创建AWS RDS实例时如何配置标签？SCP管控遇控制台无标签选项问题

我在配置AWS SCP强制资源创建阶段添加指定标签，EC2、Lambda上规则正常生效，但创建RDS实例时因为控制台找不到创建环节加标签的入口而失败。用CLI创建RDS时能通过参数添加标签并成功创建，但AWS管理控制台没显示这个选项，以下是我的SCP配置：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyEC2CreationInfraOwnerTag",
      "Effect": "Deny",
      "Action": [
        "ec2:RunInstances",
        "ec2:StartInstances"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:volume/*"
      ],
      "Condition": {
        "Null": {
          "aws:RequestTag/InfraOwner": "true"
        }
      }
    },
    {
      "Sid": "DenyEC2CreationProductTag",
      "Effect": "Deny",
      "Action": [
        "ec2:RunInstances",
        "ec2:StartInstances"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:volume/*"
      ],
      "Condition": {
        "Null": {
          "aws:RequestTag/Product": "true"
        }
      }
    },
    {
      "Sid": "DenyEC2CreationNameTag",
      "Effect": "Deny",
      "Action": [
        "ec2:RunInstances",
        "ec2:StartInstances"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:volume/*"
      ],
      "Condition": {
        "Null": {
          "aws:RequestTag/Name": "true"
        }
      }
    },
    {
      "Sid": "DenyLambdaCreationInfraOwnerTag",
      "Effect": "Deny",
      "Action": [
        "lambda:Create*"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "Null": {
          "aws:RequestTag/InfraOwner": "true"
        }
      }
    },
    {
      "Sid": "DenyLambdaCreationProductTag",
      "Effect": "Deny",
      "Action": [
        "lambda:Create*"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "Null": {
          "aws:RequestTag/Product": "true"
        }
      }
    },
    {
      "Sid": "DenyLambdaCreationNameTag",
      "Effect": "Deny",
      "Action": [
        "lambda:Create*"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "Null": {
          "aws:RequestTag/Name": "true"
        }
      }
    },
        {
        "Sid": "DenyRDSCreationInfraOwnerTag",
        "Effect": "Deny",
        "Action": [
            "rds:CreateDBInstance",
            "rds:CreateDBCluster"
        ],
        "Resource": [
            "*"
        ],
        "Condition": {
            "Null": {
                "aws:RequestTag/InfraOwner": "true"
            }
        }
    },
        {
        "Sid": "DenyRDSCreationProductTag",
        "Effect": "Deny",
        "Action": [
            "rds:CreateDBInstance",
            "rds:CreateDBCluster"
        ],
        "Resource": [
            "*"
        ],
        "Condition": {
            "Null": {
                "aws:RequestTag/Product": "true"
            }
        }
    },
        {
        "Sid": "DenyRDSCreationNameTag",
        "Effect": "Deny",
        "Action": [
            "rds:CreateDBInstance",
            "rds:CreateDBCluster"
        ],
        "Resource": [
            "*"
        ],
        "Condition": {
            "Null": {
                "aws:RequestTag/Name": "true"
            }
        }
    },
        {
        "Sid": "DenyDynamoDBCreationInfraOwnerTag",
        "Effect": "Deny",
        "Action": [
            "dynamodb:CreateTable"
        ],
        "Resource": [
            "*"
        ],
        "Condition": {
            "Null": {
                "aws:RequestTag/InfraOwner": "true"
            }
        }
    },
        {
        "Sid": "DenyDynamoDBCreationProductTag",
        "Effect": "Deny",
        "Action": [
            "dynamodb:CreateTable"
        ],
        "Resource": [
            "*"
        ],
        "Condition": {
            "Null": {
                "aws:RequestTag/Product": "true"
            }
        }
    },
        {
        "Sid": "DenyDynamoDBCreationNameTag",
        "Effect": "Deny",
        "Action": [
            "dynamodb:CreateTable"
        ],
        "Resource": [
            "*"
        ],
        "Condition": {
            "Null": {
                "aws:RequestTag/Name": "true"
            }
        }
    }
  ]
}

问题原因 #

AWS管理控制台创建RDS实例的标签选项默认藏在附加配置里，不像EC2、Lambda直接在主创建流程中显示，导致找不到入口，无法在创建时传递标签参数，触发了SCP的拒绝规则。

解决方法 #

1. 找到控制台RDS创建的标签入口

创建RDS实例时，完成基本配置后，滚动到页面最底部，展开**「Additional configuration」（附加配置）**，在「Tags」（标签）部分添加InfraOwner、Product、Name这三个必填标签，之后再完成创建即可通过SCP校验。

2. 简化SCP配置（可选）

当前SCP规则重复度很高，可以合并同类资源的标签检查规则，减少冗余，同时确保逻辑一致：

{
  "Version": "2012-10-17",
  "Statement": [
    // EC2实例/卷创建强制标签
    {
      "Sid": "DenyEC2CreationWithoutRequiredTags",
      "Effect": "Deny",
      "Action": ["ec2:RunInstances", "ec2:StartInstances"],
      "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:volume/*"
      ],
      "Condition": {
        "Null": {
          "aws:RequestTag/InfraOwner": "true",
          "aws:RequestTag/Product": "true",
          "aws:RequestTag/Name": "true"
        }
      }
    },
    // Lambda创建强制标签
    {
      "Sid": "DenyLambdaCreationWithoutRequiredTags",
      "Effect": "Deny",
      "Action": ["lambda:Create*"],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:RequestTag/InfraOwner": "true",
          "aws:RequestTag/Product": "true",
          "aws:RequestTag/Name": "true"
        }
      }
    },
    // RDS实例/集群创建强制标签
    {
      "Sid": "DenyRDSCreationWithoutRequiredTags",
      "Effect": "Deny",
      "Action": ["rds:CreateDBInstance", "rds:CreateDBCluster"],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:RequestTag/InfraOwner": "true",
          "aws:RequestTag/Product": "true",
          "aws:RequestTag/Name": "true"
        }
      }
    },
    // DynamoDB表创建强制标签
    {
      "Sid": "DenyDynamoDBCreationWithoutRequiredTags",
      "Effect": "Deny",
      "Action": ["dynamodb:CreateTable"],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:RequestTag/InfraOwner": "true",
          "aws:RequestTag/Product": "true",
          "aws:RequestTag/Name": "true"
        }
      }
    }
  ]
}

3. 备选方案：事后强制补全标签

如果控制台流程确实不符合操作习惯，可以调整策略：

• 暂时放松SCP中RDS创建的标签限制，允许不带标签创建实例
• 配置AWS Config规则，自动检查RDS实例是否存在指定标签，若缺失则通过Systems Manager Automation自动补全，或者触发通知要求运维人员补充标签

内容的提问来源于stack exchange，提问作者Ashish Sharma