AWS::EC2::SecurityGroup - Tagging-OnCreate

mderoquefeuil commented 3 years ago

Scope of request

AWS::EC2::SecurityGroup - when I have an IAM deny statement to create a security group without a specifig tag (aws:RequestTags), I can create resource via API, but not via CloudFormation.

Expected behavior

When I create a security group with an IAM policy to enforce tagging, I should be able to create the resource through API or CloudFormation the same way. So far :

Creating through API/GUI works
Creating through CloudFormation does not work

Suggest specific test cases

Prerequisites

IAM deny policy should be as follow :

- Effect: "Deny"
  Action: 
    - "ec2:CreateSecurityGroup"
  Resource: 
    - "arn:aws:ec2:*:*:security-group/*"
  Condition: 
    "StringNotLike":
    "aws:RequestTag/project":
      - "?*"

User should use the Administrator Policy.

Test case success

CFN Template should be just creating a SG with the tag "project" set to any value with 1 or more character. When running, the template should be successful.

Test case failure

CFN Template should be just creating a SG with no tag "project" set. When running, the template should be failing because of a lack of rights.

Category

Networking & Content : Security Group

Cushdrive commented 3 years ago

I looked at Cloudtrail and, at least in my case, CloudFormation is creating the resource and then tagging it in a separate operation. It's messing up my whole template because DependsOn doesn't wait for the tags to be created.