🧾 JSONhard

1. Require a data-classification tag (SCP)

Write an SCP statement that DENIES launching an EC2 instance unless a "Classification" tag is provided: • Effect: "Deny" • Action: "ec2:RunInstances" • Resource: "*" • Condition: Null on "aws:RequestTag/Classification" = "true" (i.e. deny when the tag is MISSING)

How to approach this

Data-classification labels are a core regulated-cloud control (they drive impact-level and handling). The `Null` condition operator tests whether a key is ABSENT: `aws:RequestTag/Classification` = `"true"` means "the Classification tag was not supplied." Denying `ec2:RunInstances` in that case forces every instance to carry a classification tag at creation. `"true"` here is a STRING.

config.json