DescribeReportCreation

$result = $client->describeReportCreation([/* ... */]);
$promise = $client->describeReportCreationAsync([/* ... */]);

Describes the status of the StartReportCreation operation.

You can call this operation only from the organization's management account and from the us-east-1 Region.

Parameter Syntax

$result = $client->describeReportCreation([
]);

Parameter Details

Result Syntax

[
    'ErrorMessage' => '<string>',
    'S3Location' => '<string>',
    'Status' => '<string>',
]

Result Details

Errors

ConstraintViolationException:

The request failed because performing the operation would violate a constraint.

Some of the reasons in the following list might not apply to this specific operation.

• You must meet the prerequisites for using tag policies. For information, see Prerequisites and permissions in the Tagging Amazon Web Services resources and Tag Editor user guide.

• You must enable the tag policies service principal (tagpolicies.tag.amazonaws.com) to integrate with Organizations For information, see EnableAWSServiceAccess.

• You must have a tag policy attached to the organization root, an OU, or an account.

InternalServiceException:

The request processing failed because of an unknown error, exception, or failure. You can retry the request.

InvalidParameterException:

The request failed because of one of the following reasons:

• A required parameter is missing.

• A provided string parameter is malformed.

• An provided parameter value is out of range.

• The target ID is invalid, unsupported, or doesn't exist.

• You can't access the Amazon S3 bucket for report storage. For more information, see Amazon S3 bucket policy for report storage in the Tagging Amazon Web Services resources and Tag Editor user guide.

• The partition specified in an ARN parameter in the request doesn't match the partition where you invoked the operation. The partition is specified by the second field of the ARN.

ThrottledException:

The request failed because it exceeded the allowed frequency of submitted requests.

GetComplianceSummary

$result = $client->getComplianceSummary([/* ... */]);
$promise = $client->getComplianceSummaryAsync([/* ... */]);

Returns a table that shows counts of resources that are noncompliant with their tag policies.

For more information on tag policies, see Tag Policies in the Organizations User Guide.

You can call this operation only from the organization's management account and from the us-east-1 Region.

This operation supports pagination, where the response can be sent in multiple pages. You should check the PaginationToken response parameter to determine if there are additional results available to return. Repeat the query, passing the PaginationToken response parameter value as an input to the next request until you recieve a null value. A null value for PaginationToken indicates that there are no more results waiting to be returned.

Parameter Syntax

$result = $client->getComplianceSummary([
    'GroupBy' => ['<string>', ...],
    'MaxResults' => <integer>,
    'PaginationToken' => '<string>',
    'RegionFilters' => ['<string>', ...],
    'ResourceTypeFilters' => ['<string>', ...],
    'TagKeyFilters' => ['<string>', ...],
    'TargetIdFilters' => ['<string>', ...],
]);

Parameter Details

Result Syntax

[
    'PaginationToken' => '<string>',
    'SummaryList' => [
        [
            'LastUpdated' => '<string>',
            'NonCompliantResources' => <integer>,
            'Region' => '<string>',
            'ResourceType' => '<string>',
            'TargetId' => '<string>',
            'TargetIdType' => 'ACCOUNT|OU|ROOT',
        ],
        // ...
    ],
]

Result Details

Errors

ConstraintViolationException:

The request failed because performing the operation would violate a constraint.

Some of the reasons in the following list might not apply to this specific operation.

• You must meet the prerequisites for using tag policies. For information, see Prerequisites and permissions in the Tagging Amazon Web Services resources and Tag Editor user guide.

• You must enable the tag policies service principal (tagpolicies.tag.amazonaws.com) to integrate with Organizations For information, see EnableAWSServiceAccess.

• You must have a tag policy attached to the organization root, an OU, or an account.

InternalServiceException:

The request processing failed because of an unknown error, exception, or failure. You can retry the request.

InvalidParameterException:

The request failed because of one of the following reasons:

• A required parameter is missing.

• A provided string parameter is malformed.

• An provided parameter value is out of range.

• The target ID is invalid, unsupported, or doesn't exist.

• You can't access the Amazon S3 bucket for report storage. For more information, see Amazon S3 bucket policy for report storage in the Tagging Amazon Web Services resources and Tag Editor user guide.

• The partition specified in an ARN parameter in the request doesn't match the partition where you invoked the operation. The partition is specified by the second field of the ARN.

ThrottledException:

The request failed because it exceeded the allowed frequency of submitted requests.

GetResources

$result = $client->getResources([/* ... */]);
$promise = $client->getResourcesAsync([/* ... */]);

Returns all the tagged or previously tagged resources that are located in the specified Amazon Web Services Region for the account.

Depending on what information you want returned, you can also specify the following:

• Filters that specify what tags and resource types you want returned. The response includes all tags that are associated with the requested resources.

• Information about compliance with the account's effective tag policy. For more information on tag policies, see Tag Policies in the Organizations User Guide.

This operation supports pagination, where the response can be sent in multiple pages. You should check the PaginationToken response parameter to determine if there are additional results available to return. Repeat the query, passing the PaginationToken response parameter value as an input to the next request until you recieve a null value. A null value for PaginationToken indicates that there are no more results waiting to be returned.

Parameter Syntax

$result = $client->getResources([
    'ExcludeCompliantResources' => true || false,
    'IncludeComplianceDetails' => true || false,
    'PaginationToken' => '<string>',
    'ResourceARNList' => ['<string>', ...],
    'ResourceTypeFilters' => ['<string>', ...],
    'ResourcesPerPage' => <integer>,
    'TagFilters' => [
        [
            'Key' => '<string>',
            'Values' => ['<string>', ...],
        ],
        // ...
    ],
    'TagsPerPage' => <integer>,
]);

Parameter Details

Result Syntax

[
    'PaginationToken' => '<string>',
    'ResourceTagMappingList' => [
        [
            'ComplianceDetails' => [
                'ComplianceStatus' => true || false,
                'KeysWithNoncompliantValues' => ['<string>', ...],
                'NoncompliantKeys' => ['<string>', ...],
            ],
            'ResourceARN' => '<string>',
            'Tags' => [
                [
                    'Key' => '<string>',
                    'Value' => '<string>',
                ],
                // ...
            ],
        ],
        // ...
    ],
]

Result Details

Errors

InvalidParameterException:

The request failed because of one of the following reasons:

• A required parameter is missing.

• A provided string parameter is malformed.

• An provided parameter value is out of range.

• The target ID is invalid, unsupported, or doesn't exist.

• You can't access the Amazon S3 bucket for report storage. For more information, see Amazon S3 bucket policy for report storage in the Tagging Amazon Web Services resources and Tag Editor user guide.

• The partition specified in an ARN parameter in the request doesn't match the partition where you invoked the operation. The partition is specified by the second field of the ARN.

ThrottledException:

The request failed because it exceeded the allowed frequency of submitted requests.

InternalServiceException:

The request processing failed because of an unknown error, exception, or failure. You can retry the request.

PaginationTokenExpiredException:

The request failed because the specified PaginationToken has expired. A PaginationToken is valid for a maximum of 15 minutes.

GetTagKeys

$result = $client->getTagKeys([/* ... */]);
$promise = $client->getTagKeysAsync([/* ... */]);

Returns all tag keys currently in use in the specified Amazon Web Services Region for the calling account.

This operation supports pagination, where the response can be sent in multiple pages. You should check the PaginationToken response parameter to determine if there are additional results available to return. Repeat the query, passing the PaginationToken response parameter value as an input to the next request until you recieve a null value. A null value for PaginationToken indicates that there are no more results waiting to be returned.

Parameter Syntax

$result = $client->getTagKeys([
    'PaginationToken' => '<string>',
]);

Parameter Details

Result Syntax

[
    'PaginationToken' => '<string>',
    'TagKeys' => ['<string>', ...],
]

Result Details

Errors

InvalidParameterException:

The request failed because of one of the following reasons:

• A required parameter is missing.

• A provided string parameter is malformed.

• An provided parameter value is out of range.

• The target ID is invalid, unsupported, or doesn't exist.

• You can't access the Amazon S3 bucket for report storage. For more information, see Amazon S3 bucket policy for report storage in the Tagging Amazon Web Services resources and Tag Editor user guide.

• The partition specified in an ARN parameter in the request doesn't match the partition where you invoked the operation. The partition is specified by the second field of the ARN.

ThrottledException:

The request failed because it exceeded the allowed frequency of submitted requests.

InternalServiceException:

The request processing failed because of an unknown error, exception, or failure. You can retry the request.

PaginationTokenExpiredException:

The request failed because the specified PaginationToken has expired. A PaginationToken is valid for a maximum of 15 minutes.

GetTagValues

$result = $client->getTagValues([/* ... */]);
$promise = $client->getTagValuesAsync([/* ... */]);

Returns all tag values for the specified key that are used in the specified Amazon Web Services Region for the calling account.

This operation supports pagination, where the response can be sent in multiple pages. You should check the PaginationToken response parameter to determine if there are additional results available to return. Repeat the query, passing the PaginationToken response parameter value as an input to the next request until you recieve a null value. A null value for PaginationToken indicates that there are no more results waiting to be returned.

Parameter Syntax

$result = $client->getTagValues([
    'Key' => '<string>', // REQUIRED
    'PaginationToken' => '<string>',
]);

Parameter Details

Result Syntax

[
    'PaginationToken' => '<string>',
    'TagValues' => ['<string>', ...],
]

Result Details

Errors

InvalidParameterException:

The request failed because of one of the following reasons:

• A required parameter is missing.

• A provided string parameter is malformed.

• An provided parameter value is out of range.

• The target ID is invalid, unsupported, or doesn't exist.

• You can't access the Amazon S3 bucket for report storage. For more information, see Amazon S3 bucket policy for report storage in the Tagging Amazon Web Services resources and Tag Editor user guide.

• The partition specified in an ARN parameter in the request doesn't match the partition where you invoked the operation. The partition is specified by the second field of the ARN.

ThrottledException:

The request failed because it exceeded the allowed frequency of submitted requests.

InternalServiceException:

The request processing failed because of an unknown error, exception, or failure. You can retry the request.

PaginationTokenExpiredException:

The request failed because the specified PaginationToken has expired. A PaginationToken is valid for a maximum of 15 minutes.

ListRequiredTags

$result = $client->listRequiredTags([/* ... */]);
$promise = $client->listRequiredTagsAsync([/* ... */]);

Lists the required tags for supported resource types in an Amazon Web Services account.

Parameter Syntax

$result = $client->listRequiredTags([
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
]);

Parameter Details

Result Syntax

[
    'NextToken' => '<string>',
    'RequiredTags' => [
        [
            'CloudFormationResourceTypes' => ['<string>', ...],
            'ReportingTagKeys' => ['<string>', ...],
            'ResourceType' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

InternalServiceException:

The request processing failed because of an unknown error, exception, or failure. You can retry the request.

InvalidParameterException:

The request failed because of one of the following reasons:

• A required parameter is missing.

• A provided string parameter is malformed.

• An provided parameter value is out of range.

• The target ID is invalid, unsupported, or doesn't exist.

• You can't access the Amazon S3 bucket for report storage. For more information, see Amazon S3 bucket policy for report storage in the Tagging Amazon Web Services resources and Tag Editor user guide.

• The partition specified in an ARN parameter in the request doesn't match the partition where you invoked the operation. The partition is specified by the second field of the ARN.

PaginationTokenExpiredException:

The request failed because the specified PaginationToken has expired. A PaginationToken is valid for a maximum of 15 minutes.

ThrottledException:

The request failed because it exceeded the allowed frequency of submitted requests.

StartReportCreation

$result = $client->startReportCreation([/* ... */]);
$promise = $client->startReportCreationAsync([/* ... */]);

Generates a report that lists all tagged resources in the accounts across your organization and tells whether each resource is compliant with the effective tag policy. Compliance data is refreshed daily. The report is generated asynchronously.

The generated report is saved to the following location:

s3://amzn-s3-demo-bucket/AwsTagPolicies/o-exampleorgid/YYYY-MM-ddTHH:mm:ssZ/report.csv

For more information about evaluating resource compliance with tag policies, including the required permissions, review Permissions for evaluating organization-wide compliance in the Tagging Amazon Web Services Resources and Tag Editor user guide.

You can call this operation only from the organization's management account and from the us-east-1 Region.

If the account associated with the identity used to call StartReportCreation is different from the account that owns the Amazon S3 bucket, there must be a bucket policy attached to the bucket to provide access. For more information, review Amazon S3 bucket policy for report storage in the Tagging Amazon Web Services Resources and Tag Editor user guide.

Parameter Syntax

$result = $client->startReportCreation([
    'S3Bucket' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ConcurrentModificationException:

The request failed because the target of the operation is currently being modified by a different request. Try again later.

ConstraintViolationException:

The request failed because performing the operation would violate a constraint.

Some of the reasons in the following list might not apply to this specific operation.

• You must meet the prerequisites for using tag policies. For information, see Prerequisites and permissions in the Tagging Amazon Web Services resources and Tag Editor user guide.

• You must enable the tag policies service principal (tagpolicies.tag.amazonaws.com) to integrate with Organizations For information, see EnableAWSServiceAccess.

• You must have a tag policy attached to the organization root, an OU, or an account.

InternalServiceException:

The request processing failed because of an unknown error, exception, or failure. You can retry the request.

InvalidParameterException:

The request failed because of one of the following reasons:

• A required parameter is missing.

• A provided string parameter is malformed.

• An provided parameter value is out of range.

• The target ID is invalid, unsupported, or doesn't exist.

• You can't access the Amazon S3 bucket for report storage. For more information, see Amazon S3 bucket policy for report storage in the Tagging Amazon Web Services resources and Tag Editor user guide.

• The partition specified in an ARN parameter in the request doesn't match the partition where you invoked the operation. The partition is specified by the second field of the ARN.

ThrottledException:

The request failed because it exceeded the allowed frequency of submitted requests.

TagResources

$result = $client->tagResources([/* ... */]);
$promise = $client->tagResourcesAsync([/* ... */]);

Applies one or more tags to the specified resources. Note the following:

• Not all resources can have tags. For a list of services with resources that support tagging using this operation, see Services that support the Resource Groups Tagging API. If the resource doesn't yet support this operation, the resource's service might support tagging using its own API operations. For more information, refer to the documentation for that service.

• Each resource can have up to 50 tags. For other limits, see Tag Naming and Usage Conventions in the Amazon Web Services General Reference.

• You can only tag resources that are located in the specified Amazon Web Services Region for the Amazon Web Services account.

• To add tags to a resource, you need the necessary permissions for the service that the resource belongs to as well as permissions for adding tags. For more information, see the documentation for each service.

• When you use the Amazon Web Services Resource Groups Tagging API to update tags for Amazon Web Services CloudFormation stack sets, Amazon Web Services calls the Amazon Web Services CloudFormation UpdateStack operation. This operation may initiate additional resource property updates in addition to the desired tag updates. To avoid unexpected resource updates, Amazon Web Services recommends that you only apply or update tags to your CloudFormation stack sets using Amazon Web Services CloudFormation.

Minimum permissions

In addition to the tag:TagResources permission required by this operation, you must also have the tagging permission defined by the service that created the resource. For example, to tag an Amazon EC2 instance using the TagResources operation, you must have both of the following permissions:

• tag:TagResources

• ec2:CreateTags

Parameter Syntax

$result = $client->tagResources([
    'ResourceARNList' => ['<string>', ...], // REQUIRED
    'Tags' => ['<string>', ...], // REQUIRED
]);

Parameter Details

Result Syntax

[
    'FailedResourcesMap' => [
        '<ResourceARN>' => [
            'ErrorCode' => 'InternalServiceException|InvalidParameterException',
            'ErrorMessage' => '<string>',
            'StatusCode' => <integer>,
        ],
        // ...
    ],
]

Result Details

Errors

InvalidParameterException:

The request failed because of one of the following reasons:

• A required parameter is missing.

• A provided string parameter is malformed.

• An provided parameter value is out of range.

• The target ID is invalid, unsupported, or doesn't exist.

• You can't access the Amazon S3 bucket for report storage. For more information, see Amazon S3 bucket policy for report storage in the Tagging Amazon Web Services resources and Tag Editor user guide.

• The partition specified in an ARN parameter in the request doesn't match the partition where you invoked the operation. The partition is specified by the second field of the ARN.

ThrottledException:

The request failed because it exceeded the allowed frequency of submitted requests.

InternalServiceException:

The request processing failed because of an unknown error, exception, or failure. You can retry the request.

UntagResources

$result = $client->untagResources([/* ... */]);
$promise = $client->untagResourcesAsync([/* ... */]);

Removes the specified tags from the specified resources. When you specify a tag key, the action removes both that key and its associated value. The operation succeeds even if you attempt to remove tags from a resource that were already removed. Note the following:

• To remove tags from a resource, you need the necessary permissions for the service that the resource belongs to as well as permissions for removing tags. For more information, see the documentation for the service whose resource you want to untag.

• You can only tag resources that are located in the specified Amazon Web Services Region for the calling Amazon Web Services account.

Minimum permissions

In addition to the tag:UntagResources permission required by this operation, you must also have the remove tags permission defined by the service that created the resource. For example, to remove the tags from an Amazon EC2 instance using the UntagResources operation, you must have both of the following permissions:

• tag:UntagResources

• ec2:DeleteTags

Parameter Syntax

$result = $client->untagResources([
    'ResourceARNList' => ['<string>', ...], // REQUIRED
    'TagKeys' => ['<string>', ...], // REQUIRED
]);

Parameter Details

Result Syntax

[
    'FailedResourcesMap' => [
        '<ResourceARN>' => [
            'ErrorCode' => 'InternalServiceException|InvalidParameterException',
            'ErrorMessage' => '<string>',
            'StatusCode' => <integer>,
        ],
        // ...
    ],
]

Result Details

Errors

InvalidParameterException:

The request failed because of one of the following reasons:

• A required parameter is missing.

• A provided string parameter is malformed.

• An provided parameter value is out of range.

• The target ID is invalid, unsupported, or doesn't exist.

• You can't access the Amazon S3 bucket for report storage. For more information, see Amazon S3 bucket policy for report storage in the Tagging Amazon Web Services resources and Tag Editor user guide.

• The partition specified in an ARN parameter in the request doesn't match the partition where you invoked the operation. The partition is specified by the second field of the ARN.

ThrottledException:

The request failed because it exceeded the allowed frequency of submitted requests.

InternalServiceException:

The request processing failed because of an unknown error, exception, or failure. You can retry the request.