AWS TAGGING STRATEGIES “How should I tag my AWS resources?” Overview Amazon Web Services (AWS) allows customers to assign metadata to their AWS resources in the form of tags. Each tag is a simple label consisting of a customer-defined key and an optional value that can make it easier to manage, search for, and filter resources. Although there are no inherent types of tags, they enable customers to categorize resources by purpose, owner, environment, or other criteria. This document describes commonly used tagging categories and strategies to help AWS customers implement a consistent and effective tagging strategy. The following sections assume basic knowledge of AWS resources, tagging, detailed billing, and AWS Identity and Access Management (IAM). General Best Practices When creating a tagging strategy for AWS resources, make sure that it accurately represents organizationally relevant dimensions and adheres to the following tagging best practices: Always use a standardized, case-sensitive format for tags, and implement it consistently across all resource types. Consider tag dimensions that support the ability to manage resource access control, cost tracking, automation, and organization. Implement automated tools to help manage resource tags. The Resource Groups Tagging API enables programmatic control of tags, making it easier to automatically manage, search, and filter tags and resources. It also simplifies backups of tag data across all supported services with a single API call per AWS Region. Err on the side of using too many tags rather than too few tags. Remember that it is easy to modify tags to accommodate changing business requirements, however consider the ramifications of future changes, especially in relation to tag-based access control, automation, or upstream billing reports. Tagging Categories Companies that are most effective in their use of tags typically create business-relevant tag groupings to organize their resources along technical, business, and security dimensions. Companies that use automated processes to manage their infrastructure also include additional, automation-specific tags to aid in their automation efforts. Technical Tags Name – Used to identify individual resources Application ID – Used to identify disparate resources that are related to a specific application Application Role – Used to describe the function of a particular resource (e.g. web server, message broker, database) Cluster – Used to identify resource farms that share a common configuration and perform a specific function for an application Environment – Used to distinguish between development, test, and production infrastructure Version – Used to help distinguish between different versions of resources or applications Tags for Automation Date/Time – Used to identify the date or time a resource should be started, stopped, deleted, or rotated Opt in/Opt out – Used to indicate whether a resource should be automatically included in an automated activity such as starting, stopping, or resizing instances Security – Used to determine security requirements, such as encryption, enabling Amazon VPC Flow Logs, and also to identify route tables or security groups that deserve extra scrutiny ©2017, Amazon Web Services, Inc. or its affiliates. All rights reserved. June 2, 2017 Business Tags Owner – Used to identify who is responsible for the resource Cost Center/Business Unit – Used to identify the cost center or business unit associated with a resource; typically for cost allocation and tracking Customer – Used to identify a specific client that a particular group of resources serves Security Tags Confidentiality – An identifier for the specific dataconfidentiality level a resource supports Compliance – An identifier for workloads designed to adhere to specific compliance requirements Project – Used to identify the project(s) the resource supports 1
