IAM / management / tag

AWS Tag (IAM)

JSON →
AWStagmanagement

AWS Tag service enables you to manage tags on AWS resources for cost allocation, access control, and resource organization.

iamaws
docs ↗
Permissions
Actions in this service
tag:GetResources
tag:GetTagKeys
tag:GetTagValues
tag:TagResources
tag:UntagResources
tag:GetComplianceSummary
tag:ListRequiredTags
tag:DescribeReportCreation
Policy
Minimal privilege example

Copy-paste least-privilege policy statement — not yet harness-verified.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "tag:GetResources", "tag:GetTagKeys", "tag:GetTagValues", "tag:TagResources", "tag:UntagResources", "tag:GetComplianceSummary", "tag:ListRequiredTags", "tag:DescribeReportCreation" ], "Resource": "*" } ] }
SDK mapping
Method → permission

SDK method mapping (e.g. boto3.get_object() → s3:GetObject) is not yet collected.

Footguns
Known gotchas
Avoid tag:TagResources and tag:UntagResources on all resources — can modify tags on critical resources affecting cost tracking and access policies
Avoid tag:* — grants full control over tagging, which can be used to bypass resource-based policies or cost allocation
Resources
docshttps://servicereference.us-east-1.amazonaws.com/v1/tag/tag.json ↗