resource-tagging

Resource Tagging

A tag is metadata that answers a question someone will ask later: who owns this, what does it cost, can it be deleted, does it run in production. Most tagging efforts fail not because tags are hard to write but because they're optional — added when someone remembers, skipped under deadline pressure, and drifted from reality within a quarter. A tag that isn't enforced is a suggestion, and a suggestion doesn't survive contact with a deadline.

The payoff for tagging discipline isn't the tags themselves — it's every downstream capability that depends on them: cost allocation, ownership lookup, automated cleanup, and policy scoping all break silently when tags are missing or wrong.

A tag that isn't enforced at creation time will be missing by the time you need it.

1. Design a small taxonomy before you enforce anything

A taxonomy with twenty required keys guarantees a low compliance rate, because every optional field is a place for a provisioning pipeline to skip a step under time pressure. Start with the handful of keys that answer the questions actually asked — owner, cost center, environment, service — and add more only when a real use case demands it.

Key	Answers
owner	Who to page or ask before deleting this
cost-center	Which budget this rolls up to
environment	prod / staging / dev — safe to tear down?
service	Which system this belongs to

Done when: the required tag set is short enough that no team has a plausible excuse for skipping one.

2. Enforce tags at provision time, not after the fact

A tagging policy that's checked by a nightly report finds violations a day late, after the resource is already running untracked. Enforcing required tags in the provisioning path — Terraform policy checks, admission control, or the cloud provider's native tag policies — rejects the untagged resource before it exists rather than flagging it after the fact.

• Fail the provisioning step, don't just warn, when a required tag is missing.
• Default where safe — an environment tag can often be inferred from the pipeline that deployed it, reducing what a human has to type.
• Apply the same enforcement to manual console changes as to automated pipelines, or the policy only covers the traffic that was already disciplined.