AWS Tagging Standard

Table of contents

  1. Tags by Category
    1. Technical Tags
    2. Tags for Automation
    3. Business Tags
    4. Security Tags
    5. Tags for Classification
  2. Tags by Use Case
    1. AWS Console Organization & Resource Groups
    2. Cost Allocation
    3. Automation
    4. Operations Support
    5. Access Control
    6. Security Risk Management

Tags by Category

Technical Tags

Tag KeyDescriptionExample
nameDescriptive name of the resourceweb-server-prod
ownerPerson/team responsiblejane.doe@company.com
availability-zoneAWS AZ or regionus-west-2a
serviceAWS service typeec2, s3, rds
lifecycleLifecycle stageactive, archived
versionVersion labelv1.3.2
created-dateDate created2024-11-02
last-modified-dateDate last modified2025-04-18
resource-idUnique resource identifieri-04a8b2f3ab1c12345
environment-typeEnvironment classificationproduction, qa, dev

Tags for Automation

Tag KeyDescriptionExample
automatedManaged by automationyes
auto-scaling-groupAssociated scaling groupasg-web-frontend
automation-toolTool managing resourceterraform
scheduled-automationAutomation schedule participationyes
continuous-integrationIntegrated with CI/CD systemjenkins, github-actions
automated-backupBackup enabledtrue
auto-shutdownScheduled shutdown enabledenabled
auto-recoveryAuto-recovery settingenabled
auto-scaling-policyScaling policy usedcpu-usage-threshold
automated-monitoringMonitoring tool enabledcloudwatch

Business Tags

Tag KeyDescriptionExample
cost-centerFinancial cost centerCC-0453-FINANCE
departmentDepartment responsibleengineering
projectProject or initiativeecommerce-platform
business-unitBusiness unitretail-services
customer-idAssociated customercustomer-00192
revenue-centerRevenue groupingrev-west-division
business-criticalityCriticality levelhigh
contract-idRelated contractcontract-2024-xyz
service-level-agreementSLA attached99.99-uptime
business-impactBusiness consequence if downcritical

Security Tags

Tag KeyDescriptionExample
security-classificationSecurity levelconfidential
complianceCompliance standardGDPR, HIPAA
backupIncluded in backupsyes
encryptionEncryption enabledAES-256
access-control-listACL identifieracl-admin-only
security-groupAssociated security groupsg-0a1234cdefb56789a
firewall-ruleRelated firewall rulerule-web-allow-443
vulnerabilityPatch/vulnerability statuspatched
data-classificationSensitivity levelsensitive
security-policyApplied policypci-encryption-required

Tags for Classification

Tag KeyDescriptionExample
environmentResource environmentproduction
applicationApplication associatedinventory-service
regionAWS regionus-east-1
zoneAvailability zoneus-east-1b
roleComponent’s function in architecturefrontend, backend
service-typeNature of servicedatabase, web, cache
deployment-stageRelease maturitybeta, release-candidate
cost-allocationCost tag groupapp-cost-tracking
cost-savingsIncluded in optimizationyes
expiration-dateRetirement/review date2025-12-31

Tags by Use Case

AWS Console Organization & Resource Groups

Use Case KeyDescriptionExample Tag
organize-resourcesGroup by project/env/etc.project = crm-system
resource-group-classificationResource Group setupenvironment = staging

Cost Allocation

Use Case KeyDescriptionExample Tag
cost-trackingTrack by department/projectcost-center = CC-104-marketing
cost-allocation-reportsGenerate Cost Explorer insightsproject = web-migration

Automation

Use Case KeyDescriptionExample Tag
automated-resource-managementUse for Lambda/EC2 controlauto-shutdown = enabled
automated-backup-and-recoveryTargeted backup plansautomated-backup = true

Operations Support

Use Case KeyDescriptionExample Tag
resource-monitoring-and-alertsAlerts, dashboardsautomated-monitoring = cloudwatch
incident-response-and-troubleshootingAssist investigationowner = ops@company.com

Access Control

Use Case KeyDescriptionExample Tag
access-control-policiesIAM policy filteringdepartment = legal
resource-sharing-and-cross-account-accessCross-account role accessaccess-level = partner-view

Security Risk Management

Use Case KeyDescriptionExample Tag
security-group-and-nacl-rulesTrack network policiessecurity-policy = dmz-restrict
asset-inventory-and-vulnerability-managementAudit/patching managementvulnerability = unpatched