Control Tagging via IAM policy

[GilesDay]

Has anyone looked into how to give a RO user access to create/edit tags?  (ie Access Environment only with policy bound.

We have a very controlled environment with limited users who have change monitoring settings. We're looking to give out more permissions, starting with adding/updating tags to Synthetics. Ideally we could limit this to certain tags as well so that users don't mess up management zone/event management tags, but could change a MaintenanceWindow Tag. to On or Off.

[jason_gs]

you maybe able to to control access to Settings->Tags via a schema + policy, but not sub-group of Tags from the list within. 

[DanielS]

Yes @GilesDay what you can do is to create a policy like the following one:

ALLOW settings:objects:read, settings:objects:write, settings:schemas:read WHERE settings:schemaId IN ("builtin:tags.auto-tagging", "builtin:tags.manual-tagging", "builtin:alerting.maintenance-window");

 as @jason_gs already told you, you can't control sub-groups of tags.