# ResourceGroupsTaggingAPITagUntagSupportedResources **Description**: Provides permissions to tag and untag all the resources supported by Resource Groups Tagging API. This policy also grants the permissions required to retrieve all tagged, or previously tagged, resources through the Resource Groups Tagging API. `ResourceGroupsTaggingAPITagUntagSupportedResources` is an [AWS managed policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies). ## Using this policy You can attach `ResourceGroupsTaggingAPITagUntagSupportedResources` to your users, groups, and roles. ## Policy details + **Type**: AWS managed policy + **Creation time**: October 11, 2024, 11:11 UTC + **Edited time:** February 12, 2026, 18:00 UTC + **ARN**: `arn:aws:iam::aws:policy/ResourceGroupsTaggingAPITagUntagSupportedResources` ## Policy version **Policy version:** v4 (default) The policy's default version is the version that defines the permissions for the policy. When a user or role with the policy makes a request to access an AWS resource, AWS checks the default version of the policy to determine whether to allow the request. ## JSON policy document ``` { "Version" : "2012-10-17", "Statement" : [ { "Effect" : "Allow", "Action" : [ "a4b:TagResource", "a4b:UntagResource", "access-analyzer:TagResource", "access-analyzer:UntagResource", "acm-pca:TagCertificateAuthority", "acm-pca:UntagCertificateAuthority", "acm:AddTagsToCertificate", "acm:RemoveTagsFromCertificate", "amplify:TagResource", "amplify:UntagResource", "appconfig:TagResource", "appconfig:UntagResource", "appflow:TagResource", "appflow:UntagResource", "appmesh:TagResource", "appmesh:UntagResource", "appstream:TagResource", "appstream:UntagResource", "appsync:TagResource", "appsync:UntagResource", "athena:TagResource", "athena:UntagResource", "auditmanager:TagResource", "auditmanager:UntagResource", "autoscaling:CreateOrUpdateTags", "autoscaling:DeleteTags", "backup:TagResource", "backup:UntagResource", "batch:TagResource", "batch:UntagResource", "braket:TagResource", "braket:UntagResource", "cassandra:TagResource", "cassandra:UntagResource", "chime:TagResource", "chime:UntagResource", "cloud9:TagResource", "cloud9:UntagResource", "clouddirectory:TagResource", "clouddirectory:UntagResource", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudhsm:TagResource", "cloudhsm:UntagResource", "cloudtrail:AddTags", "cloudtrail:RemoveTags", "cloudwatch:TagResource", "cloudwatch:UntagResource", "codeartifact:TagResource", "codeartifact:UntagResource", "codecommit:TagResource", "codecommit:UntagResource", "codedeploy:AddTagsToOnPremisesInstances", "codedeploy:RemoveTagsFromOnPremisesInstances", "codedeploy:TagResource", "codedeploy:UntagResource", "codeguru-profiler:TagResource", "codeguru-profiler:UntagResource", "codepipeline:TagResource", "codepipeline:UntagResource", "codestar-connections:TagResource", "codestar-connections:UntagResource", "codestar:TagProject", "codestar:UntagProject", "cognito-identity:TagResource", "cognito-identity:UntagResource", "cognito-idp:TagResource", "cognito-idp:UntagResource", "comprehend:TagResource", "comprehend:UntagResource", "config:TagResource", "config:UntagResource", "connect:TagResource", "connect:UntagResource", "dataexchange:TagResource", "dataexchange:UntagResource", "datapipeline:AddTags", "datapipeline:RemoveTags", "datasync:TagResource", "datasync:UntagResource", "deepcomposer:TagResource", "deepcomposer:UntagResource", "detective:TagResource", "detective:UntagResource", "devicefarm:TagResource", "devicefarm:UntagResource", "directconnect:TagResource", "directconnect:UntagResource", "dlm:TagResource", "dlm:UntagResource", "dms:AddTagsToResource", "dms:RemoveTagsFromResource", "dynamodb:TagResource", "dynamodb:UntagResource", "ec2:CreateTags", "ec2:DeleteTags", "ecr:TagResource", "ecr:UntagResource", "ecs:TagResource", "ecs:UntagResource", "eks:TagResource", "eks:UntagResource", "elastic-inference:TagResource", "elastic-inference:UntagResource", "elasticache:AddTagsToResource", "elasticache:RemoveTagsFromResource", "elasticbeanstalk:UpdateTagsForResource", "elasticfilesystem:CreateTags", "elasticfilesystem:DeleteTags", "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", "elasticmapreduce:AddTags", "elasticmapreduce:RemoveTags", "emr-containers:TagResource", "emr-containers:UntagResource", "es:AddTags", "es:RemoveTags", "events:TagResource", "events:UntagResource", "firehose:TagDeliveryStream", "firehose:UntagDeliveryStream", "fms:TagResource", "fms:UntagResource", "forecast:TagResource", "forecast:UntagResource", "frauddetector:TagResource", "frauddetector:UntagResource", "fsx:TagResource", "fsx:UntagResource", "gamelift:TagResource", "gamelift:UntagResource", "glacier:AddTagsToVault", "glacier:RemoveTagsFromVault", "globalaccelerator:TagResource", "globalaccelerator:UntagResource", "glue:TagResource", "glue:UntagResource", "greengrass:TagResource", "greengrass:UntagResource", "groundstation:TagResource", "groundstation:UntagResource", "guardduty:TagResource", "guardduty:UntagResource", "iam:TagInstanceProfile", "iam:TagMFADevice", "iam:TagOpenIDConnectProvider", "iam:TagPolicy", "iam:TagRole", "iam:TagSAMLProvider", "iam:TagServerCertificate", "iam:TagUser", "iam:UntagInstanceProfile", "iam:UntagMFADevice", "iam:UntagOpenIDConnectProvider", "iam:UntagPolicy", "iam:UntagRole", "iam:UntagSAMLProvider", "iam:UntagServerCertificate", "iam:UntagUser", "imagebuilder:TagResource", "imagebuilder:UntagResource", "inspector:ListTagsForResource", "inspector:SetTagsForResource", "iot1click:TagResource", "iot1click:UntagResource", "iot:TagResource", "iot:UntagResource", "iotanalytics:TagResource", "iotanalytics:UntagResource", "iotdeviceadvisor:TagResource", "iotdeviceadvisor:UntagResource", "iotevents:TagResource", "iotevents:UntagResource", "iotfleethub:TagResource", "iotfleethub:UntagResource", "iotsitewise:TagResource", "iotsitewise:UntagResource", "iottwinmaker:TagResource", "iottwinmaker:UntagResource", "iotwireless:TagResource", "iotwireless:UntagResource", "ivs:TagResource", "ivs:UntagResource", "kafka:TagResource", "kafka:UntagResource", "kendra:TagResource", "kendra:UntagResource", "kinesis:AddTagsToStream", "kinesis:RemoveTagsFromStream", "kinesisanalytics:TagResource", "kinesisanalytics:UntagResource", "kms:TagResource", "kms:UntagResource", "lambda:TagResource", "lambda:UntagResource", "lex:TagResource", "lex:UntagResource", "license-manager:TagResource", "license-manager:UntagResource", "lightsail:TagResource", "lightsail:UntagResource", "logs:TagLogGroup", "logs:TagResource", "logs:UntagLogGroup", "logs:UntagResource", "lookoutequipment:TagResource", "lookoutequipment:UntagResource", "machinelearning:AddTags", "machinelearning:DeleteTags", "macie2:TagResource", "macie2:UntagResource", "managedblockchain:TagResource", "managedblockchain:UntagResource", "mediaconnect:TagResource", "mediaconnect:UntagResource", "mediaconvert:TagResource", "mediaconvert:UntagResource", "medialive:CreateTags", "medialive:DeleteTags", "mediapackage-vod:TagResource", "mediapackage-vod:UntagResource", "mediapackage:TagResource", "mediapackage:UntagResource", "mediatailor:TagResource", "mediatailor:UntagResource", "mobiletargeting:TagResource", "mobiletargeting:UntagResource", "mq:CreateTags", "mq:DeleteTags", "neptune-graph:TagResource", "neptune-graph:UntagResource", "network-firewall:TagResource", "network-firewall:UntagResource", "networkmanager:TagResource", "networkmanager:UntagResource", "opsworks-cm:TagResource", "opsworks-cm:UntagResource", "opsworks:TagResource", "opsworks:UntagResource", "organizations:TagResource", "organizations:UntagResource", "outposts:TagResource", "outposts:UntagResource", "qldb:TagResource", "qldb:UntagResource", "quicksight:TagResource", "quicksight:UntagResource", "ram:TagResource", "ram:UntagResource", "rds:AddTagsToResource", "rds:RemoveTagsFromResource", "redshift:CreateTags", "redshift:DeleteTags", "resource-explorer-2:TagResource", "resource-explorer-2:UntagResource", "resource-groups:Tag", "resource-groups:Untag", "robomaker:TagResource", "robomaker:UntagResource", "route53:ChangeTagsForResource", "route53domains:DeleteTagsForDomain", "route53domains:UpdateTagsForDomain", "route53resolver:TagResource", "route53resolver:UntagResource", "s3:GetBucketTagging", "s3:GetJobTagging", "s3:GetObjectTagging", "s3:GetObjectVersionTagging", "s3:GetStorageLensConfigurationTagging", "s3:DeleteJobTagging", "s3:DeleteObjectTagging", "s3:DeleteObjectVersionTagging", "s3:PutBucketTagging", "s3:PutJobTagging", "s3:PutObjectTagging", "s3:PutObjectVersionTagging", "s3:PutStorageLensConfigurationTagging", "s3:DeleteStorageLensConfigurationTagging", "s3:TagResource", "s3:UntagResource", "sagemaker:AddTags", "sagemaker:DeleteTags", "savingsplans:TagResource", "savingsplans:UntagResource", "schemas:TagResource", "schemas:UntagResource", "secretsmanager:TagResource", "secretsmanager:UntagResource", "securityhub:TagResource", "securityhub:UntagResource", "servicediscovery:TagResource", "servicediscovery:UntagResource", "servicequotas:TagResource", "servicequotas:UntagResource", "ses:TagResource", "ses:UntagResource", "sns:TagResource", "sns:UntagResource", "sqs:TagQueue", "sqs:UntagQueue", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "states:TagResource", "states:UntagResource", "storagegateway:AddTagsToResource", "storagegateway:RemoveTagsFromResource", "swf:TagResource", "swf:UntagResource", "synthetics:TagResource", "synthetics:UntagResource", "tag:GetResources", "tag:TagResources", "tag:UntagResources", "transfer:TagResource", "transfer:UntagResource", "waf-regional:TagResource", "waf-regional:UntagResource", "waf:TagResource", "waf:UntagResource", "wafv2:TagResource", "wafv2:UntagResource", "worklink:TagResource", "worklink:UntagResource", "workmail:TagResource", "workmail:UntagResource", "workspaces:CreateTags", "workspaces:DeleteTags", "xray:TagResource", "xray:UntagResource", "kinesisvideo:TagResource", "kinesisvideo:UntagResource", "redshift-serverless:TagResource", "redshift-serverless:UntagResource", "route53-recovery-control-config:TagResource", "route53-recovery-control-config:UntagResource", "route53-recovery-readiness:TagResource", "route53-recovery-readiness:UntagResource", "ssm-contacts:TagResource", "ssm-contacts:UntagResource", "ssm-incidents:TagResource", "ssm-incidents:UntagResource", "vpc-lattice:TagResource", "vpc-lattice:UntagResource", "workspaces-web:TagResource", "workspaces-web:UntagResource" ], "Resource" : "*" } ] } ``` ## Learn more + [Create a permission set using AWS managed policies in IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html) + [Adding and removing IAM identity permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) + [Understand versioning for IAM policies](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html) + [Get started with AWS managed policies and move toward least-privilege permissions](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)