Currently CloudFormation does have the ability pass the tag for "resourceType": "network-interface" to the RunInstances API request when an AWS::EC2::Instance resource is created.
It is also not passed even if we use a AWS::EC2::LaunchTemplate by specifying the LaunchTemplateTagSpecification property with ResourceType: network-interface.
However, it is possible from EC2 console or CLI to pass the tag "resourceType": "network-interface" while launching the instance as referenced in this EC2 documentation Add a tag when you launch an instance. This includes the tag in the RunInstances API request.
Other Details
One of the use cases of this feature is to ensure that all EC2 instances created from CloudFormation and it's associated resources are tagged properly. If there is an SCP in place that denies ec2:RunInstances on resource arn:aws:ec2:*:*:network-interface/* based on a tag condition, it always fails because the tag is not passed from CloudFormation. However, it works from EC2 console or CLI.
Name of the resource
AWS::EC2::Instance
Resource name
No response
Description
Currently CloudFormation does have the ability pass the tag for
"resourceType": "network-interface"to the RunInstances API request when anAWS::EC2::Instanceresource is created.It is also not passed even if we use a
AWS::EC2::LaunchTemplateby specifying the LaunchTemplateTagSpecification property withResourceType: network-interface.However, it is possible from EC2 console or CLI to pass the tag
"resourceType": "network-interface"while launching the instance as referenced in this EC2 documentation Add a tag when you launch an instance. This includes the tag in theRunInstancesAPI request.Other Details
One of the use cases of this feature is to ensure that all EC2 instances created from CloudFormation and it's associated resources are tagged properly. If there is an SCP in place that denies
ec2:RunInstanceson resourcearn:aws:ec2:*:*:network-interface/*based on a tag condition, it always fails because the tag is not passed from CloudFormation. However, it works from EC2 console or CLI.