Tags
- What they are
- Key-value metadata labels attached to AWS resources.
Environment=Production,CostCenter=1234,Owner=team-payments. - Free. Up to 50 tags per resource. Keys are case sensitive.
- Key-value metadata labels attached to AWS resources.
- What they are used for
- Cost allocation — activate them in the Billing console to break down spend by team, project, or environment. See cost allocation tags.
- Automation — target resources by tag in AWS Systems Manager, backup plans, and scripts (for example, stop everything tagged
Environment=Devat night). - Access control — attribute-based access control (ABAC) in IAM: a policy grants access only where the resource tag matches the principal’s tag. Scales far better than naming every ARN.
- Organization — group and find resources with Resource Groups.
- Governance
- Tag policies in AWS Organizations enforce allowed keys and value casing across accounts.
- AWS Config rules flag untagged resources.
- AWS Resource Groups and Tag Editor applies or corrects tags in bulk across Regions.
- Gotchas
- Tags are not retroactive for billing — activate cost allocation tags before you need the data.
- Not every resource type supports tags, and tags do not propagate automatically from a parent to child resources in every service.
- Never put secrets or PII in a tag; tags are visible in billing reports and to many read-only roles.