[whoknew1122]

This is also a problem when using CloudFormation. CloudFormation will often create resources without tags and then add the tags in a separate call.

[ldoughty]

That's the root of my complaint...

This effectively means IAM cannot limit creation events by tag because it's two steps. Only solution is two steps