resource-tagging_skill

Overview

This skill applies and enforces consistent cloud resource tagging across AWS, Azure, GCP, and Kubernetes to enable cost allocation, ownership tracking, compliance, and automation. It codifies a minimum viable tagging strategy (the “Big Six”), naming conventions, enforcement patterns, and audit workflows. The goal is to reduce unallocated spend, speed incident response, and make infrastructure automation reliable across multi-cloud environments.

How this skill works

The skill inspects resource metadata and applies tag/label standards via Infrastructure-as-Code modules (Terraform/Pulumi), provider policies (Azure Policy, GCP org policies, AWS Organizations), and admission controllers for Kubernetes (Kyverno/OPA). It runs periodic audits to detect missing or inconsistent tags, reports compliance gaps, and supports remediation patterns like policy denial, automated mutation, or IaC updates. Cost allocation and billing exports are validated to ensure tags are usable for FinOps reporting.

When to use it

• Implementing cloud governance or FinOps to enable showback/chargeback
• Enforcing compliance (PCI, HIPAA, SOC2) via automated policy scope
• Automating lifecycle actions (backup, auto-shutdown, monitoring) that target tagged resources
• Managing multi-tenant, multi-project, or multi-environment cloud estates
• Onboarding IaC modules or centralizing tagging standards across teams

Best practices

• Start with the “Big Six”: Name, Environment, Owner, CostCenter, Project, ManagedBy and enforce them as required tags
• Choose one naming convention organization-wide (PascalCase, lowercase, kebab-case or namespaced) and apply provider-specific rules
• Apply tags via provider-level defaults in IaC to eliminate manual errors and ensure inheritance
• Use hard enforcement for cost allocation tags and soft enforcement (audits/alerts) for operational tags
• Run weekly tag compliance audits and integrate remediation into CI/CD or runbooks

Example use cases

• Enable project-level cost dashboards by enforcing Project and CostCenter labels and exporting billing data to BigQuery/Azure/AWS cost tools
• Block untagged resource creation with Azure Policy / AWS Config deny rules to avoid orphaned spend
• Auto-apply Environment and Owner labels in Kubernetes using Kyverno for consistent pod/deployment metadata
• Trigger automated backups for resources with Backup:daily tag and apply retention policies based on SLA tag
• Detect stale Owner tags with weekly audits and sync ownership from the identity provider for remediation