Naming

https://docs.aws.amazon.com/whitepapers/latest/tagging-best-practices/tagging-best-practices.html
https://docs.aws.amazon.com/tag-editor/latest/userguide/best-practices-and-strats.html
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html
https://developer.hashicorp.com/terraform/language/style
https://github.com/cloudposse/terraform-null-label
https://docs.aws.amazon.com/cli/latest/reference/cloudwatch/put-metric-alarm.html
https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Create_Composite_Alarm.html
https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-targetgroup.html
https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html
https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html

AWS:
    use a consistent tagging strategy
    do not put sensitive data in tags or names
    use tags for search, filter, automation, cost, and access control
    a structured resource name is useful, but name can only hold limited metadata

Terraform:
    resource local name should be descriptive noun
    use underscores in Terraform resource identifiers
    do not repeat resource type in Terraform local name

Terraform ecosystem:
    common label pattern is namespace/environment/stage/name/attributes
    generated Name tag is usually a compact human-readable id

AWS resource Name / name:
    <namespace>-<stage>-<name>-<attributes>

example:
    acme-prod-api-lambda-sg

meaning:
    namespace:
        org / platform short name, for example acme
    stage:
        dev / uat / prod
    name:
        application or component, for example api / worker / orders
    attributes:
        role / tier / protocol / resource type, for example private sg

put Region in tag, not name

VPC / subnet / route table / security group:
    already regional and VPC-scoped

ALB / NLB / target group:
    regional; add region only when centralized alert/inventory tools lose region context

ECS / Lambda / RDS / ElastiCache / DynamoDB / SQS:
    regional; tag Region is normally enough

name:
    <namespace>-<stage>-<service>-<attributes>

tag:
    Region = ap-east-1

multi-region name when needed:
    <namespace>-<stage>-<service>-<region>-<attributes>

Name:
    human-readable resource label

tags:
    structured metadata for filters, cost, ownership, routing, and policy

Project
Environment
ManagedBy

Project
Environment
Region
Stack
Service
ManagedBy

Project
Environment
Region
Stack
Service
Owner
Team
CostCenter
Criticality
ManagedBy

locals {
  namespace   = "acme"
  stage       = "prod"
  name        = "api"
  region      = "ap-east-1"
  stack       = "ecs"
  id          = "${local.namespace}-${local.stage}-${local.name}"

  common_tags = {
    Project     = "order"
    Environment = local.stage
    Region      = local.region
    Stack       = local.stack
    Service     = local.name
    ManagedBy   = "terraform"
    Owner       = "alice.chen@example.com"
    Team        = "checkout-platform"
    CostCenter  = "fin-ops-042"
    Criticality = "high"
  }
}

resource "aws_security_group" "lambda" {
  name = "${local.id}-lambda-sg"
  tags = merge(local.tags, {
    Name = "${local.id}-lambda-sg"
  })
}

acme:network-tier:
    public / private

acme:subnet-role:
    public-ingress / private-app / private-data / private-endpoint

resource "aws_security_group" "lambda" {
  name        = "${local.id}-lambda-sg"
  description = "Security group for ${local.id} Lambda ENIs"
  vpc_id      = data.aws_vpc.selected.id

  tags = merge(local.tags, {
    Name = "${local.id}-lambda-sg"
  })
}

resource "aws_security_group" "ec2" {
  name        = "${local.namespace}-${local.stage}-bastion-ec2-sg"
  description = "Security group for bastion EC2 instances"
  vpc_id      = data.aws_vpc.selected.id

  tags = merge(local.tags, {
    Name = "${local.namespace}-${local.stage}-bastion-ec2-sg"
  })
}

metric alarm:
    <namespace>-<stage>-<service>-<resource-type>-<signal>

composite alarm:
    <namespace>-<stage>-<service>-composite-<symptom>

log metric alarm:
    <namespace>-<stage>-<service>-log-<signal>

optional severity suffix:
    <namespace>-<stage>-<service>-<resource-type>-<signal>-<severity>

organization namespace:
    acme
    appears in alarm_name to match the rest of the naming standard

CloudWatch metric namespace:
    AWS/Lambda
    AWS/EC2
    AWS/ApplicationELB
    custom namespace such as Acme/OrderApi
    belongs in the alarm metric definition and tags, not usually in alarm_name

resource "aws_cloudwatch_metric_alarm" "lambda_errors" {
  alarm_name          = "${local.namespace}-${local.stage}-${local.name}-lambda-capture-errors-high"
  alarm_description   = "Lambda capture errors are above threshold"
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = 3
  datapoints_to_alarm = 2
  metric_name         = "Errors"
  namespace           = "AWS/Lambda"
  period              = 60
  statistic           = "Sum"
  threshold           = 1
  treat_missing_data  = "notBreaching"

  dimensions = {
    FunctionName = aws_lambda_function.capture.function_name
  }

  tags = merge(local.tags, {
    Name                     = "${local.namespace}-${local.stage}-${local.name}-lambda-capture-errors-high"
    "acme:severity"          = "p1"
    "acme:alarm-signal"      = "errors-high"
    "acme:monitored-service" = local.name
    "acme:metric-namespace"  = "AWS/Lambda"
  })
}

do:
    follow namespace-stage-service-attributes order
    include organization namespace, stage, detailed service, resource type, and signal
    make service specific enough, for example api-public / api-blue / payment-dlq
    include direction in signal: high / low / missing / unhealthy
    keep alarm_name stable because notification routing and runbooks may reference it
    use tags for severity, owner, runbook, dashboard, metric namespace, and escalation metadata

avoid:
    severity prefix by default; use severity tag or optional suffix instead
    CloudWatch metric namespace literal in alarm name, such as AWS/Lambda
    full ARN or long target group ARN suffix in alarm name
    threshold value in name unless it is part of SLO language
    random suffix
    resource ID only, such as i-1234567890abcdef

must:
    use tags for filtering and automation
    keep Name human-readable and short
    keep tag keys consistent across all resources
    avoid secrets, customer names, tickets, or incident IDs in names/tags
    check service-specific name length and character limits

prefer:
    namespace-stage-name-attributes
    lowercase values for generated names
    short generated names for target groups
    account/region in globally unique names such as S3 buckets

avoid:
    inventing a different pattern per service team
    encoding all metadata into resource names
    parsing environment or subnet type from Name when tags can express it