/resource-tagging

name: resource-tagging
description: Apply and enforce cloud resource tagging strategies across AWS, Azure, GCP, and Kubernetes for cost allocation, ownership tracking, compliance, and automation. Use when implementing cloud governance, optimizing costs, or automating infrastructure management.

Resource Tagging

Apply comprehensive cloud resource tagging strategies to enable cost allocation, ownership tracking, compliance enforcement, and infrastructure automation across multi-cloud environments.

Purpose

Resource tagging provides the foundational metadata layer for cloud governance. Tags enable precise cost allocation (reducing unallocated spend by up to 80%), rapid ownership identification, compliance scope definition, and automated lifecycle management. Without proper tagging, cloud costs become untrackable, security incidents lack context, and automation policies fail to target resources effectively.

When to Use

Use resource tagging when:

• Implementing cloud governance frameworks for cost allocation and accountability
• Building FinOps practices requiring spend visibility by team, project, or department
• Enforcing compliance requirements (PCI, HIPAA, SOC2) through automated policies
• Setting up automated resource lifecycle management (backup, monitoring, shutdown)
• Managing multi-tenant or multi-project cloud environments
• Implementing disaster recovery and backup policies based on criticality
• Tracking resource ownership for security incident response
• Optimizing cloud costs through spend analysis and showback/chargeback

Minimum Viable Tagging Strategy

Start with the **"Big Six"** required tags for all cloud resources:

| Tag | Purpose | Example Value | |-----|---------|---------------| | **Name** | Human-readable identifier | `prod-api-server-01` | | **Environment** | Lifecycle stage | `prod` \| `staging` \| `dev` | | **Owner** | Responsible team contact | `platform-team@company.com` | | **CostCenter** | Finance code for billing | `CC-1234` | | **Project** | Business initiative | `ecommerce-platform` | | **ManagedBy** | Resource creation method | `terraform` \| `pulumi` \| `manual` |

**Optional tags** to add based on specific needs:

• **Application**: Multi-app projects requiring app-level isolation
• **Component**: Resource role (`web`, `api`, `database`, `cache`)
• **Backup**: Backup policy (`daily`, `weekly`, `none`)
• **Compliance**: Regulatory scope (`PCI`, `HIPAA`, `SOC2`)
• **SLA**: Service level (`critical`, `high`, `medium`, `low`)

Tag Naming Conventions

Choose ONE naming convention organization-wide and enforce consistently:

| Convention | Format | Example | Best For | |------------|--------|---------|----------| | **PascalCase** | `CostCenter`, `ProjectName` | AWS standard | AWS-first orgs | | **lowercase** | `costcenter`, `project` | GCP labels (required) | GCP-first orgs | | **kebab-case** | `cost-center`, `project-name` | Azure (case-insensitive) | Azure-first orgs | | **Namespaced** | `company:environment`, `team:owner` | Multi-org tag policies | Large enterprises |

**Critical:** Case sensitivity varies by provider:

• **AWS**: Case-sensitive (`Environment` ≠ `environment`)
• **Azure**: Case-insensitive (`Environment` = `environment`)
• **GCP**: Lowercase required (`environment` only)
• **Kubernetes**: Case-sensitive (`environment` ≠ `Environment`)

Tag Categories

For detailed taxonomy of all tag categories, see `references/tag-taxonomy.md`.

Technical Tags

Operations-focused metadata: Name, Environment, Version, ManagedBy

Business Tags

Cost allocation metadata: Owner, CostCenter, Project, Department

Security Tags

Compliance metadata: Confidentiality, Compliance, DataClassification, SecurityZone

Automation Tags

Lifecycle metadata: Backup, Monitoring, Schedule, AutoShutdown

Operational Tags

Support metadata: SLA, ChangeManagement, CreatedBy, CreatedDate

Custom Tags

Organization-specific metadata: Customer, Application, Component, Stack

Cloud Provider Tag Limits

| Provider | Tag Limit | Key Length | Value Length | Case Sensitive | Inheritance | |----------|-----------|------------|--------------|----------------|-------------| | **AWS** | 50 user-defined | 128 chars | 256 chars | Yes | Via tag policies | | **Azure** | 50 pairs | 512 chars | 256 chars | No | Via Azure Policy | | **GCP** | 64 labels | 63 chars | 63 chars | No | Via org policies | | **Kubernetes** | Unlimited | 253 prefix + 63 name | 63 chars | Yes | Via namespace |

Tag Enforcement Patterns

Infrastructure as Code (Recommended)

Apply tags automatically via Terraform/Pulumi to reduce manual errors by 95%:

# Terraform: Provider-level default tags
provider "aws" {
  default_tags {
    tags = {
      Environment = var.environment
      Owner       = var.owner
      CostCenter  = var.cost_center
      Project     = var.project
      ManagedBy   = "terraform"
    }
  }
}

All resources automatically inherit these tags. Resource-specific tags merge with defaults.

For complete Terraform, Pulumi, and CloudFormation examples, see `examples/terraform/`, `examples/pulumi/`, and `examples/cloudformation/`.

Policy-Based Enforcement

Enforce tagging at resource creation time:

**AWS**: Use AWS Config rules to check tag compliance (alert or deny) **Azure**: Use Azure Policy for tag inheritance and enforcement **GCP**: Use Organization Policies to restrict label values **Kubernetes**: Use OPA Gatekeeper or Kyverno for admission control

For enforcement implementation patterns, see `references/enforcement-patterns.md`.

Tag Compliance Auditing

Run regular audits (weekly recommended) to identify untagged resources:

**AWS Config Query** (SQL):

SELECT resourceId, resourceType, configuration.tags
WHERE resourceType IN ('AWS::EC2::Instance', 'AWS::RDS::DBInstance')
  AND (configuration.tags IS NULL OR NOT configuration.tags.Environment EXISTS)

**Azure Resource Graph Query** (KQL):

Resources
| where