Tagging governance using AWS Organizations in the public sector

When Department of the Air Force (DAF) software factories scale their cloud operations across mission-critical environments, maintaining consistent resource tagging becomes crucial for security, compliance, and operational effectiveness. For organizations like Kessel Run, a unit that provides capabilities within the DAF Battle Network, ensuring compliance while maintaining rapid deployment capabilities is essential for delivering capabilities to warfighters.

Traditional approaches using reactive cleanup scripts and post-creation enforcement often lead to compliance gaps and significant operational overhead, potentially impacting mission readiness. Kessel Run needed a solution that could enforce tagging standards at resource creation while supporting their complex deployment patterns.

Objectives

Organizations using HAQM Web Services (AWS) at scale need consistent resource tagging for cost allocation, security compliance, and operational management. Reactive tagging enforcement through scheduled jobs and resource termination scripts, rather than native AWS event-driven controls, creates unnecessary operational complexity.

Kessel Run faced several key challenges related to mission-critical resource management:

• Managing HAQM Elastic Compute Cloud (HAQM EC2) instances across disparate AWS accounts
• Maintaining compliance with DAF security requirements
• Eliminating operational overhead from managing AWS Lambda functions used for policy enforcement

Building a preventative solution with AWS Organizations working within requirements, the team developed a preventative control system using service control policies (SCPs) and formal logic principles.

The solution needed to:

• Enforce tagging at resource creation time
• Scale across multiple accounts

By choosing to leverage AWS Organizations SCPs, they built a solution that meets these requirements while ensuring extensibility for further use cases including:

• Ensuring consistent backup policies for mission-critical resources
  • Maintaining different backup policies based on mission criticality
• Support flexible deployment patterns across security boundaries
  • Including AWS Hybrid Edge deployments

The following illustration demonstrates the tagging governance framework designed by the Kessel Run team. It shows how business requirements directly map to specific required tags, which are then enforced through SCPs at resource creation time. This preventative approach ensures consistent tagging across multiple accounts while supporting specialized use cases.

Figure 1. Tagging governance framework showing how business requirements translate to required tags and enforcement through SCP policy, with AWS Backup plans integration.

The power of De Morgan’s laws in SCP design

The core challenge was implementing complex logical conditions within SCPs while meeting strict security requirements. The requirement to “allow resource creation if valid tags are present OR the resource matches an exception pattern” couldn’t leverage traditional policy statements normally used in SCPs.

Here’s where De Morgan’s laws come into play. Instead of expressing the positive condition, the Kessel Run team inverted the logic:

Original business logic

Transformed using De Morgan’s laws

This transformation allows organizations to implement complex logical conditions while working within SCP constraints. Here’s how it looks in practice:

This policy denies HAQM EC2 instance creation if:

• The OutpostIdentifier tag is missing AND
• The DeploymentType tag is not set to either “edge”, “core”, or “hybrid” AND
• The BackupCompliance tag is not set to either “mission-critical” or “business-critical” AND
• The BusinessUnit tag doesn’t start with “infra-“

In simpler terms, all HAQM EC2 instances must:

• Have an OutpostIdentifier tag
• Be tagged with an approved deployment type
• Have a valid backup compliance level
• Belong to an infrastructure business unit

Sample Solution

The following illustration shows the technical implementation of the tagging governance solution. The architecture diagram demonstrates how SCPs enforce tag requirements across both cloud and edge environments. A compliance test Lambda function validates the enforcement mechanism, ensuring that HAQM EC2 instances in both standard VPC and AWS Outposts environments have the required tags before creation. The diagram also shows how backup policies are applied based on tag values, creating an end-to-end governance framework that works consistently across deployment models.

Figure 2. Technical architecture diagram showing SCP enforcement flow and sample Lambda function used to demo the enforcement of the SCP.

To demonstrate this tagging governance solution in practice, a sample implementation package is available that can be deployed in any AWS environment. This allows organizations to experience the tag enforcement mechanism firsthand and validate its effectiveness for their specific use cases.

Implementation steps:

• Deploy the sample solution using provided templates
• Create Lambda test events (shown in Figure 3)
• Test resource creation with compliant and non-compliant tags
• Observe enforcement behaviors

Figure 3. Creating a test event in the Lambda console.

The following table provides an overview of test scenarios:

The following Figure 4 shows an HAQM EC2 launch attempt with compliant tags.

Figure 4. Successful HAQM EC2 launch with required tags.

Figure 5 shows an HAQM EC2 launch denial due to missing tags.

Figure 5. Resource creation blocked due to missing required tags.

Conclusion

SCPs represent a significant advancement in AWS resource tagging governance. By enforcing tags at creation time, organizations ensure compliance from the start rather than relying on after-the-fact corrections. This preventative approach eliminates reactive scripts and Lambda functions, reducing both operational overhead and API costs.

The solution scales seamlessly across multiple AWS accounts while maintaining consistent enforcement. Through De Morgan’s laws, organizations can implement complex logical conditions within SCP constraints. The provided sample implementation lets teams validate this approach in a controlled environment before production deployment.

For organizations like Kessel Run, this tagging governance solution delivers both immediate operational benefits and strategic advantages in security and compliance. The framework provides a solid foundation that can evolve with changing cloud governance needs.