Resource: Restrict the Amazon EC2 tags a principal can set on compute resources - AWS Batch
Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

Resource: Restrict the Amazon EC2 tags a principal can set on compute resources

Use the following policy to control the tags a principal sets when they create or update a compute environment. The policy requires the principal to always set a CostCenter compute resource tag with an approved value and a Team compute resource tag. This policy demonstrates how to use the batch:ComputeResourcesTag/tag-key condition key to enforce a tagging convention on the Amazon EC2 instances that a compute environment manages. For more information, see Control access to compute resource tags with condition keys. To also restrict which tag keys a principal can set, use the complementary batch:ComputeResourcesTagKeys condition key. For an example, see Example: Restrict the compute resource tag keys a principal can set.

The first statement allows the compute environment actions when the CostCenter tag is engineering. The second statement denies the actions whenever a request omits the Team compute resource tag, whether or not the request sets any other compute resource tags.

Requires a Team tag on every request

This policy denies every compute environment create or update that doesn't include a Team compute resource tag. AWS Batch evaluates batch:ComputeResourcesTag/tag-key only when your request includes computeResources.tags. The Null condition operator in the second statement matches whenever the Team compute resource tag is absent. This includes a request that sets no compute resource tags at all.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowApprovedCostCenterTag",
      "Effect": "Allow",
      "Action": [
        "batch:CreateComputeEnvironment",
        "batch:UpdateComputeEnvironment"
      ],
      "Resource": "arn:aws:batch:*:*:compute-environment/*",
      "Condition": {
        "StringEquals": {
          "batch:ComputeResourcesTag/CostCenter": "engineering"
        }
      }
    },
    {
      "Sid": "DenyMissingTeamTag",
      "Effect": "Deny",
      "Action": [
        "batch:CreateComputeEnvironment",
        "batch:UpdateComputeEnvironment"
      ],
      "Resource": "arn:aws:batch:*:*:compute-environment/*",
      "Condition": {
        "Null": {
          "batch:ComputeResourcesTag/Team": "true"
        }
      }
    }
  ]
}