Resource Tagging

Apply comprehensive cloud resource tagging strategies to enable cost allocation, ownership tracking, compliance enforcement, and infrastructure automation across multi-cloud environments.

When to Use

Use this skill when:

Implementing cloud governance frameworks for cost allocation and accountability
Building FinOps practices requiring spend visibility by team, project, or department
Enforcing compliance requirements (PCI, HIPAA, SOC2) through automated policies
Setting up automated resource lifecycle management (backup, monitoring, shutdown)
Managing multi-tenant or multi-project cloud environments
Implementing disaster recovery and backup policies based on criticality
Tracking resource ownership for security incident response
Optimizing cloud costs through spend analysis and showback/chargeback

Key Features

1. Minimum Viable Tagging Strategy

Start with the "Big Six" required tags for all cloud resources:

Tag	Purpose	Example Value
Name	Human-readable identifier	`prod-api-server-01`
Environment	Lifecycle stage	`prod` \| `staging` \| `dev`
Owner	Responsible team contact	`platform-team@company.com`
CostCenter	Finance code for billing	`CC-1234`
Project	Business initiative	`ecommerce-platform`
ManagedBy	Resource creation method	`terraform` \| `pulumi` \| `manual`

Optional tags to add based on specific needs:

Application: Multi-app projects requiring app-level isolation
Component: Resource role (web, api, database, cache)
Backup: Backup policy (daily, weekly, none)
Compliance: Regulatory scope (PCI, HIPAA, SOC2)
SLA: Service level (critical, high, medium, low)

2. Tag Naming Conventions

Choose ONE naming convention organization-wide:

Convention	Format	Example	Best For
PascalCase	`CostCenter`, `ProjectName`	AWS standard	AWS-first orgs
lowercase	`costcenter`, `project`	GCP labels (required)	GCP-first orgs
kebab-case	`cost-center`, `project-name`	Azure (case-insensitive)	Azure-first orgs
Namespaced	`company:environment`, `team:owner`	Multi-org tag policies	Large enterprises

Critical: Case sensitivity varies by provider:

AWS: Case-sensitive (Environment ≠ environment)
Azure: Case-insensitive (Environment = environment)
GCP: Lowercase required (environment only)
Kubernetes: Case-sensitive (environment ≠ Environment)

3. Cloud Provider Tag Limits

Provider	Tag Limit	Key Length	Value Length	Case Sensitive	Inheritance
AWS	50 user-defined	128 chars	256 chars	Yes	Via tag policies
Azure	50 pairs	512 chars	256 chars	No	Via Azure Policy
GCP	64 labels	63 chars	63 chars	No	Via org policies
Kubernetes	Unlimited	253 prefix + 63 name	63 chars	Yes	Via namespace

4. Tag Enforcement Patterns

Infrastructure as Code (Recommended):

Apply tags automatically via Terraform/Pulumi to reduce manual errors by 95%:

# Terraform: Provider-level default tags
provider "aws" {
  default_tags {
    tags = {
      Environment = var.environment
      Owner       = var.owner
      CostCenter  = var.cost_center
      Project     = var.project
      ManagedBy   = "terraform"
    }
  }
}

All resources automatically inherit these tags. Resource-specific tags merge with defaults.

Policy-Based Enforcement:

Enforce tagging at resource creation time:

AWS: Use AWS Config rules to check tag compliance (alert or deny)
Azure: Use Azure Policy for tag inheritance and enforcement
GCP: Use Organization Policies to restrict label values
Kubernetes: Use OPA Gatekeeper or Kyverno for admission control

5. Cost Allocation with Tags

Enable cost allocation tags to track spending by team, project, or department

AWS Cost Explorer:

Activate cost allocation tags (up to 24 hours for activation):

# Enable cost allocation tags via Terraform
resource "aws_ce_cost_allocation_tag" "environment" {
  tag_key = "Environment"
  status  = "Active"
}

resource "aws_ce_cost_allocation_tag" "project" {
  tag_key = "Project"
  status  = "Active"
}

Set up cost anomaly detection by tag:

resource "aws_ce_anomaly_monitor" "project_monitor" {
  name         = "project-cost-monitor"
  monitor_type = "DIMENSIONAL"

  monitor_specification = jsonencode({
    Tags = {
      Key    = "Project"
      Values = ["ecommerce", "mobile-app"]
    }
  })
}

Azure Cost Management:

Group costs by tags in dashboards. Export cost data with tag breakdowns:

az consumption usage list \
  --start-date 2025-12-01 \
  --query "[].{Cost:pretaxCost, Project:tags.Project, Team:tags.Owner}"

GCP Cloud Billing:

Export billing data to BigQuery with label breakdowns:

SELECT
  labels.key AS label_key,
  labels.value AS label_value,
  SUM(cost) AS total_cost
FROM `project.dataset.gcp_billing_export_v1_XXXXX`
CROSS JOIN UNNEST(labels) AS labels
WHERE labels.key IN ('environment', 'project', 'costcenter')
GROUP BY label_key, label_value
ORDER BY total_cost DESC

Quick Start

Terraform Default Tags (AWS)

provider "aws" {
  default_tags {
    tags = {
      Environment = "production"
      Owner       = "platform-team@company.com"
      CostCenter  = "CC-1234"
      Project     = "ecommerce"
      ManagedBy   = "terraform"
    }
  }
}

# All resources inherit these tags automatically
resource "aws_instance" "example" {
  ami           = "ami-12345678"
  instance_type = "t3.micro"

  # Resource-specific tags merge with default tags
  tags = {
    Name = "web-server-01"
  }
}

Azure Policy for Tag Inheritance

resource "azurerm_policy_assignment" "inherit_environment" {
  name                 = "inherit-environment-tag"
  policy_definition_id = azurerm_policy_definition.inherit_tags.id

  parameters = jsonencode({
    tagName = { value = "Environment" }
  })
}

Kubernetes Label Propagation (Kyverno)

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: add-default-labels
spec:
  rules:
  - name: add-environment-label
    match:
      resources:
        kinds: [Pod, Deployment]
    mutate:
      patchStrategicMerge:
        metadata:
          labels:
            +(environment): "{{request.namespace}}"

Tag Compliance Auditing

Run regular audits (weekly recommended) to identify untagged resources

AWS Config Query (SQL):

SELECT resourceId, resourceType, configuration.tags
WHERE resourceType IN ('AWS::EC2::Instance', 'AWS::RDS::DBInstance')
  AND (configuration.tags IS NULL OR NOT configuration.tags.Environment EXISTS)

Azure Resource Graph Query (KQL):

Resources
| where type in~ ('microsoft.compute/virtualmachines')
| where isnull(tags.Environment) or isnull(tags.Owner)
| project name, type, resourceGroup, tags

GCP Cloud Asset Inventory:

gcloud asset search-all-resources \
  --query="NOT labels:environment OR NOT labels:owner" \
  --format="table(name,assetType,labels)"

Decision Framework: Required vs. Optional Tags

REQUIRED (enforce with hard deny):

Cost allocation: Owner, CostCenter, Project
Lifecycle: Environment, ManagedBy
Identification: Name

RECOMMENDED (soft enforcement - alert only):

Operational: Backup, Monitoring, Schedule
Security: Compliance, DataClassification
Support: SLA, ChangeManagement

OPTIONAL (no enforcement):

Custom: Application, Component, Customer
Experimental: Any non-standard tags

Enforcement methods:

Hard enforcement (deny resource creation): Use for cost allocation tags
Soft enforcement (alert only): Use for operational tags
No enforcement (best-effort): Use for custom/experimental tags

Tag Inheritance Strategies

Reduce manual tagging effort through automatic inheritance

AWS Tag Policies:

{
  "tags": {
    "Environment": {
      "tag_key": {
        "@@assign": "Environment"
      },
      "enforced_for": {
        "@@assign": ["ec2:instance", "s3:bucket"]
      }
    }
  }
}

Azure Tag Inheritance:

resource "azurerm_policy_assignment" "inherit_environment" {
  name                 = "inherit-environment-tag"
  policy_definition_id = azurerm_policy_definition.inherit_tags.id

  parameters = jsonencode({
    tagName = { value = "Environment" }
  })
}

GCP Label Inheritance:

resource "google_organization_policy" "require_labels" {
  org_id     = var.organization_id
  constraint = "constraints/gcp.resourceLabels"

  list_policy {
    allow {
      values = ["environment:prod", "environment:staging"]
    }
    inherit_from_parent = true
  }
}

Common Anti-Patterns

Anti-Pattern 1: Inconsistent Tag Naming

Problem: Multiple variations of the same tag across resources

# BAD: Tag sprawl
Environment: prod
environment: production
Env: prod
ENVIRONMENT: PROD

Solution: Enforce single naming convention via IaC and tag policies

# GOOD: Consistent naming
Environment: prod  # Single standard format

Anti-Pattern 2: Manual Resource Creation Without Tags

Problem: CLI/console-created resources missing required tags

Solution: Block untagged resource creation via Config/Policy rules, or use AWS Service Catalog/Azure Blueprints with pre-tagged templates

Anti-Pattern 3: No Tag Enforcement (Voluntary Tagging)

Problem: Tags are optional, frequently forgotten, leading to 35% unallocated spend

Solution: Use provider default tags in IaC + policy enforcement at account/subscription level

Anti-Pattern 4: Tag Sprawl (Too Many Custom Tags)

Problem: 30+ tags per resource, most unused, causing noise in cost reports

Solution: Start with "Big Six" required tags only. Add optional tags only when clear use case exists.

Anti-Pattern 5: Static Tags Not Updated

Problem: Tags set at creation but never updated (e.g., Owner outdated after team changes)

Solution: Run automated tag audits (weekly), use IaC to update tags programmatically, integrate with identity provider for owner updates

Implementation Checklist

Integration with Other Skills

writing-infrastructure-code: Tags applied automatically via Terraform/Pulumi modules
optimizing-costs: Tags enable cost allocation, showback/chargeback, and budget alerts
implementing-compliance: Tags prove PCI/HIPAA/SOC2 scope for audit trails
architecting-security: Tags enforce security policies (e.g., public vs. internal access)
planning-disaster-recovery: Tags identify resources for backup policies
operating-kubernetes: Labels used for pod scheduling, resource quotas, network policies

Key Takeaways

Start with "Big Six" required tags: Name, Environment, Owner, CostCenter, Project, ManagedBy
Enforce at creation time: Use AWS Config, Azure Policy, GCP org policies to block untagged resources
Automate with IaC: Terraform/Pulumi default tags reduce manual errors by 95%
Enable cost allocation: Activate billing tags to reduce unallocated spend by 80%
Choose ONE naming convention: PascalCase, lowercase, or kebab-case - enforce consistently
Inherit tags from parents: Resource groups, folders, namespaces propagate tags automatically
Audit regularly: Weekly tag compliance checks catch drift and prevent sprawl
Tag inheritance reduces effort: Let parent resources propagate common tags to children

References

Full skill documentation: /skills/resource-tagging/SKILL.md
Tag taxonomy and categories: /skills/resource-tagging/references/tag-taxonomy.md
Enforcement patterns: /skills/resource-tagging/references/enforcement-patterns.md
Cost allocation setup: /skills/resource-tagging/references/cost-allocation.md
Compliance auditing queries: /skills/resource-tagging/references/compliance-auditing.md
Terraform examples: /skills/resource-tagging/examples/terraform/
Kubernetes manifests: /skills/resource-tagging/examples/kubernetes/

When to Use​

Key Features​

1. Minimum Viable Tagging Strategy​

2. Tag Naming Conventions​

3. Cloud Provider Tag Limits​

4. Tag Enforcement Patterns​

5. Cost Allocation with Tags​

Quick Start​

Terraform Default Tags (AWS)​

Azure Policy for Tag Inheritance​

Kubernetes Label Propagation (Kyverno)​

Tag Compliance Auditing​

Decision Framework: Required vs. Optional Tags​

Tag Inheritance Strategies​

Common Anti-Patterns​

Anti-Pattern 1: Inconsistent Tag Naming​

Anti-Pattern 2: Manual Resource Creation Without Tags​

Anti-Pattern 3: No Tag Enforcement (Voluntary Tagging)​

Anti-Pattern 4: Tag Sprawl (Too Many Custom Tags)​

Anti-Pattern 5: Static Tags Not Updated​

Implementation Checklist​

Integration with Other Skills​

Key Takeaways​

References​