Tagging Strategies That Actually Work for Cost Allocation

# Mandatory tags enforced via SCP
variable "mandatory_tags" {
  type = map(string)
  default = {
    Environment = "" # prod | staging | dev | sandbox
    Owner       = "" # Email of team/person (e.g., team-payments@company.com)
    Application = "" # App/service name (e.g., payment-api, fraud-detection)
    CostCenter  = "" # Finance cost center code (e.g., ENG-001, MKT-002)
  }
}

variable "recommended_tags" {
  type = map(string)
  default = {
    Project     = "" # Initiative/project (e.g., mobile-app-rewrite, gdpr-compliance)
    Compliance  = "" # Regulatory requirement (e.g., PCI-DSS, SOC2, HIPAA)
    DataClass   = "" # Data sensitivity (public | internal | confidential | restricted)
    Backup      = "" # Backup policy (daily | weekly | none)
    Schedule    = "" # Auto-start/stop schedule (e.g., weekdays-9to5, always-on)
    Contact     = "" # Oncall contact (e.g., @payments-oncall in PagerDuty)
  }
}

# Auto-tags from AWS
aws:autoscaling:groupName: payments-api-asg
aws:cloudformation:stack-name: payments-api-prod
aws:eks:cluster-name: prod-cluster
aws:createdBy: AWSServiceRoleForECS

# Tag Registry
 
## Mandatory Tags
 
| Tag         | Values                     | Owner     | Purpose              |
|-------------|----------------------------|-----------|----------------------|
| Environment | prod, staging, dev, sandbox| DevOps    | Cost allocation      |
| Owner       | Email address              | Engineering| Accountability      |
| Application | Service name               | Engineering| Per-app cost tracking|
| CostCenter  | Finance code (ENG-001)     | Finance   | Chargeback           |
 
## Approved Values
 
### Environment
- `prod`: Production workloads (customer-facing)
- `staging`: Pre-prod testing (mirrors production)
- `dev`: Development/integration testing
- `sandbox`: Experimentation (auto-deleted after 30 days)
 
### CostCenter
- `ENG-001`: Engineering - Platform
- `ENG-002`: Engineering - Product
- `MKT-001`: Marketing - Growth
- `MKT-002`: Marketing - Brand

import boto3
import csv
from collections import defaultdict
 
# Define mandatory tags
MANDATORY_TAGS = {'Environment', 'Owner', 'Application', 'CostCenter'}
 
def get_all_resources():
    """Get all resources using Resource Groups Tagging API"""
    client = boto3.client('resourcegroupstaggingapi', region_name='us-east-1')
    resources = []
 
    paginator = client.get_paginator('get_resources')
    for page in paginator.paginate():
        resources.extend(page['ResourceTagMappingList'])
 
    return resources
 
def assess_compliance(resources):
    """Assess tagging compliance"""
    stats = {
        'total_resources': len(resources),
        'fully_compliant': 0,
        'partially_compliant': 0,
        'non_compliant': 0,
        'by_service': defaultdict(lambda: {'total': 0, 'compliant': 0}),
        'missing_tags': defaultdict(int)
    }
 
    non_compliant_resources = []
 
    for resource in resources:
        arn = resource['ResourceARN']
        service = arn.split(':')[2]  # Extract service from ARN
        tags = {tag['Key']: tag['Value'] for tag in resource.get('Tags', [])}
 
        stats['by_service'][service]['total'] += 1
 
        # Check compliance
        missing = MANDATORY_TAGS - set(tags.keys())
 
        if not missing:
            stats['fully_compliant'] += 1
            stats['by_service'][service]['compliant'] += 1
        elif len(missing) < len(MANDATORY_TAGS):
            stats['partially_compliant'] += 1
            for tag in missing:
                stats['missing_tags'][tag] += 1
            non_compliant_resources.append({
                'arn': arn,
                'service': service,
                'missing_tags': list(missing),
                'existing_tags': tags
            })
        else:
            stats['non_compliant'] += 1
            for tag in missing:
                stats['missing_tags'][tag] += 1
            non_compliant_resources.append({
                'arn': arn,
                'service': service,
                'missing_tags': list(missing),
                'existing_tags': tags
            })
 
    return stats, non_compliant_resources
 
def generate_report(stats, non_compliant_resources):
    """Generate compliance report"""
    print("=" * 80)
    print("AWS TAGGING COMPLIANCE REPORT")
    print("=" * 80)
    print(f"\nTotal Resources: {stats['total_resources']}")
    print(f"Fully Compliant: {stats['fully_compliant']} ({stats['fully_compliant']/stats['total_resources']*100:.1f}%)")
    print(f"Partially Compliant: {stats['partially_compliant']} ({stats['partially_compliant']/stats['total_resources']*100:.1f}%)")
    print(f"Non-Compliant: {stats['non_compliant']} ({stats['non_compliant']/stats['total_resources']*100:.1f}%)")
 
    print("\n" + "=" * 80)
    print("COMPLIANCE BY SERVICE")
    print("=" * 80)
    for service, counts in sorted(stats['by_service'].items(), key=lambda x: x[1]['total'], reverse=True):
        compliance_rate = counts['compliant'] / counts['total'] * 100 if counts['total'] > 0 else 0
        print(f"{service:20} {counts['total']:6} resources  {compliance_rate:5.1f}% compliant")
 
    print("\n" + "=" * 80)
    print("MOST COMMONLY MISSING TAGS")
    print("=" * 80)
    for tag, count in sorted(stats['missing_tags'].items(), key=lambda x: x[1], reverse=True):
        print(f"{tag:20} {count:6} resources missing this tag")
 
    # Export non-compliant resources to CSV
    with open('non_compliant_resources.csv', 'w', newline='') as f:
        writer = csv.writer(f)
        writer.writerow(['ARN', 'Service', 'Missing Tags', 'Existing Tags'])
        for resource in non_compliant_resources:
            writer.writerow([
                resource['arn'],
                resource['service'],
                ', '.join(resource['missing_tags']),
                ', '.join([f"{k}={v}" for k, v in resource['existing_tags'].items()])
            ])
 
    print(f"\n✅ Exported {len(non_compliant_resources)} non-compliant resources to non_compliant_resources.csv")
 
if __name__ == '__main__':
    print("Fetching all AWS resources...")
    resources = get_all_resources()
 
    print(f"Found {len(resources)} resources. Assessing compliance...")
    stats, non_compliant = assess_compliance(resources)
 
    generate_report(stats, non_compliant)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyCreateWithoutMandatoryTags",
      "Effect": "Deny",
      "Action": [
        "ec2:RunInstances",
        "ec2:CreateVolume",
        "ec2:CreateSnapshot",
        "rds:CreateDBInstance",
        "rds:CreateDBCluster",
        "s3:CreateBucket",
        "lambda:CreateFunction",
        "dynamodb:CreateTable",
        "elasticloadbalancing:CreateLoadBalancer",
        "elasticloadbalancing:CreateTargetGroup"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotLike": {
          "aws:RequestTag/Environment": ["prod", "staging", "dev", "sandbox"],
          "aws:RequestTag/Owner": "*@company.com",
          "aws:RequestTag/Application": "*",
          "aws:RequestTag/CostCenter": ["ENG-*", "MKT-*", "SAL-*", "FIN-*"]
        }
      }
    },
    {
      "Sid": "DenyCreateWithoutAllTags",
      "Effect": "Deny",
      "Action": [
        "ec2:RunInstances",
        "rds:CreateDBInstance",
        "lambda:CreateFunction"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:RequestTag/Environment": "true",
          "aws:RequestTag/Owner": "true",
          "aws:RequestTag/Application": "true",
          "aws:RequestTag/CostCenter": "true"
        }
      }
    }
  ]
}

# modules/ec2-instance/main.tf
variable "tags" {
  description = "Resource tags (will be merged with mandatory tags)"
  type        = map(string)
  default     = {}
}
 
variable "mandatory_tags" {
  description = "Mandatory tags enforced by organization"
  type = object({
    Environment = string
    Owner       = string
    Application = string
    CostCenter  = string
  })
}
 
resource "aws_instance" "this" {
  ami           = var.ami_id
  instance_type = var.instance_type
 
  tags = merge(
    var.mandatory_tags,
    var.tags,
    {
      Name       = var.instance_name
      ManagedBy  = "Terraform"
      Module     = "ec2-instance"
      CreatedAt  = timestamp()
    }
  )
}

# environments/prod/main.tf
module "payment_api" {
  source = "../../modules/ec2-instance"
 
  instance_name = "payment-api-prod"
  ami_id        = "ami-0c55b159cbfafe1f0"
  instance_type = "t3.large"
 
  mandatory_tags = {
    Environment = "prod"
    Owner       = "team-payments@company.com"
    Application = "payment-api"
    CostCenter  = "ENG-002"
  }
 
  tags = {
    Project    = "checkout-v2"
    Compliance = "PCI-DSS"
    Backup     = "daily"
  }
}

# terraform/config-rules.tf
resource "aws_config_config_rule" "required_tags" {
  name = "required-tags"
 
  source {
    owner             = "AWS"
    source_identifier = "REQUIRED_TAGS"
  }
 
  input_parameters = jsonencode({
    tag1Key = "Environment"
    tag2Key = "Owner"
    tag3Key = "Application"
    tag4Key = "CostCenter"
  })
 
  depends_on = [aws_config_configuration_recorder.main]
}
 
resource "aws_config_config_rule" "environment_tag_values" {
  name = "environment-tag-values"
 
  source {
    owner             = "AWS"
    source_identifier = "REQUIRED_TAGS"
  }
 
  input_parameters = jsonencode({
    tag1Key   = "Environment"
    tag1Value = "prod,staging,dev,sandbox"
  })
}
 
# Auto-remediation: Tag non-compliant resources
resource "aws_config_remediation_configuration" "auto_tag" {
  config_rule_name = aws_config_config_rule.required_tags.name
 
  target_type      = "SSM_DOCUMENT"
  target_identifier = "AWS-PublishSNSNotification"
 
  parameter {
    name         = "AutomationAssumeRole"
    static_value = aws_iam_role.config_remediation.arn
  }
 
  parameter {
    name         = "TopicArn"
    static_value = aws_sns_topic.tagging_violations.arn
  }
 
  automatic                  = true
  maximum_automatic_attempts = 3
  retry_attempt_seconds      = 60
}

import boto3
from datetime import datetime, timedelta
 
def find_resource_creator(resource_arn):
    """Find who created a resource using CloudTrail"""
    cloudtrail = boto3.client('cloudtrail')
 
    # Extract resource ID from ARN
    resource_id = resource_arn.split('/')[-1]
 
    # Search CloudTrail for creation event
    start_time = datetime.now() - timedelta(days=90)  # CloudTrail retains 90 days
 
    response = cloudtrail.lookup_events(
        LookupAttributes=[
            {
                'AttributeKey': 'ResourceName',
                'AttributeValue': resource_id
            }
        ],
        StartTime=start_time,
        MaxResults=50
    )
 
    if response['Events']:
        event = response['Events'][0]
        username = event.get('Username', 'unknown')
        event_time = event['EventTime']
        event_name = event['EventName']
 
        return {
            'creator': username,
            'created_at': event_time,
            'event': event_name
        }
 
    return None
 
# Example: Find creator of an EC2 instance
creator_info = find_resource_creator('arn:aws:ec2:us-east-1:123456789012:instance/i-0abcd1234efgh5678')
print(f"Created by: {creator_info['creator']}")

# Using AWS CLI for bulk tagging
aws resourcegroupstaggingapi tag-resources \
  --resource-arn-list \
    "arn:aws:ec2:us-east-1:123456789012:instance/i-0abcd1234efgh5678" \
    "arn:aws:ec2:us-east-1:123456789012:instance/i-0abcd1234efgh5679" \
  --tags \
    Environment=prod \
    Owner=team-platform@company.com \
    Application=legacy-monolith \
    CostCenter=ENG-001

{
  Environment = "unknown"
  Owner       = "infra-team@company.com"
  Application = "orphaned"
  CostCenter  = "ENG-001"
  DeleteAfter = "2025-01-15"  # 30-day grace period
}

# Via AWS CLI
aws ce update-cost-allocation-tags-status \
  --cost-allocation-tags-status \
    TagKey=Environment,Status=Active \
    TagKey=Owner,Status=Active \
    TagKey=Application,Status=Active \
    TagKey=CostCenter,Status=Active

# terraform/cost-categories.tf
resource "aws_ce_cost_category" "department" {
  name         = "Department"
  rule_version = "CostCategoryExpression.v1"
 
  rule {
    value = "Engineering"
    rule {
      dimension {
        key           = "COST_CENTER"
        values        = ["ENG-001", "ENG-002", "ENG-003"]
        match_options = ["EQUALS"]
      }
    }
  }
 
  rule {
    value = "Marketing"
    rule {
      dimension {
        key           = "COST_CENTER"
        values        = ["MKT-001", "MKT-002"]
        match_options = ["EQUALS"]
      }
    }
  }
 
  rule {
    value = "Sales"
    rule {
      dimension {
        key           = "COST_CENTER"
        values        = ["SAL-001"]
        match_options = ["EQUALS"]
      }
    }
  }
}
 
resource "aws_ce_cost_category" "team" {
  name         = "Team"
  rule_version = "CostCategoryExpression.v1"
 
  rule {
    value = "Platform Team"
    rule {
      tags {
        key           = "Owner"
        values        = ["team-platform@company.com"]
        match_options = ["EQUALS"]
      }
    }
  }
 
  rule {
    value = "Payments Team"
    rule {
      tags {
        key           = "Owner"
        values        = ["team-payments@company.com"]
        match_options = ["EQUALS"]
      }
    }
  }
}

import boto3
from datetime import datetime, timedelta
import pandas as pd
 
def generate_chargeback_report(start_date, end_date, cost_center):
    """Generate chargeback report for a cost center"""
    ce = boto3.client('ce')
 
    response = ce.get_cost_and_usage(
        TimePeriod={
            'Start': start_date.strftime('%Y-%m-%d'),
            'End': end_date.strftime('%Y-%m-%d')
        },
        Granularity='MONTHLY',
        Filter={
            'Tags': {
                'Key': 'CostCenter',
                'Values': [cost_center]
            }
        },
        Metrics=['UnblendedCost', 'UsageQuantity'],
        GroupBy=[
            {'Type': 'TAG', 'Key': 'Application'},
            {'Type': 'TAG', 'Key': 'Environment'},
            {'Type': 'SERVICE'}
        ]
    )
 
    # Parse response into DataFrame
    rows = []
    for result in response['ResultsByTime']:
        period = result['TimePeriod']['Start']
        for group in result['Groups']:
            app = group['Keys'][0].split('$')[1] if '$' in group['Keys'][0] else 'Untagged'
            env = group['Keys'][1].split('$')[1] if '$' in group['Keys'][1] else 'Untagged'
            service = group['Keys'][2]
            cost = float(group['Metrics']['UnblendedCost']['Amount'])
 
            rows.append({
                'Period': period,
                'Application': app,
                'Environment': env,
                'Service': service,
                'Cost': cost
            })
 
    df = pd.DataFrame(rows)
 
    # Generate summary
    summary = {
        'cost_center': cost_center,
        'period': f"{start_date.strftime('%Y-%m')}",
        'total_cost': df['Cost'].sum(),
        'by_environment': df.groupby('Environment')['Cost'].sum().to_dict(),
        'by_application': df.groupby('Application')['Cost'].sum().to_dict(),
        'top_services': df.groupby('Service')['Cost'].sum().nlargest(5).to_dict()
    }
 
    return summary, df
 
# Generate report for Engineering
last_month_start = datetime.now().replace(day=1) - timedelta(days=1)
last_month_start = last_month_start.replace(day=1)
last_month_end = datetime.now().replace(day=1)
 
summary, detailed = generate_chargeback_report(
    last_month_start,
    last_month_end,
    'ENG-001'
)
 
print(f"Cost Center: {summary['cost_center']}")
print(f"Period: {summary['period']}")
print(f"Total Cost: ${summary['total_cost']:,.2f}")
print("\nBy Environment:")
for env, cost in summary['by_environment'].items():
    print(f"  {env}: ${cost:,.2f}")
print("\nTop Applications:")
for app, cost in list(summary['by_application'].items())[:5]:
    print(f"  {app}: ${cost:,.2f}")

import { EC2Client, CreateTagsCommand, DescribeInstancesCommand } from '@aws-sdk/client-ec2';
import { CloudTrailClient, LookupEventsCommand } from '@aws-sdk/client-cloudtrail';
 
interface EventBridgeEvent {
  detail: {
    eventName: string;
    requestParameters: any;
    responseElements: any;
    userIdentity: {
      principalId: string;
      arn: string;
    };
  };
}
 
const ec2 = new EC2Client({});
const cloudtrail = new CloudTrailClient({});
 
export const handler = async (event: EventBridgeEvent): Promise<void> => {
  const { detail } = event;
 
  // Handle EC2 instance creation
  if (detail.eventName === 'RunInstances') {
    const instanceIds = detail.responseElements?.instancesSet?.items?.map(
      (i: any) => i.instanceId
    ) || [];
 
    if (instanceIds.length === 0) return;
 
    // Check if instances already have mandatory tags
    const describeCmd = new DescribeInstancesCommand({
      InstanceIds: instanceIds
    });
    const instances = await ec2.send(describeCmd);
 
    for (const reservation of instances.Reservations || []) {
      for (const instance of reservation.Instances || []) {
        const tags = instance.Tags || [];
        const tagKeys = tags.map(t => t.Key);
 
        const missingTags = ['Environment', 'Owner', 'Application', 'CostCenter'].filter(
          tag => !tagKeys.includes(tag)
        );
 
        if (missingTags.length > 0) {
          // Attempt to infer tags from creator and context
          const inferredTags = await inferTags(detail, instance);
 
          // Tag the instance
          const createTagsCmd = new CreateTagsCommand({
            Resources: [instance.InstanceId!],
            Tags: [
              ...inferredTags,
              { Key: 'AutoTagged', Value: 'true' },
              { Key: 'AutoTaggedAt', Value: new Date().toISOString() }
            ]
          });
 
          await ec2.send(createTagsCmd);
 
          // Send notification to creator
          await sendTaggingNotification(detail.userIdentity.arn, instance.InstanceId!, missingTags);
 
          console.log(`Auto-tagged instance ${instance.InstanceId} with inferred tags`);
        }
      }
    }
  }
};
 
async function inferTags(event: any, instance: any): Promise<Array<{Key: string, Value: string}>> {
  const tags: Array<{Key: string, Value: string}> = [];
 
  // Infer Owner from IAM principal
  const principalArn = event.userIdentity.arn;
  if (principalArn.includes(':user/')) {
    const username = principalArn.split('/').pop();
    tags.push({ Key: 'Owner', Value: `${username}@company.com` });
  }
 
  // Infer Environment from VPC/Subnet tags
  if (instance.SubnetId) {
    const subnet = await getSubnetTags(instance.SubnetId);
    if (subnet?.Environment) {
      tags.push({ Key: 'Environment', Value: subnet.Environment });
    }
  }
 
  // Infer Application from instance name
  const nameTag = instance.Tags?.find((t: any) => t.Key === 'Name');
  if (nameTag) {
    const appName = nameTag.Value.split('-')[0]; // Extract from naming pattern
    tags.push({ Key: 'Application', Value: appName });
  }
 
  // Default CostCenter to 'ENG-001' (manual review required)
  tags.push({ Key: 'CostCenter', Value: 'ENG-001' });
  tags.push({ Key: 'RequiresReview', Value: 'true' });
 
  return tags;
}
 
async function sendTaggingNotification(userArn: string, resourceId: string, missingTags: string[]): Promise<void> {
  // Send email via SES or Slack notification
  console.log(`Notification: User ${userArn} created ${resourceId} missing tags: ${missingTags.join(', ')}`);
  // Implementation details omitted for brevity
}
 
async function getSubnetTags(subnetId: string): Promise<Record<string, string> | null> {
  // Fetch subnet tags to infer environment
  return null; // Implementation omitted
}

resource "aws_cloudwatch_event_rule" "ec2_creation" {
  name        = "ec2-instance-creation"
  description = "Trigger on EC2 instance creation"
 
  event_pattern = jsonencode({
    source      = ["aws.ec2"]
    detail-type = ["AWS API Call via CloudTrail"]
    detail = {
      eventName = ["RunInstances"]
    }
  })
}
 
resource "aws_cloudwatch_event_target" "lambda" {
  rule      = aws_cloudwatch_event_rule.ec2_creation.name
  target_id = "AutoTagLambda"
  arn       = aws_lambda_function.auto_tag.arn
}

resource "aws_cloudwatch_dashboard" "tagging_compliance" {
  dashboard_name = "Tagging-Compliance"
 
  dashboard_body = jsonencode({
    widgets = [
      {
        type = "metric"
        properties = {
          metrics = [
            ["AWS/Config", "ComplianceScore", { stat = "Average" }]
          ]
          period = 86400
          stat   = "Average"
          region = "us-east-1"
          title  = "Overall Tagging Compliance"
          yAxis = {
            left = {
              min = 0
              max = 100
            }
          }
        }
      },
      {
        type = "log"
        properties = {
          query = <<-EOT
            SOURCE '/aws/config/compliance'
            | fields @timestamp, resourceType, compliance
            | filter compliance = "NON_COMPLIANT"
            | stats count() by resourceType
          EOT
          region = "us-east-1"
          title  = "Non-Compliant Resources by Type"
        }
      }
    ]
  })
}

import boto3
from datetime import datetime, timedelta
 
def quarterly_tag_audit():
    """Quarterly audit to identify orphaned and mis-tagged resources"""
    results = {
        'orphaned_resources': [],
        'invalid_tag_values': [],
        'estimated_savings': 0
    }
 
    # Get all resources
    client = boto3.client('resourcegroupstaggingapi')
    resources = client.get_resources()['ResourceTagMappingList']
 
    cloudwatch = boto3.client('cloudwatch')
    ce = boto3.client('ce')
 
    for resource in resources:
        arn = resource['ResourceARN']
        tags = {tag['Key']: tag['Value'] for tag in resource.get('Tags', [])}
 
        # Check for invalid Environment values
        if 'Environment' in tags:
            if tags['Environment'] not in ['prod', 'staging', 'dev', 'sandbox']:
                results['invalid_tag_values'].append({
                    'arn': arn,
                    'tag': 'Environment',
                    'value': tags['Environment'],
                    'expected': 'prod, staging, dev, sandbox'
                })
 
        # Check for orphaned resources (no activity in 90 days)
        if is_orphaned(arn, cloudwatch):
            cost = estimate_resource_cost(arn, ce)
            results['orphaned_resources'].append({
                'arn': arn,
                'tags': tags,
                'monthly_cost': cost
            })
            results['estimated_savings'] += cost
 
    # Generate report
    print(f"=== QUARTERLY TAG AUDIT ===")
    print(f"Orphaned Resources: {len(results['orphaned_resources'])}")
    print(f"Estimated Savings: ${results['estimated_savings']:,.2f}/month")
    print(f"Invalid Tag Values: {len(results['invalid_tag_values'])}")
 
    return results
 
def is_orphaned(arn, cloudwatch):
    """Check if resource has had no activity in 90 days"""
    # Implementation varies by resource type
    # For EC2: Check CPUUtilization metric
    # For RDS: Check DatabaseConnections
    # For S3: Check NumberOfObjects
    return False  # Simplified
 
def estimate_resource_cost(arn, ce_client):
    """Estimate monthly cost of a resource"""
    # Use Cost Explorer to get resource-specific costs
    return 0.0  # Simplified

aws resourcegroupstaggingapi get-resources \
  --tag-filters Key=Environment,Values=prod Key=Compliance,Values=SOC2

resource "aws_autoscaling_group" "app" {
  name                = "app-asg"
  max_size            = 10
  min_size            = 2
  desired_capacity    = 4
 
  launch_template {
    id      = aws_launch_template.app.id
    version = "$Latest"
  }
 
  # Propagate tags from ASG to instances
  tag {
    key                 = "Environment"
    value               = "prod"
    propagate_at_launch = true
  }
 
  tag {
    key                 = "Owner"
    value               = "team-platform@company.com"
    propagate_at_launch = true
  }
 
  tag {
    key                 = "Application"
    value               = "web-app"
    propagate_at_launch = true
  }
 
  tag {
    key                 = "CostCenter"
    value               = "ENG-001"
    propagate_at_launch = true
  }
}

# modules/app-stack/main.tf
variable "app_name" {}
variable "environment" {}
variable "owner" {}
variable "cost_center" {}
 
locals {
  common_tags = {
    Environment = var.environment
    Owner       = var.owner
    Application = var.app_name
    CostCenter  = var.cost_center
    ManagedBy   = "Terraform"
    Module      = "app-stack"
  }
}
 
resource "aws_instance" "web" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t3.medium"
 
  tags = merge(
    local.common_tags,
    {
      Name = "${var.app_name}-web-${var.environment}"
      Tier = "web"
    }
  )
}
 
resource "aws_db_instance" "db" {
  allocated_storage = 100
  engine            = "postgres"
  instance_class    = "db.t3.medium"
 
  tags = merge(
    local.common_tags,
    {
      Name = "${var.app_name}-db-${var.environment}"
      Tier = "database"
    }
  )
}
 
resource "aws_s3_bucket" "assets" {
  bucket = "${var.app_name}-assets-${var.environment}"
 
  tags = merge(
    local.common_tags,
    {
      Name = "${var.app_name}-assets"
      Tier = "storage"
    }
  )
}

module "payment_api" {
  source = "../../modules/app-stack"
 
  app_name    = "payment-api"
  environment = "prod"
  owner       = "team-payments@company.com"
  cost_center = "ENG-002"
}

{
  "tags": {
    "Environment": {
      "tag_key": {
        "@@assign": "Environment",
        "@@operators_allowed_for_child_policies": ["@@none"]
      },
      "tag_value": {
        "@@assign": ["prod", "staging", "dev", "sandbox"]
      },
      "enforced_for": {
        "@@assign": [
          "ec2:instance",
          "rds:db",
          "s3:bucket",
          "lambda:function"
        ]
      }
    },
    "Owner": {
      "tag_key": {
        "@@assign": "Owner"
      },
      "tag_value": {
        "@@assign": ["*@company.com"]
      },
      "enforced_for": {
        "@@assign": ["ec2:*", "rds:*", "s3:*", "lambda:*"]
      }
    },
    "CostCenter": {
      "tag_key": {
        "@@assign": "CostCenter"
      },
      "tag_value": {
        "@@assign": ["ENG-*", "MKT-*", "SAL-*", "FIN-*"]
      },
      "enforced_for": {
        "@@assign": ["ec2:*", "rds:*"]
      }
    }
  }
}

aws organizations create-policy \
  --content file://tag-policy.json \
  --name "Mandatory-Tagging-Policy" \
  --type TAG_POLICY \
  --description "Enforce mandatory tags across all accounts"
 
aws organizations attach-policy \
  --policy-id p-xxxxxxxxxx \
  --target-id r-xxxx  # Root OU

resource "aws_ce_anomaly_monitor" "by_application" {
  name              = "Application-Cost-Monitor"
  monitor_type      = "DIMENSIONAL"
  monitor_dimension = "SERVICE"
}
 
resource "aws_ce_anomaly_subscription" "app_alerts" {
  name      = "app-cost-alerts"
  frequency = "DAILY"
 
  monitor_arn_list = [
    aws_ce_anomaly_monitor.by_application.arn
  ]
 
  subscriber {
    type    = "SNS"
    address = aws_sns_topic.cost_alerts.arn
  }
 
  threshold_expression {
    dimension {
      key           = "ANOMALY_TOTAL_IMPACT_ABSOLUTE"
      values        = ["100"]  # Alert if anomaly >$100
      match_options = ["GREATER_THAN_OR_EQUAL"]
    }
  }
}