AWS Tag Design Guide: The Most Fundamental Governance Connecting Cost, Security, and Operations

When operating AWS, resources such as EC2, S3, RDS, Lambda, EKS, CloudFront, VPC, and EBS rapidly increase. Initially, with only a few resources, they can be distinguished by name alone. However, as the number of accounts grows and development, testing, and production environments become separated, management becomes difficult with simple names.

At this point, the most fundamental management system is tagging.

AWS tags are key-value metadata attached to resources. For example, you can attach the following tags to an EC2 instance:

Name = web-prod-ec2-01
Environment = prod
Owner = security-team
Service = homepage
CostCenter = edu-platform
ManagedBy = terraform

Attaching tags in this way goes beyond mere aesthetics, enabling cost analysis, owner tracking, automation, security control, incident response, and access control.

---

1. Why should tags be managed?

AWS tags are not just simple labels. From an operational perspective, they are akin to a resource’s ID card.

Without tags, the following problems arise:

Problem	Description
Difficulty tracking costs	Difficult to know which team, service, or project incurred costs
Unclear resource owner	Difficult to find the responsible person in case of an incident
Difficulty managing security exceptions	Difficult to distinguish between production and development resources
Difficulty with automation	Difficult to back up, terminate, or scan resources only for specific environments
Difficulty identifying cleanup targets	Difficult to distinguish old, test, or unused resources
Limitations in permission control	Difficult to design tag-based access control, i.e., ABAC

As the AWS environment grows, tags become not an option, but essential operational data.

A tagging strategy is particularly necessary for organizations that:

• Use multiple AWS accounts
• Have separate development, testing, and production environments
• Require project-based cost billing
• Need to comply with ISMS-P, financial security, and internal audits
• Use IaC tools like Terraform, CloudFormation, and CDK
• Operate multi-account environments based on AWS Organizations and Control Tower

---

2. Core Principles of Tag Design

To use tags effectively,