Where AWS honours the condition#

Where the key is confirmed#

17 of 180 services in AWS’s Service Authorization Reference name aws:ResourceTag on their tagging action. That is a lower bound. The reference is authoritative about what it names and silent about what it omits, and AWS documents tag-based authorization for services it says nothing about, Lambda among them.

Services with no verdict#

The reference states nothing either way for these. Check them against AWS’s own IAM documentation and test the policy. This is not a list of services where scoping fails.

Types that carry no tags#

A marker needs somewhere to live, and a minority of admitted types take no tags argument at all. A condition on either marker key is unmatched on those, so a grant covering them is wider than its condition.

Being identifiable without a tag and being governable by one are different properties, and an IAM condition needs the second. live/MARKERS.md carries the generated count and the per-service breakdown.

What a run itself needs#

choudoufu makes few AWS calls of its own. Resource reads, writes and lists go through the provider plugin, so those are the AWS provider’s permissions, exactly as any OpenTofu run. Reference lists the fork’s own call surface per stage, which is short and fixed.

Marker stamping calls the tagging action for the resource’s own service. A role that can create a resource can usually already tag it, which matters when a policy is scoped tightly.

The rosters on this page are rendered from live/iam-reference.json, generated by tools/iamref-gen from AWS’s published reference. That artifact is authoritative about the condition keys it names and silent about the ones it omits.