Some more information about why this is happening.

Spot Instance Requests should be getting the tags assigned. The problem is that the tags do not then get passed on to the fulfilling instance. According to the AWS documentation this is the intended behavior (http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/concepts-spot-instances-request-tags.html). It seems we need to manually pass on the tags from the Spot Request to the actual instance.

Code changed in jenkins
User: Adam I
Path:
src/main/java/hudson/plugins/ec2/EC2AbstractSlave.java
src/main/java/hudson/plugins/ec2/EC2Computer.java
src/main/java/hudson/plugins/ec2/EC2ComputerListener.java
src/main/java/hudson/plugins/ec2/EC2SpotSlave.java
http://jenkins-ci.org/commit/ec2-plugin/f6d54a7948b171d093b02a7def4141d8b2716494
Log:
JENKINS-19058 Fix cannot add tags to Spot Instances

Add a ComputerListener so that we can take action when a
slave is connected. This allows us to be notified when a
Spot instance is connected and add the Spot Request's tags
to its instance.

Code changed in jenkins
User: Francis Upton
Path:
src/main/java/hudson/plugins/ec2/EC2AbstractSlave.java
src/main/java/hudson/plugins/ec2/EC2Computer.java
src/main/java/hudson/plugins/ec2/EC2ComputerListener.java
src/main/java/hudson/plugins/ec2/EC2SpotSlave.java
http://jenkins-ci.org/commit/ec2-plugin/6a374e309c229f1b3227791dea9c088eadb088db
Log:
Merge pull request #61 from aji9861/master

JENKINS-19058 Fix cannot add tags to Spot Instances

Compare: https://github.com/jenkinsci/ec2-plugin/compare/98a36f1f2512...6a374e309c22

When you get a chance let us know if you are still seeing this issue with the latest commit.

Thanks for your quick patch and instant response.

From my testing, when no global security enabled, it works and tags have been added. But if enable the global security, it will pop out the errors like this:

=== Slave ===
$ java -jar slave.jar -jnlpUrl http://ec2-XX-XX-XX-xX.compute-1.amazonaws.com:8080/computer/XXXXXX-XXXXXX/slave-agent.jnlp

java.io.IOException: Failed to load http://ec2-XX-XX-XX-XX.compute-1.amazonaws.com:8080/computer/XXXXXX-XXXXXX/slave-agent.jnlp: 403 Forbidden
at hudson.remoting.Launcher.parseJnlpArguments(Launcher.java:261)
at hudson.remoting.Launcher.run(Launcher.java:215)
at hudson.remoting.Launcher.main(Launcher.java:189)
Waiting 10 seconds before retry

=== Master ===
INFO: While serving http://ec2-XX-XX-XX-XX.compute-1.amazonaws.com:8080/computer/XXXXXX-XXXXXX/slave-agent.jnlp: hudson.security.AccessDeniedException2: anonymous is missing the Slave/Connect permission

Besides, I also enabled the "Slave/Connect" permission for anonymous users. It still cannot work with 403 forbidden.

Then, I created one normal user with all permission, and use "-auth xxx:xxx" as a parameter in the command line. It seems that Master did not recognize the user and still consider it as anonymous.

So I am not sure whether the code has this logic now.

Thanks
Henry

I was able to connect with the following command:
java -jar slave.jar -jnlpCredentials user:passsword -jnlpUrl http://ec2-xxx-xx-xxx-xxx.compute-1.amazonaws.com:8080/computer/XXXXXX-XXXXXXX/slave-agent.jnlp

This however requires you put the user password in the command parameters.

There should be a way to use your auth token instead of your password, but when I try I am getting a 401. Issues with connecting a slave using jnlp are not specific to this plugin/Spot instances. It uses the standard Jenkins jnlp information.