AWS Tags

Name:
    human-readable label
    good for console display

Tags:
    structured metadata
    used by billing, IAM, automation, inventory, dashboards, alert routing, backup, cleanup

do not parse resource name for important metadata
put stable metadata in tags

secrets
tokens
passwords
customer PII
raw ticket comments
high-cardinality values such as request id or timestamp

YACE discovery:
    uses AWS Resource Groups Tagging API to find tagged resources
    then queries CloudWatch metrics for those resources

if resource has no tag:
    discovery may not find it

if searchTags do not match:
    resource is filtered out

No tagged resources made it through filtering

YACE queried the namespace and region,
but no tagged resource matched the discovery filter.

discovery:
  jobs:
    - type: AWS/DynamoDB
      regions:
        - ap-northeast-1
      customTags:
        - key: environment
          value: uat
      searchTags:
        - key: Service
          value: order-api
        - key: Environment
          value: prod

searchTags key is case-sensitive:
    Environment != environment

searchTags value is regex:
    prod|staging matches prod or staging

searchTags:
    controls which AWS resources are discovered

tag_* labels:
    tags exported by YACE, for example tag_Env="uat"

exportedTagsOnMetrics:
    explicitly controls which AWS tags are attached to normal CloudWatch metrics
    use it when dashboards / alerts depend on these labels

customTags:
    adds static labels to metrics collected by this YACE job
    for example custom_tag_environment="uat"

searchTags:
    input filter
    decides resource in / out

exportedTagsOnMetrics:
    output label control
    decides which resource tags appear as tag_* labels on metrics

customTags:
    static output label
    adds config-defined labels such as custom_tag_environment="uat"

apiVersion: v1alpha1
sts-region: ap-northeast-1
discovery:
  exportedTagsOnMetrics:
    AWS/DynamoDB:
      - Env
      - ManagedBy
      - Service
  jobs:
    - type: AWS/DynamoDB
      regions:
        - ap-northeast-1
      customTags:
        - key: environment
          value: uat
      searchTags:
        - key: Env
          value: uat
      metrics:
        - name: ConsumedReadCapacityUnits
          statistics: [Sum]
          period: 300
          length: 600

tag_Env="uat"
tag_ManagedBy="Terraform"
tag_Service="order-api"
custom_tag_environment="uat"

sum by (dimension_TableName, tag_Env, tag_ManagedBy, custom_tag_environment) (
  aws_dynamodb_consumed_read_capacity_units_sum{
    tag_Env="uat",
    tag_ManagedBy="Terraform",
    custom_tag_environment="uat"
  }
)

exportedTagsOnMetrics:
    not the same thing as searchTags
    makes tag labels predictable on metrics used by dashboards / alerts

customTags:
    not read from AWS resources
    useful when one YACE job has a known static context
    key: environment is exported as custom_tag_environment="uat"

Grafana filters:
    can use tag_Env / tag_Service / tag_ManagedBy / custom_tag_environment only if those labels exist in the queried metrics

exportedTagsOnMetrics is not a replacement for AWS resource tags.
customTags is not a replacement for discovery tags.
For YACE discovery, add tags when creating the AWS resource.
For Grafana tag filters, verify the tag_* labels exist on the actual metrics.

{__name__=~"aws_dynamodb_.*", tag_Env="uat"}

{__name__=~"aws_dynamodb_.*_info", tag_Env="uat"}

aws resourcegroupstaggingapi get-resources \
  --region ap-northeast-1 \
  --resource-type-filters dynamodb:table

Project
Service
Environment
CostCenter
Team

activate cost allocation tags in Billing
new tags may need time before they appear in cost reports
tag historical coverage matters; missing tags create unallocated cost

cost by Project
cost by Environment
cost by Service inside prod
shared platform cost by Stack or Team

developer can manage dev resources
only when resource tag Environment=dev
and create requests include Project and Environment tags

inconsistent tags become inconsistent permissions
some AWS services have partial tag-on-create support
test deny policies before applying to prod OUs

standardize spelling and allowed values
good for organization-wide consistency
do not grant IAM permissions

detect resources missing required tags
useful for audit and remediation
not every AWS resource type is covered

use carefully
can block resource creation if service does not support tag-on-create
roll out in dev first

locals {
  common_tags = {
    Project     = "commerce"
    Service     = "order-api"
    Environment = "prod"
    ManagedBy   = "terraform"
    Owner       = "platform"
    Team        = "checkout-platform"
    CostCenter  = "fin-042"
    Criticality = "p1"
  }
}

provider "aws" {
  region = "ap-northeast-1"

  default_tags {
    tags = local.common_tags
  }
}

tags = {
  Name         = "prod-order-events"
  MessageType  = "domain-event"
  Producer     = "order-api"
  Consumer     = "order-worker"
}

required:
    Name
    Project
    Service
    Environment
    ManagedBy

recommended:
    Owner
    Team
    CostCenter
    Criticality

conditional:
    DataClass
    BackupPolicy
    RunbookUrl
    DashboardUrl
    ExpiresOn

new AWS resource:
    has standard tags at creation time
    has Service and Environment for monitoring discovery
    has CostCenter if cost allocation matters
    has Owner or Team for incident routing
    has ManagedBy to distinguish Terraform/manual resources

new monitoring dashboard:
    can group by Service and Environment
    can filter discovered AWS resources by tags
    does not depend on parsing Name

new IAM/ABAC policy:
    uses only stable and enforced tags
    tests service tag-on-create behavior first