AWS: Establish tag policies for the organization

[ameukam]

Establish and implement tag policies across the organization.

• Tags at the org level
• Tags at the account level
• Tags at the ressource level

/area infra
/area infra/aws
/priority important-soon
/milestone v1.27

[ameukam]

cc @deobieta @sftim

[sftim]

What outcomes do we have / want in GCP land? Let's aim for equivalent outcomes on AWS.

[ameukam]

We currently don't have a tags strategy on GCP so I think we can start with AWS and replicate/extand to GCP. I don't have specific outcomes of this. The ultimate goal will be to easily track costs across the entire organization (what's are the specific costs of a specific workload, service, OU, etc...)

[deobieta]

/assign

[deobieta]

Hello, I've been reading about tag policies and these are my findings:

1. Tag policies only describe accepted values for tags and not their presence on resources. Resources with non-compliant tags can be fetched via the AWS Resource Groups console so they can be corrected using the console or tagging API operations of the AWS service, or the Resource Group Tag Editor console.
2. Tag policies can be enforced on certain resources. This means that non-compliant tagging requests on specified resource types are prevented from completing; however, enforcement does not affect untagged resources so users with the right IAM permissions could still create untagged resources or delete compliant tags.
3. To ensure that AWS resources are created with the appropriate tags and deny tag deletion we need to use Tag policies in conjunction with Service Control Policies.

Questions.

1. What tag strategy should we use? Tag policies, Enforced Tag policies, Enforced Tag policies + SCPs.
2. Which resources should we enforce compliance?
3. What tag convention should we use? For example, Costcenter, costcenter, or CostCenter.
4. Which tags should we start using for cost management ? For example, Workload, Service, OU, SIG, WG, UG.

@ameukam Is it possible to create an OU for policy staging and add at least one AWS account to the OU for Tag policy and inheritance testing.