AWS Tag Policy Validator

What this validates

A tag policy is an AWS Organizations policy type — a completely different document from an IAM policy, with its own syntax built around tag_key, tag_value, and enforced_for, plus inheritance operators (@@assign, @@append, @@remove, @@operators_allowed_for_child_policies) that control how a policy merges with others attached higher up the organization tree. This checks a single pasted document against AWS's own documented syntax and constraints.

What gets checked

• Structure. A single top-level tags key; each entry limited to tag_key, tag_value, enforced_for, and report_required_tag_for.
• Operators. Only @@assign, @@append, @@remove, and @@operators_allowed_for_child_policies are valid — and @@append/@@remove only apply to the multi-valued fields (tag_value, enforced_for), never to tag_key, which takes a single string.
• The policy key must match tag_key. Per AWS's own docs, the key identifying each statement (costcenter in the example below) has to match the string assigned to tag_key (CostCenter) — case differences are fine, anything else isn't. Easy to break by renaming one but not the other.
• Tag key/value limits. 128 characters for a key, 256 for a value, restricted to letters, numbers, spaces, and + - = . _ : / @ — the same rules that apply to tags generally, not just inside a tag policy.
• Wildcard placement. At most one * per tag value (300* is fine, *3*0*0* isn't) — and no wildcards at all in enforced_for, where ALL_SUPPORTED is the only wildcard-like value AWS accepts.
• The reserved aws: prefix on either a key or a value, which AWS reserves for its own system-generated tags.

What it doesn't check: whether a given service:resourceType pair in enforced_for is one AWS actually supports enforcement for — that list is long and service-specific. See AWS's list of supported services and resource types.

The whitespace rule runs backwards from IAM policies

IAM Policy Minifier exists because AWS explicitly ignores whitespace when measuring an IAM policy against its size quota — minifying an IAM policy usually changes nothing about whether it fits. Tag policies are the opposite: AWS's own guidance says to delete whitespace if a tag policy's size is approaching its 10,000-character limit, which only makes sense if whitespace counts. This tool shows both numbers — as pasted, and minified — so it's obvious which one to trust for each type of policy.

FAQ

Does this check the effective policy across my whole organization?

No — tag policies inherit and merge down an organization tree (a policy at the root combines with one on an OU, which combines with one on an account) into an effective policy. This validates one document in isolation, the same way IAM Policy Simulator is scoped to identity-based policies rather than the full cross-account evaluation chain.

Why does report_required_tag_for show up separately from enforced_for?

enforced_for actively blocks a noncompliant tagging operation. report_required_tag_for is softer — it flags a resource as missing a required tag for compliance reporting (including in infrastructure-as-code tools like CloudFormation and Terraform) without blocking anything by itself.

Is my policy sent anywhere?

No — validation happens entirely in your browser. Nothing you paste here is ever sent to a server.