## TL;DR

The organization's tag policy denies the automation role from applying the shutdown tags (tag policies can restrict who may set which tag keys), so the tagging step fails and the shutdown never triggers. Update the tag policy to allow the automation role to set the specific tag keys it needs, scoped to the resources it manages. The policy is the control; the role needs an explicit allowance.

## Error

```text
agent tagged resources for shutdown but tag policies blocked the automation role
```

## Steps

1. Confirm the block: the tagging calls fail with a tag-policy denial. Expected: the error names the policy and the denied tag key.
2. Open the tag policy in Organizations and find the rule covering the shutdown tag keys. Expected: the deny rule for the automation role is visible.
3. Add an exception or scoped allow for the automation role on the shutdown tag keys. Expected: the policy permits the role to set those keys.
4. Re-run the agent's tagging step. Expected: the tags apply successfully.
5. Verify the shutdown automation now picks up the tagged resources. Expected: the full tag-to-shutdown flow works.

## When to use

- An automation role is blocked from tagging by tag policies.
- Tag-based shutdown never triggers because tags never land.
- The tag policy was recently tightened.

## When not to use

- The role lacks EC2 tagging permission generally (an IAM problem).
- The resources should not be shut down (a targeting problem).
- Tag policies are not in use in the organization.

## Tool compatibility

AWS Organizations tag policies, IAM, EC2/RDS tagging (current 2026 releases).

### Variant phrasings

### "tag policy denied" on automation tagging

Allow the role the specific tag keys in the policy.

### shutdown tags never applied

The tag step is failing on policy. Fix the allowance.

### automation role can't set cost-center tags

Same policy class. Scope the allow to the needed keys.

## Why it happens

Tag policies enforce tagging standards org-wide, including which principals may set which tags. Automation roles are often created after the policy and never added to its allowlist, so their tagging calls hit the deny. The policy is doing its job (preventing rogue tagging); the fix is the deliberate, scoped exception for the legitimate automation.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_CAGZTICVEqNLkac5Zil6AQ