Team tag missing on AWS resource

Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: terraform-aws-team-tag-not-present

Provider: AWS

Platform: Terraform

Severity: Low

Category: Best Practices

Learn More

Description

This check ensures that every cloud resource defined in Terraform includes a “Team” tag within the tags attribute, which is critical for tracking resource ownership and accountability. Without a “Team” tag (for example, tags = { Environment = "Production" }), it becomes difficult to determine resource owners, leading to challenges in cost allocation, incident response, and lifecycle management. If left unaddressed, the absence of this tag can result in unmanaged resources remaining active, increasing the risk of security vulnerabilities and unnecessary expenses.

Compliant Code Examples

resource "aws_instance" "good_example" {
  ami           = "ami-123456"
  instance_type = "t2.micro"

  tags = {
    Team        = "DevOps" # ✅ "Team" tag is present
    Environment = "Production"
  }
}

resource "aws_s3_bucket" "good_example" {
  bucket = "my-bucket"

  tags = {
    Team = "Security" # ✅ "Team" tag is present
  }
}

resource "aws_s3_bucket" "good_example" {
  bucket = "my-bucket"

  tags = {
    team = "Security" # ✅ "team" tag is present
  }
}

Non-Compliant Code Examples

resource "aws_instance" "bad_example" {
  ami           = "ami-123456"
  instance_type = "t2.micro"

  tags = {
    Environment = "Production" # ❌ Missing "Team" tag
  }
}

resource "aws_s3_bucket" "bad_example" {
  bucket = "my-bucket"

  # ❌ No tags at all
}

provider "aws" {
  alias = "tagged"
  default_tags {
    tags = {
      Team = "platform" # ❌ default_tags don't propagate to aws_autoscaling_group
    }
  }
}

resource "aws_autoscaling_group" "no_local_team_tag" {
  provider         = aws.tagged
  desired_capacity = 1
  max_size         = 1
  min_size         = 1
  # ❌ Auto Scaling groups need a local "Team" tag because the provider default_tags aren't inherited here
}

provider "aws" {
  region = "us-east-1"
}

provider "aws" {
  alias = "tagged"
  default_tags {
    tags = {
      Team = "platform"
    }
  }
}

# ❌ The default provider has no default_tags, and this resource uses it without a local "Team" tag
resource "aws_s3_bucket" "no_tags_default_provider" {
  bucket = "b1"
}