iac.htora.dev · security templates

Home/Using the templates/Tags every template uses

Tags every template uses

Four tags on everything these templates create, so any resource can be traced to a person and a purpose.

The four tags

TagWhy
ownerWho to call when this breaks.
environmentprod, staging, or dev.
data_classificationHow sensitive the data is: public, internal, confidential, or restricted.
managed_byAlways terraform, so nobody edits it by hand thinking it is unmanaged.

How each tool applies them

WhereHow
AWSThe provider's default_tags block, so every resource gets them without repeating them.
AzureOne local.tags value, set on each resource. The Azure provider has no default tags setting.
KubernetesLabels added by kustomize in the Standard bootstrap template, with includeSelectors: false so selector fields are left alone.
AnsibleNothing to tag. Ansible configures machines that already exist, so the tags belong wherever the machine was created.

Quick start templates hard-code sensible values so there is nothing to fill in.

Naming

Resource names come from one name setting, so everything a template creates sorts together in the console. Change it once and the bucket, the key, the role, and the log group all follow.

What is deliberately missing

There is no cost centre tag and no project code. Those differ too much between organisations to guess, and a tag nobody fills in correctly misleads the next person who reads it. Add yours through the extra_tags setting, which merges over the four above.

Registry 0.6.0. Built 2026-09-22.

Made by Habibullah Tora. Code under the MIT licence, writing under CC BY 4.0.