cis-aws-compute-2-4

name	cis-aws-compute-2.4
description	Ensure an Organizational EC2 Tag Policy has been Created
category	cis-compute
version	1.1.0
author	cyberstrike-official
tags	["cis","aws","compute","ec2","tag-policy","organizations","compliance"]
cis_id	2.4
cis_benchmark	CIS AWS Compute Services Benchmark v1.1.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-compute-2.3","cis-aws-compute-2.14"]
prerequisites	[]
severity_boost	{}

Ensure an Organizational EC2 Tag Policy has been Created

Description

A tag policy enables you to define tag compliance rules to help you maintain consistency in the tags attached to your organization's resources.

Rationale

You can use an EC2 tag policy to enforce your tag strategy across all of your EC2 resources.

Impact

Creating and enforcing tag policies may prevent resource creation if tags do not comply with the defined policy, potentially affecting automated deployments.

Audit Procedure

Using AWS CLI

No specific CLI audit command is provided for this control. Use the console method below.

Using AWS Console

1. Login to the AWS Organizations using https://console.aws.amazon.com/organizations/
2. On the left click Policies.
3. Click on Tag policies.
4. Confirm that a policy name exists with a description.
5. Click on the policy for EC2 Tagging as indicated in the name, description or both.
6. Click on Edit policy.
7. Confirm that Tag key capitalization compliance is checked.
8. Confirm that Prevent non-compliant operations for this tag is checked.
9. Confirm that ec2:image, ec2:instance and ec2:reserved-instances are listed.

If the tag policy does not exist with the settings listed above refer to the remediation below.

Expected Result

An EC2 tag policy should exist with Tag key capitalization compliance enabled, non-compliant operations prevented, and ec2:image, ec2:instance, and ec2:reserved-instances resource types specified.

Remediation

Using AWS CLI

No specific CLI remediation command is provided for this control. Use the console method below.

Using AWS Console

You must sign in as an IAM user, assume an IAM role, or sign in as the root user (not recommended) in the organization's management account.

To create a tag policy:

1. Login to the AWS Organizations using https://console.aws.amazon.com/organizations/
2. Left hand side Click on Policies.
3. Under Support policy types click on Tag policies.
4. Under Available policies click on Create policy.