Home/Using the templates/Tags every template uses
Tags every template uses
Four tags on everything these templates create, so any resource can be traced to a person and a purpose.
The four tags
| Tag | Why |
|---|---|
owner | Who to call when this breaks. |
environment | prod, staging, or dev. |
data_classification | How sensitive the data is: public, internal, confidential, or restricted. |
managed_by | Always terraform, so nobody edits it by hand thinking it is unmanaged. |
How each tool applies them
| Where | How |
|---|---|
| AWS | The provider's default_tags block, so every
resource gets them without repeating them. |
| Azure | One local.tags value, set on each
resource. The Azure provider has no default tags setting. |
| Kubernetes | Labels added by kustomize in the Standard bootstrap
template, with includeSelectors: false so selector fields are left alone. |
| Ansible | Nothing to tag. Ansible configures machines that already exist, so the tags belong wherever the machine was created. |
Quick start templates hard-code sensible values so there is nothing to fill in.
Naming
Resource names come from one name setting, so everything a template
creates sorts together in the console. Change it once and the bucket, the key, the
role, and the log group all follow.
What is deliberately missing
There is no cost centre tag and no project code. Those differ too much between
organisations to guess, and a tag nobody fills in correctly misleads the next
person who reads it. Add yours through the extra_tags setting, which
merges over the four above.