DevOps Community Sponsored by Cloud Posse

SweetOps

<https://sweetops.slack.com/archives/CCT1E7JJY/p1780074119016769>

I got my test to work minutes after speaking during 2026-06-03 office hours, but there are bugs on the Terraform AWS provider side. `tag_policy_compliance = "warning"` is less comprehensive than `tag_policy_compliance = "error"` , and even the latter will let through some plans that will fail on apply.

Definitely use AWS Organizations tag policies, because the AWS API enforces them no matter what.

Don't count on plan-time warnings from Terraform for all potential violations. In the TF AWS provider repo, there is one open issue (unrelated to this specific gap) and there was a hint of issues with `warning` in comments in the PR for the `tag_policy_compliance` feature.

```$ terraform plan
[...]
Planning failed. Terraform encountered an error while generating this plan.
[...]
│ Error: Missing Required Tags - An organizational tag policy requires the following tags for aws_security_group: [department]
│
│   with aws_security_group.allow_tls,
│   on <http://main.tf|main.tf> line 6, in resource "aws_security_group" "allow_tls":
│    6: resource "aws_security_group" "allow_tls" {```