A post turned up on my LinkedIn feed this morning about the

tag_policy_compliance

provider argument introduced in Terraform AWS provider v6.22.0 (2025-11-20). I knew about tag policies in AWS Organizations (note: this is a different policy type than an SCP) but I'd missed the new Terraform feature. Once you've defined tag policies, adding

tag_policy_compliance = "warning"

to your provider configuration produces warnings at plan time.

tag_policy_compliance = "error"

makes it stick. Who is using this already? LinkedIn | AWS blog | AWS sample Terraform code | Terraform AWS provider documentation

Terraform only I assume? Not opentofu

That's a good question. It's part of the provider, so

tag_policy_compliance

is available in OpenTofu, too! search.opentofu.org/provider/opentofu/aws/latest/docs/guides/tag-policy-compliance#enforcing-tag-policy-compliance

ohhh, but of course

This combination looks really useful as a way to gradually move an organization to a workable tag standard.