Missing documentation for `aws_tags` option?

[mikemhenry]

In the README it says to see the README for more details, but I don't see where in the README there are any more details.

I was able to figure it out by the description since it clear, but an example could be nice :)

I am testing this feature right now, since I think the ec2:CreateTags permission will be required but I will let you know either way.

[ethanholz]

I do believe you would need the ec2:CreateTags permission added and for reference, we use the same tagging format as the ec2-github-runner as you can see here: https://github.com/machulav/ec2-github-runner/blob/6a96fd4676ce44606c4bc58308af29dfdb345b85/README.md?plain=1#L261

[ethanholz]

I will be updating the docs in our upcoming release to reflect this.

[mikemhenry]

Thanks! -- Thoughts on using a syntax that implicitly uses Key: Value instead of having {"Key": "Name", "Value": "ec2-github-runner"}, you could just do {"Name": "ec2-github-runner"},

[mikemhenry]

Ah it looks like that is what boto expects, probably not worth the trouble

[mikemhenry]

BTW, we will see if the extra permissions are needed, but I am getting this far botocore.exceptions.ClientError: An error occurred (TagPolicyViolation) when calling the RunInstances operation: For 'env', use the capitalization specified by the tag policy. (the email I got from MSK has inconstant use of case, so it is easy to fix but I would expect an error about not having permissions to apply tags to happen before a tag policy error, but we will see)

[mikemhenry]

Confirmed you need ec2:CreateTags (aws will let you enumerate tag-policy I guess) botocore.exceptions.ClientError: An error occurred (UnauthorizedOperation) when calling the RunInstances operation: You are not authorized to perform this operation. User: arn:aws:sts::009563297724:assumed-role/gha-runner-omsf/GitHubActions is not authorized to perform: ec2:CreateTags on resource: arn:aws:ec2:us-east-1:009563297724:instance/* because no identity-based policy allows the ec2:CreateTags action. Encoded authorization failure message:

[ethanholz]

Thanks for digging into this! To enumerate changes we need to see in this project:

• Add ec2:CreateTags to the permissions document
• Implement a dry-run permissions check on the creation of instances to see if you have the required permissions to run an operation