Tag every resource with its owner

How to do it

Set the tags once in the provider's default tags, so each resource gets them without extra code. Use the same tag keys in every account. Turn on the tags for cost reports, such as cost allocation tags in AWS or labels in Google Cloud billing. Fail untagged plans with the policy on the plan.

Example

provider "aws" {
  region = "eu-north-1"
  default_tags {
    tags = {
      owner       = "web-team"
      service     = "shop"
      environment = var.environment
      managed-by  = "opentofu"
    }
  }
}

// Pulumi in TypeScript: pass this provider to every resource
import * as aws from '@pulumi/aws';

const provider = new aws.Provider('tagged', {
  region: 'eu-north-1',
  defaultTags: { tags: { owner: 'web-team', service: 'shop', environment: 'production', 'managed-by': 'pulumi' } },
});

import pulumi_aws as aws

provider = aws.Provider("tagged", region="eu-north-1", default_tags={
    "tags": {"owner": "web-team", "service": "shop", "environment": "production", "managed-by": "pulumi"},
})

How to check

A resource search finds no taggable resource missing any of the owner, service, environment and managed-by tags. The cost report groups at least 95 percent of last month's spend by service.