title: Use of AWS null condition to prevent empty or missing tags?
body: <p>The goal of my policy document:</p>
  
  <ol>
  <li>Prevent resource creation if it does not have proper tags</li>
  <li>Require that certain values be given to <em>specific</em> tags (e.g. env tag must either be dev OR stg OR prd, etc)</li>
  </ol>
  
  <p>No. 2 works as expected; however, if the user creates an EC2 instance with the tag empty or simply forgets to add it, the policy still allows the user to create the instance.</p>
  
  <p>I tried the null operator (referenced <a href="http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html#Conditions_Null" rel="noreferrer" title="IAM policies Null checks">here</a>), but it doesn't seem to work.</p>
  
  <p>Another attempt was to use a condition matching aws:tag-keys values (referenced <a href="https://aws.amazon.com/blogs/aws/new-tag-ec2-instances-ebs-volumes-on-creation/" rel="noreferrer" title="Require EC2 tags upon creation - Jeff Barr">here</a>), but it only appears to work when checking one single value with a StringLike comparison operator</p>
  
  <p>This is prerequisite for a Lambda function to turn off dev instances.</p>
  
  <hr>
  
  <pre><code> {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "RequireEnvTags",
              "Effect": "Deny",
              "Action": [
                  "ec2:RunInstances"
              ],
              "Condition": {
                  "ForAnyValue:StringNotEquals": {
                      "ec2:ResourceTag/env": [
                          "dev",
                          "stg",
                          "prd",
                          "dev-noshutdown"
                      ]
                  }
              },
              "Resource": [
                  "*"
              ]
          },
          {
              "Sid": "RequireDataSensitivity1",
              "Effect": "Deny",
              "Action": [
                  "ec2:RunInstances"
              ],
              "Condition": {
                  "ForAnyValue:StringNotEquals": {
                      "ec2:ResourceTag/data-sensitivity": [
                          "public",
                          "internal",
                          "confidential",
                          "highly confidential"
                      ]
                  }
              },
              "Resource": [
                  "*"
              ]
          },
          {
              "Sid": "NullChecksDontSeemToWork0",
              "Effect": "Deny",
              "Action": [
                  "ec2:RunInstances"
              ],
              "Condition": {
                  "Null": {
                      "ec2:ResourceTag/Name": "true"
                  }
              },
              "Resource": [
                  "*"
              ]
          },
          {
              "Sid": "NullChecksDontSeemToWork1",
              "Effect": "Deny",
              "Action": [
                  "ec2:RunInstances"
              ],
              "Condition": {
                  "Null": {
                      "ec2:ResourceTag/team": "true"
                  }
              },
              "Resource": [
                  "*"
              ]
          }
      ]
  }
  </code></pre>