SCP в организации для ограничения создания экземпляров EC2, томов без обязательных тегов

Question

Я добавил SCP в организацию, чтобы ограничить создание экземпляра EC2, томов без обязательных тегов. Ручное создание экземпляров с обязательными тегами работает нормально. когда я передаю все теги внутри CloudFormation, он не может создать экземпляр.

Policy

    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyRunInstanceWithNoProjectTag",
            "Effect": "Deny",
            "Action": "ec2:RunInstances",
            "Resource": [
                "arn:aws:ec2:*:*:instance/*",
                "arn:aws:ec2:*:*:volume/*"
            ],
            "Condition": {
                "Null": {
                    "aws:RequestTag/AppID": "true"
                }
            }
        }
    ]
} 

Сообщение об ошибке:

API: ec2: RunInstances Вы не являетесь уполномочен выполнять эту операцию. Закодированного сообщение об ошибке авторизации: ghoOCHN7ZLl0rvdRObGsJeDyE86Nt0lqYYAhVmOHGu7J2zGxbuDWa3VyYl75TfChof_km2U-_Eo4c9Kq6qY_XvmTN-nZa3inB6QEVG0OvOokZuFyFiOS0vSIorhW2uwVmI8w25Fqgf5ueBH0bxq5BnmY7gTCcI9NjCHzEpBY4nudbrNm1iNfQSPldof4CwmibMip_Cs-JgQ2vV76wjo0DgLQDDp6Yzk65-Std9ihGqnlE8DiHBE_dKiUNQtfqXcJ8jsAjjnP-DSmHBprg-IJB-bsOWHElylusj-zCDKby44xiLnG1sv_7pbIhFPcV5gezCaTufGlB9wkZxFuncYPl5Uv6xsL7CmGi_UXHcKeyQpLxMwXRBuo6SWTplsI67_LLskvvj00Kj8_8XDi5kz87B9kkWSiBoykgDHVZPngK6DSMv1YhPAbDu03oVw3wdYxzQO3MwoX-tXGJN63NtYhf-ГРО-G9YF599zWSX5kT41FJlmuYDBn7nDPrXpXZLAhIjyulUnQOzuz4aEG_xWDiY-ZAZNuI6o7Df_K0OuI3xU-qKpgssSUt6bR6goHoaQJ_NDSzzoodusYtk69RPv_Pyom5WETfOv9zfGtKAkmn5Sk4NTP7T0rYClOnaUvx_MkKy1Lk6jFGYNfROqs96UIxBsYUhD-QEOjRZQ4-L7GSNIn3cZfCHJ9e5ZuPflQpMQsRiV9tUIessOC8uKnGYRZw4cSeCNzTgjLypcCbFchf01qdFsB4TrTtOTRMzYf1-ImBg4CY3CycmZ8Cduv_wSWTw

CloudFormation:

Description: CloudFormation template to create Windows2016 VM
Parameters:
  vpcid:
    Type: String
  subnetid1:
    Type: String  
  az1:
    Type: String   
  instanceType:
    Type: String
    Default: t2.micro   
  ami:
    Type: String   
  CostCenter:
    Type: String
  ApplicationName:
    Type: String
  ProjectID:
    Type: String
  IONumber:
    Type: String
  Environment:
    Type: String
  ApplicationOwner:
    Type: String
  BusinessOwner:
    Type: String
  BusinessUnit:
    Type: String
  Hostname:
    Type: String
  Backup:
    Type: String
    Default: default
  Basesgwindows:
    Type: String
  AppID:
    Type: String
    Default: 1234
Resources:
  instance1:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref ami
      InstanceType: !Ref instanceType
      SubnetId: !Ref subnetid1
      AvailabilityZone: !Ref az1
      SecurityGroupIds:
        - !Ref Basesgwindows
      Tags:
        - Key: "BusinessUnit"
          Value: !Ref BusinessUnit
        - Key: "CostCenter"
          Value: !Ref CostCenter
        - Key: "ApplicationName"
          Value: !Ref ApplicationName
        - Key: "ProjectID"
          Value: !Ref ProjectID
        - Key: "IONumber"
          Value: !Ref IONumber
        - Key: "Environment"
          Value: !Ref Environment  
        - Key: "ApplicationOwner"
          Value: !Ref ApplicationOwner
        - Key: "BusinessOwner"  
          Value: !Ref BusinessOwner
        - Key: "Hostname"
          Value: !Ref Hostname
        - Key: "Backup"
          Value: !Ref Backup
        - Key: "AppID"
          Value: !Ref AppID

Answer 1

AWSTemplateFormatVersion: 2010-09-09
Description: CloudFormation template to create Windows2016 VM
Parameters:
  vpcid:
    Type: String
  subnetid1:
    Type: String  
  az1:
    Type: String   
  instanceType:
    Type: String
    Default: t2.micro   
  ami:
    Type: String   
  CostCenter:
    Type: String
  ApplicationName:
    Type: String
  ProjectID:
    Type: String
  IONumber:
    Type: String
  Environment:
    Type: String
  ApplicationOwner:
    Type: String
  BusinessOwner:
    Type: String
  BusinessUnit:
    Type: String
  Hostname:
    Type: String
  Backup:
    Type: String
    Default: default
  Basesgwindows:
    Type: String
  AppID:
    Type: String
    Default: 1234
Resources:
  instance1:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref ami
      InstanceType: !Ref instanceType
      SubnetId: !Ref subnetid1
      AvailabilityZone: !Ref az1
      SecurityGroupIds:
        - !Ref Basesgwindows
      Tags:
        - Key: "BusinessUnit"
          Value: !Ref BusinessUnit
        - Key: "CostCenter"
          Value: !Ref CostCenter
        - Key: "ApplicationName"
          Value: !Ref ApplicationName
        - Key: "ProjectID"
          Value: !Ref ProjectID
        - Key: "IONumber"
          Value: !Ref IONumber
        - Key: "Environment"
          Value: !Ref Environment  
        - Key: "ApplicationOwner"
          Value: !Ref ApplicationOwner
        - Key: "BusinessOwner"  
          Value: !Ref BusinessOwner
        - Key: "Hostname"
          Value: !Ref Hostname
        - Key: "Backup"
          Value: !Ref Backup
        - Key: "AppID"
          Value: !Ref AppID