Resource not using tags

Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: terraform-aws-resource-not-using-tags

Provider: AWS

Platform: Terraform

Severity: Low

Category: Best Practices

Learn More

Description

AWS resource tagging is an essential best practice that supports resource management, cost tracking, automation, and security enforcement. If only the default Name tag is applied and no additional metadata tags (such as Environment, Owner, or Project) are defined, resources may become difficult to identify, audit, and manage at scale, increasing the risk of misconfiguration or unintended resource exposure. For example, a secure configuration should use a tags block with descriptive tags:

tags = {
  Name        = "example-cert"
  Environment = "production"
  Owner       = "devops-team"
}

Compliant Code Examples

resource "aws_acm_certificate" "cert" {
  domain_name       = "example.com"
  validation_method = "DNS"

  tags = {
    Environment = "test"
  }

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_acm_certificate_validation" "example" {
  certificate_arn         = aws_acm_certificate.example.arn
  validation_record_fqdns = [for record in aws_route53_record.example : record.fqdn]
}

resource "aws_iam_role" "offsite_restore_github" {
  name               = "au-offsite-restore"
  assume_role_policy = data.aws_iam_policy_document.offsite_restore_github_assume_role.json
  tags               = local.tags
}

Non-Compliant Code Examples

resource "aws_acm_certificate" "cert" {
  domain_name       = "example.com"
  validation_method = "DNS"

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_acm_certificate" "cert_2" {
  domain_name       = "example.com"
  validation_method = "DNS"

  tags = {
    Name = "test"
  }

  lifecycle {
    create_before_destroy = true
  }
}