{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyMissingTagApplicationName",
      "Effect": "Deny",
      "Action": [
        "ec2:Create*",
        "rds:CreateDBInstance",
        "rds:CreateDBCluster",
        "s3:CreateBucket",
        "lambda:CreateFunction",
        "ecs:CreateCluster",
        "ecs:CreateService",
        "eks:CreateCluster",
        "elasticache:CreateCacheCluster",
        "elasticache:CreateReplicationGroup",
        "dynamodb:CreateTable",
        "sqs:CreateQueue",
        "sns:CreateTopic",
        "secretsmanager:CreateSecret",
        "kms:CreateKey",
        "elasticloadbalancing:CreateLoadBalancer",
        "autoscaling:CreateAutoScalingGroup"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:RequestTag/application-name": "true"
        }
      }
    },
    {
      "Sid": "DenyMissingTagEnvironment",
      "Effect": "Deny",
      "Action": [
        "ec2:Create*",
        "rds:CreateDBInstance",
        "rds:CreateDBCluster",
        "s3:CreateBucket",
        "lambda:CreateFunction",
        "ecs:CreateCluster",
        "ecs:CreateService",
        "eks:CreateCluster",
        "elasticache:CreateCacheCluster",
        "elasticache:CreateReplicationGroup",
        "dynamodb:CreateTable",
        "sqs:CreateQueue",
        "sns:CreateTopic",
        "secretsmanager:CreateSecret",
        "kms:CreateKey",
        "elasticloadbalancing:CreateLoadBalancer",
        "autoscaling:CreateAutoScalingGroup"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:RequestTag/environment": "true"
        }
      }
    },
    {
      "Sid": "DenyInvalidEnvironmentTagValue",
      "Effect": "Deny",
      "Action": [
        "ec2:Create*",
        "rds:CreateDBInstance",
        "rds:CreateDBCluster",
        "s3:CreateBucket",
        "lambda:CreateFunction",
        "ecs:CreateCluster",
        "ecs:CreateService",
        "eks:CreateCluster",
        "elasticache:CreateCacheCluster",
        "elasticache:CreateReplicationGroup",
        "dynamodb:CreateTable",
        "sqs:CreateQueue",
        "sns:CreateTopic",
        "secretsmanager:CreateSecret",
        "kms:CreateKey",
        "elasticloadbalancing:CreateLoadBalancer",
        "autoscaling:CreateAutoScalingGroup"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEqualsIfExists": {
          "aws:RequestTag/environment": [
            "prod",
            "pre-prod",
            "non-prod",
            "staging",
            "qa",
            "dev",
            "sandbox"
          ]
        }
      }
    },
    {
      "Sid": "DenyMissingTagTeam",
      "Effect": "Deny",
      "Action": [
        "ec2:Create*",
        "rds:CreateDBInstance",
        "rds:CreateDBCluster",
        "s3:CreateBucket",
        "lambda:CreateFunction",
        "ecs:CreateCluster",
        "ecs:CreateService",
        "eks:CreateCluster",
        "elasticache:CreateCacheCluster",
        "elasticache:CreateReplicationGroup",
        "dynamodb:CreateTable",
        "sqs:CreateQueue",
        "sns:CreateTopic",
        "secretsmanager:CreateSecret",
        "kms:CreateKey",
        "elasticloadbalancing:CreateLoadBalancer",
        "autoscaling:CreateAutoScalingGroup"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:RequestTag/team": "true"
        }
      }
    },
    {
      "Sid": "DenyMissingTagOwner",
      "Effect": "Deny",
      "Action": [
        "ec2:Create*",
        "rds:CreateDBInstance",
        "rds:CreateDBCluster",
        "s3:CreateBucket",
        "lambda:CreateFunction",
        "ecs:CreateCluster",
        "ecs:CreateService",
        "eks:CreateCluster",
        "elasticache:CreateCacheCluster",
        "elasticache:CreateReplicationGroup",
        "dynamodb:CreateTable",
        "sqs:CreateQueue",
        "sns:CreateTopic",
        "secretsmanager:CreateSecret",
        "kms:CreateKey",
        "elasticloadbalancing:CreateLoadBalancer",
        "autoscaling:CreateAutoScalingGroup"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:RequestTag/owner": "true"
        }
      }
    },
    {
      "Sid": "DenyMissingTagAssignmentGroup",
      "Effect": "Deny",
      "Action": [
        "ec2:Create*",
        "rds:CreateDBInstance",
        "rds:CreateDBCluster",
        "s3:CreateBucket",
        "lambda:CreateFunction",
        "ecs:CreateCluster",
        "ecs:CreateService",
        "eks:CreateCluster",
        "elasticache:CreateCacheCluster",
        "elasticache:CreateReplicationGroup",
        "dynamodb:CreateTable",
        "sqs:CreateQueue",
        "sns:CreateTopic",
        "secretsmanager:CreateSecret",
        "kms:CreateKey",
        "elasticloadbalancing:CreateLoadBalancer",
        "autoscaling:CreateAutoScalingGroup"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:RequestTag/assignment-group": "true"
        }
      }
    },
    {
      "Sid": "DenyMissingTagProject",
      "Effect": "Deny",
      "Action": [
        "ec2:Create*",
        "rds:CreateDBInstance",
        "rds:CreateDBCluster",
        "s3:CreateBucket",
        "lambda:CreateFunction",
        "ecs:CreateCluster",
        "ecs:CreateService",
        "eks:CreateCluster",
        "elasticache:CreateCacheCluster",
        "elasticache:CreateReplicationGroup",
        "dynamodb:CreateTable",
        "sqs:CreateQueue",
        "sns:CreateTopic",
        "secretsmanager:CreateSecret",
        "kms:CreateKey",
        "elasticloadbalancing:CreateLoadBalancer",
        "autoscaling:CreateAutoScalingGroup"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:RequestTag/project": "true"
        }
      }
    },
    {
      "Sid": "DenyMissingTagAvailabilityTier",
      "Effect": "Deny",
      "Action": [
        "ec2:Create*",
        "rds:CreateDBInstance",
        "rds:CreateDBCluster",
        "s3:CreateBucket",
        "lambda:CreateFunction",
        "ecs:CreateCluster",
        "ecs:CreateService",
        "eks:CreateCluster",
        "elasticache:CreateCacheCluster",
        "elasticache:CreateReplicationGroup",
        "dynamodb:CreateTable",
        "sqs:CreateQueue",
        "sns:CreateTopic",
        "secretsmanager:CreateSecret",
        "kms:CreateKey",
        "elasticloadbalancing:CreateLoadBalancer",
        "autoscaling:CreateAutoScalingGroup"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:RequestTag/availability-tier": "true"
        }
      }
    },
    {
      "Sid": "DenyMissingTagDataClassification",
      "Effect": "Deny",
      "Action": [
        "ec2:CreateVolume",
        "ec2:CreateSnapshot",
        "rds:CreateDBInstance",
        "rds:CreateDBCluster",
        "s3:CreateBucket"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:RequestTag/data-classification": "true"
        }
      }
    },
    {
      "Sid": "DenyMissingTagCostCenterOpex",
      "Effect": "Deny",
      "Action": [
        "ec2:Create*",
        "rds:CreateDBInstance",
        "rds:CreateDBCluster",
        "s3:CreateBucket",
        "lambda:CreateFunction",
        "ecs:CreateCluster",
        "ecs:CreateService",
        "eks:CreateCluster",
        "elasticache:CreateCacheCluster",
        "elasticache:CreateReplicationGroup",
        "dynamodb:CreateTable",
        "sqs:CreateQueue",
        "sns:CreateTopic",
        "secretsmanager:CreateSecret",
        "kms:CreateKey",
        "elasticloadbalancing:CreateLoadBalancer",
        "autoscaling:CreateAutoScalingGroup"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:RequestTag/cost-center-opex": "true"
        }
      }
    },
    {
      "Sid": "DenyMissingTagCostCenterCapex",
      "Effect": "Deny",
      "Action": [
        "ec2:Create*",
        "rds:CreateDBInstance",
        "rds:CreateDBCluster",
        "s3:CreateBucket",
        "lambda:CreateFunction",
        "ecs:CreateCluster",
        "ecs:CreateService",
        "eks:CreateCluster",
        "elasticache:CreateCacheCluster",
        "elasticache:CreateReplicationGroup",
        "dynamodb:CreateTable",
        "sqs:CreateQueue",
        "sns:CreateTopic",
        "secretsmanager:CreateSecret",
        "kms:CreateKey",
        "elasticloadbalancing:CreateLoadBalancer",
        "autoscaling:CreateAutoScalingGroup"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:RequestTag/cost-center-capex": "true"
        }
      }
    },
    {
      "Sid": "DenyMissingTagBusinessUnit",
      "Effect": "Deny",
      "Action": [
        "ec2:Create*",
        "rds:CreateDBInstance",
        "rds:CreateDBCluster",
        "s3:CreateBucket",
        "lambda:CreateFunction",
        "ecs:CreateCluster",
        "ecs:CreateService",
        "eks:CreateCluster",
        "elasticache:CreateCacheCluster",
        "elasticache:CreateReplicationGroup",
        "dynamodb:CreateTable",
        "sqs:CreateQueue",
        "sns:CreateTopic",
        "secretsmanager:CreateSecret",
        "kms:CreateKey",
        "elasticloadbalancing:CreateLoadBalancer",
        "autoscaling:CreateAutoScalingGroup"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:RequestTag/business-unit": "true"
        }
      }
    },
    {
      "Sid": "DenyMissingTagAppOwner",
      "Effect": "Deny",
      "Action": [
        "ec2:Create*",
        "rds:CreateDBInstance",
        "rds:CreateDBCluster",
        "s3:CreateBucket",
        "lambda:CreateFunction",
        "ecs:CreateCluster",
        "ecs:CreateService",
        "eks:CreateCluster",
        "elasticache:CreateCacheCluster",
        "elasticache:CreateReplicationGroup",
        "dynamodb:CreateTable",
        "sqs:CreateQueue",
        "sns:CreateTopic",
        "secretsmanager:CreateSecret",
        "kms:CreateKey",
        "elasticloadbalancing:CreateLoadBalancer",
        "autoscaling:CreateAutoScalingGroup"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:RequestTag/app-owner": "true"
        }
      }
    }
  ]
}