c3.3 Define a tagging strategy
Tags are user-defined metadata (key/value) on resources. A consistent tagging strategy underpins attribute-based access control, ownership and cost tracking, automation, and incident response — for example protecting a compromised instance from accidental deletion.
Implementation guidance
Why tags matter for security
Tags let you organize, search, and govern resources, and they enable several security capabilities:
- Attribute-based access control (ABAC) — grant access based on matching tags, for example letting developers act only on resources tagged
environment: development. - Ownership — identify the individual or business unit responsible for a resource.
- Incident response — tagging a compromised instance, combined with a Deny policy on that tag, can prevent accidental deletion of forensic evidence.
Follow tagging best practices
- Never store PII or confidential data in tags.
- Use a standardized, case-consistent format applied across all resource types.
- Design tags for multiple purposes: access control, cost allocation, automation, and organization.
- Automate with the Resource Groups Tagging API to apply, search, and audit tags at scale.
- Prefer more tags over fewer, but plan changes carefully — changing a tag used for ABAC means updating the IAM policies that reference it.
See the tagging best practices whitepaper and the general tagging guidance.
Watch
How to validate
- Do you have a documented, consistently applied tagging strategy?
- Are tags used to enforce access (ABAC) and to identify resource owners?
- Do you avoid storing PII or secrets in tags, and automate tagging at scale?
Threats addressed
- Without consistent tagging you cannot reliably enforce attribute-based access control, attribute ownership, or protect forensic evidence during an incident.