AWS Tagging and Resource Groups

A tag is a key-value pair attached to an AWS resource. Tags are metadata: AWS does not interpret them, which is precisely why they can carry whatever an organization needs them to carry — an owning team, a cost centre, an environment, a data classification.

Almost every AWS resource that accrues cost can be tagged. Limits are per service; 50 user-defined tags per resource is the common ceiling, and tag keys and values are case-sensitive.

Do not put personal or sensitive data in tags. Tags surface in billing data, in the console and in exports; they are not a place for anything confidential.

What tags are for

Cost allocation. This is the main one. A tag only appears in Cost Explorer and Cost and Usage Reports after it has been activated as a cost allocation tag in the Billing console, and activation is not retrospective — data before activation stays untagged. Activate the tags you care about on day one, not the day someone asks for a cost breakdown.

Access control. Tags can be referenced in IAM policy conditions, so a policy can grant access to resources tagged with a particular department or environment without enumerating ARNs. This is attribute-based access control, and it scales where resource-by-resource policies do not.

Automation. Systems Manager, Backup, Auto Scaling and most automation tooling select targets by tag. A Schedule=office-hours tag is how a shutdown job knows what to stop.

Organisation. Finding things. Filtering a console view. Grouping for reporting.

Keeping tags consistent

Tags are only as useful as they are consistent, and left to themselves they are not consistent: env, Env, Environment and environment will all appear within a month.

• Tag policies in AWS Organizations define the tag keys that are allowed and the values each may take, and report non-compliant resources across every account. See Organizations, accounts, OUs and policies.
• AWS Config rules flag resources missing required tags, and can trigger remediation — up to and including stopping an untagged instance.
• Tag at creation time in your infrastructure-as-code templates. Tagging as a later cleanup pass never finishes.

Agree a small, mandatory set of keys before anything else — owner, environment, cost centre, application — and treat additions as a deliberate decision. A tagging standard nobody can recite is not a standard.

Resource groups

A resource group is a collection of resources defined by a tag query or by resource type. Once grouped, a set of resources can be viewed, managed and automated against as a unit: a custom console view that consolidates metrics, alarms and configuration for one application, or a target for a Systems Manager document.

Typical groupings mirror the tag keys above — by environment, by project, by owning team, by cost centre. Tag Editor, in the same part of the console, is how you find and bulk-edit tags across Regions and services, which is the only practical way to fix a tagging inconsistency after the fact.