How can I enforce mandatory tagging of Department and Project with specified values when creating compute resources in Databricks using IAM roles?
To enforce mandatory tagging of Department and Project with specified values when creating compute resources in Databricks using IAM roles, you can apply an IAM policy to your account’s primary IAM role. This policy should include explicit Deny statements for mandatory tag keys and optional values. Here's an example policy that enforces Department and Project tags with specified values:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "MandateLaunchWithTag1",
      "Effect": "Deny",
      "Action": [
        "ec2:RunInstances",
        "ec2:CreateTags"
      ],
      "Resource": "arn:aws:ec2:region:accountId:instance/*",
      "Condition": {
        "StringNotEqualsIgnoreCase": {
          "aws:RequestTag/Department": [
            "Deptt1",
            "Deptt2",
            "Deptt3"
          ]
        }
      }
    },
    {
      "Sid": "MandateLaunchWithTag2",
      "Effect": "Deny",
      "Action": [
        "ec2:RunInstances",
        "ec2:CreateTags"
      ],
      "Resource": "arn:aws:ec2:region:accountId:instance/*",
      "Condition": {
        "StringNotLike": {
          "aws:RequestTag/Project": "?*"
        }
      }
    }
  ]
}
```

This policy includes two statements, one for each tag. The first statement denies the creation of instances if the Department tag is not one of the specified values ("Deptt1", "Deptt2", or "Deptt3"). The second statement denies the creation of instances if the Project tag is not a non-empty value.

To apply this policy, you need to attach it to your account’s primary IAM role. After that, cluster creation will fail if required tags with one of the allowed values aren’t provided.