In AWS, I want to tag every EBS volume that automatically gets created as a result of an EC2 instance launch, which would be the RunInstances event. However, a CreateVolume event does not occur for a volume that is automatically created and associated with a new EC2. I have tried the policy below, but it does not work because in the CloudTrail RunInstances event, the EBS Volume Id is not found anywhere. Any suggestions?

policies:
- name: tag-ebs-volumes-on-ec2-launch
  resource: ebs
  description: |
    Triggered when a new EBS Volume is created for a new EC2 Launch. Checks to see if
    it's missing the CreatedBy and CreatedOn tag. If both missing then four tags get created.
  mode:
    type: cloudtrail
    role: arn:aws:iam::{account_id}:role/cloud-custodian-role-assumed
    events:
      - source: ec2.amazonaws.com
        event: RunInstances
        ids: "responseElements.instancesSet.items[].blockDeviceMappings[].ebs.volumeId"
  filters:
    - and:
      - tag:CreatedBy: absent
      - tag:CreatedOn: absent
  actions:
    - type: copy-related-tag
      resource: ec2
      skip_missing: true
      key: "Attachments[0].InstanceId"
      tags:
        - Name
        - CreatedBy
        - CreatedOn
        - AccountId
        - Region

can't you use only the copy-related-tag policy without cloudtrail? it will tag the volumes AFTER they are created not on their launch.