# Grant permission to tag resources on creation
The following tag-on create Amazon ECS API actions allow you to specify tags when you create the resource. If tags are specified in the resource-creating action, AWS performs additional authorization to verify that the correct permissions are assigned to create tags.
+ `CreateCapacityProvider`
+ `CreateCluster`
+ `CreateService`
+ `CreateTaskSet`
+ `RegisterContainerInstance`
+ `RegisterTaskDefinition`
+ `RunTask`
+ `StartTask`
You can use resource tags to implement attribute-based control (ABAC). For more information, see [Control access to Amazon ECS resources using resource tags](control-access-with-tags.md) and [Tagging Amazon ECS resources](ecs-using-tags.md).
To allow tagging on creation, create or modify a policy to include both the permissions to use the action that creates the resource, such as `ecs:CreateCluster` or `ecs:RunTask` and the `ecs:TagResource` action.
The following example demonstrates a policy that allows users to create clusters and add tags during the cluster creation. Users are not permitted to tag any existing resources (they cannot call the `ecs:TagResource` action directly).
```
{
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:CreateCluster"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ecs:TagResource"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"ecs:CreateAction": [
"CreateCluster",
"CreateCapacityProvider",
"CreateService",
"CreateTaskSet",
"RegisterContainerInstance",
"RegisterTaskDefinition",
"RunTask",
"StartTask"
]
}
}
}
]
}
```
The `ecs:TagResource` action is only evaluated if tags are applied during the resource-creating action. Therefore, a user that has permissions to create a resource (assuming there are no tagging conditions) does not require permissions to use the `ecs:TagResource` action if no tags are specified in the request. However, if the user attempts to create a resource with tags, the request fails if the user does not have permissions to use the `ecs:TagResource` action.
## Amazon ECS control access to specific tags
You can use additional conditions in the `Condition` element of your IAM policies to control the tag keys and values that can be applied to resources.
The following condition keys can be used with the examples in the preceding section:
+ `aws:RequestTag`: To indicate that a particular tag key or tag key and value must be present in a request. Other tags can also be specified in the request.
+ Use with the `StringEquals` condition operator to enforce a specific tag key and value combination, for example, to enforce the tag `cost-center`=`cc123`:
```
"StringEquals": { "aws:RequestTag/cost-center": "cc123" }
```
+ Use with the `StringLike` condition operator to enforce a specific tag key in the request; for example, to enforce the tag key `purpose`:
```
"StringLike": { "aws:RequestTag/purpose": "*" }
```
+ `aws:TagKeys`: To enforce the tag keys that are used in the request.
+ Use with the `ForAllValues` modifier to enforce specific tag keys if they are provided in the request (if tags are specified in the request, only specific tag keys are allowed; no other tags are allowed). For example, the tag keys `environment` or `cost-center` are allowed:
```
"ForAllValues:StringEquals": { "aws:TagKeys": ["environment","cost-center"] }
```
+ Use with the `ForAnyValue` modifier to enforce the presence of at least one of the specified tag keys in the request. For example, at least one of the tag keys `environment` or `webserver` must be present in the request:
```
"ForAnyValue:StringEquals": { "aws:TagKeys": ["environment","webserver"] }
```
These condition keys can be applied to resource-creating actions that support tagging, as well as the `ecs:TagResource` action. To learn whether an Amazon ECS API action supports tagging, see [Actions, resources, and condition keys for Amazon ECS](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticcontainerservice.html).
To force users to specify tags when they create a resource, you must use the `aws:RequestTag` condition key or the `aws:TagKeys` condition key with the `ForAnyValue` modifier on the resource-creating action. The `ecs:TagResource` action is not evaluated if a user does not specify tags for the resource-creating action.
For conditions, the condition key is not case-sensitive and the condition value is case-sensitive. Therefore, to enforce the case-sensitivity of a tag key, use the `aws:TagKeys` condition key, where the tag key is specified as a value in the condition.
For more information about multi-value conditions, see [Conditions with multiple context keys or values](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-logic-multiple-context-keys-or-values.html) in the *IAM User Guide*.
# Control access to Amazon ECS resources using resource tags
When you create an IAM policy that grants users permission to use Amazon ECS resources, you can include tag information in the `Condition` element of the policy to control access based on tags. This is known as attribute-based access control (ABAC). ABAC provides better control over which resources a user can modify, use, or delete. For more information, see [What is ABAC for AWS?](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction_attribute-based-access-control.html)
For example, you can create a policy that allows users to delete a cluster, but denies the action if the cluster has the tag `environment=production`. To do this, you use the `aws:ResourceTag` condition key to allow or deny access to the resource based on the tags that are attached to the resource.
```
"StringEquals": { "aws:ResourceTag/environment": "production" }
```
To learn whether an Amazon ECS API action supports controlling access using the `aws:ResourceTag` condition key, see [Actions, resources, and condition keys for Amazon ECS](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticcontainerservice.html). Note that the `Describe` actions do not support resource-level permissions, so you must specify them in a separate statement without conditions.
For example IAM policies, see [Amazon ECS Example policies](iam-policies-ecs-console.md).
If you allow or deny users access to resources based on tags, you must consider explicitly denying users the ability to add those tags to or remove them from the same resources. Otherwise, it's possible for a user to circumvent your restrictions and gain access to a resource by modifying its tags.
# Amazon ECS Example policies
You can use IAM policies to grant users permissions to view and work with specific resources in the Amazon ECS console. You can use the example policies in the previous section; however, they are designed for requests that are made with the AWS CLI or an AWS SDK.
## Example: Allow users to delete an Amazon ECS cluster based on tags
The following policy allows users to delete clusters when the tag has a key/value pair of "Purpose/Testing".
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Action": [
"ecs:DeleteCluster"
],
"Effect": "Allow",
"Resource": "arn:aws:ecs:us-east-1:111122223333:cluster/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/Purpose": "Testing"
}
}
}
]
}
```
------