Resource Tagging
Compliance & GovernanceResource Tagging is the practice of labeling AWS resources with key-value metadata. Tags are fundamental to security governance at scale.
Security Use Cases
- Attribute-Based Access Control (ABAC): IAM policies that grant/deny access based on tags (e.g.,
aws:ResourceTag/Environment = Production) - Cost Allocation: track security spending by team, project, or compliance requirement
- Compliance Scoping: tag resources as
PCI=trueorHIPAA=truefor audit - Automation: target patching, backup, and remediation based on tags
- Ownership: identify who owns and is responsible for each resource
Enforcement
- Tag Policies: enforce tag keys and allowed values across AWS Organizations
- SCPs: deny resource creation without required tags
- Config Rules: detect resources missing required tags
- Service Catalog: enforce tags at provisioning time
Related AWS Services
Related Terms
An organization-wide guardrail that restricts what actions member accounts can perform, regardless of their IAM policies.
A service for centrally managing multiple AWS accounts with consolidated billing, service control policies (SCPs), and organizational units (OUs).
Meeting regulatory requirements and industry standards (SOC 2, HIPAA, GDPR, PCI DSS, CIS) for data protection, access control, and security practices in the cloud.
A JSON document that defines permissions - which actions are allowed or denied on which AWS resources, and under what conditions.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.