← Back to Documentation

Tag Governance

Surface untagged resources in every audit. Useful for tracking ownership, preventing accidental deletion, and enabling accurate AWS Cost Explorer cost allocation.

Overview

StackSage includes an opt-in untagged resource detector. It flags EC2 instances, EBS volumes (≥ 50 GB), and RDS instances that have zero user-defined tags (AWS-managed aws:* tags are ignored). Each finding includes the resource's estimated monthly cost so you can prioritise which resources to tag first.

Opt-in only. The tagging check is disabled by default to keep reports focused. Enable it per the instructions below when you want tagging compliance findings included.

Enable the check

Add the following to your stacksage.yml:

detectors:
  check_tagging_compliance: true

When enabled, any resource with no user-defined tags appears as an untagged_resource finding with severity low and a copy-paste aws … create-tags remediation command.

Example finding

{
  "type": "untagged_resource",
  "resource_type": "ec2",
  "id": "i-0abc123def456",
  "region": "us-east-1",
  "instance_type": "t3.medium",
  "estimated_monthly_cost_usd": 30.37,
  "severity": "low",
  "recommended_action": "add-basic-tags",
  "remediation_commands": [
    "aws ec2 create-tags --resources i-0abc123def456 --tags Key=Name,Value=<name> Key=Environment,Value=<prod|dev|test> Key=Owner,Value=<team>"
  ]
}

Suppress noisy resources

Use exclusions to skip specific resources or entire regions from the tagging check:

exclude:
  resource_ids:
    - i-0abc123def456   # intentionally untagged (legacy)
  tags:
    - key: ManagedBy
      value: terraform  # terraform-managed resources tagged by IaC

Related topics