> ## Content Index
> Fetch the complete content index at: https://devopscube.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# AWS Tag Policy Configuration Using Terraform
- URL: https://devopscube.com/aws-tag-policy-terraform/
- Published: 2023-08-28T15:29:21.000Z
- Updated: 2025-03-12T16:32:35.000Z
- Author: Bibin Wilson
- Tags: AWS, #arunlal, TERRAFORM, #Migrated-1741795015845, #wp, #wp-post, #Import 2025-03-12 15:57, #blog

In this blog, you will learn to configure [AWS Tag Policies](https://devopscube.com/aws-tag-policy/) using Terraform. I have added step-by-step guides for the whole setup.

## Terraform Tag Policy Deployment Workflow

Here is the workflow explanation

1. Download the Terraform code from the GitHub repository into your system where you have installed Terraform and AWS CLI.
2. Run the specific script which contains `tag-policy` module by passing proper variables in the variable file.
3. Terraform will execute the `tag-policy` module to create a policy to enforce compliance for specific resources such as EC2 Instances, Security Groups, AWS Lambda, etc.
4. The newly created policy will be associated with the account that we have mentioned in the variables file.
5. The policy ID will be shown in the output as part of the Terraform configuration.
6. Terraform will automatically save the state file in the S3 bucket in your AWS account.

## **Terraform Tag Policy Code Repository**

The Tag Policy Terraform code is included in the [Terraform AWS](https://github.com/techiescamp/terraform-aws.git?ref=devopscube.com) repository. To follow the guide, clone the repository to your workstation.

```
git clone https://github.com/techiescamp/terraform-aws.git
```

Fork and clone the repository if you intend to reuse and make changes as per your requirements.

## **Terraform AWS Organization’s Tag Policy Provisioning Workflow**

The Terraform script for Tag Policy is structured in the following way.

```
├──infra
│   ├── tag-policy
│   │   ├── main.tf
|   |   ├── outputs.tf
│   │   └── variables.tf
├──modules
│   ├── tag-policy
│   │   ├── main.tf
│   │   ├── outputs.tf
│   │   └── variables.tf
└──vars
    └── dev
        └── tag-policy.tfvars

```

**`vars`** folder contains the variables file named `tag-policy.tfvars`

**infra**/**tag-policy** folder contains the terraform code (`main.tf`) that calls the Tag Policy module from the modules directory.

The modules directory contains the following resources:

**`tag-policy` Module**: The `tag-policy` module contains an AWS Organizations policy creation block with JSON code to create tags with specified tag keys, tag values, and enforcement for values.

The policy attachment block is used to attach the created policy to a related account using the account ID.

## Implementing Tag Policy Using Terraform

Follow the steps provided in this section to implement a tag policy in an AWS account.

Assuming the "**terraform-aws**" folder as the root directory for this guide.

### **Step 1:** Adjust the variables for the tag-policy module.

Open the `vars/dev/tag-policy.tfvars` file and edit the variables based on your requirements. Primarily, you may want to change `target_id` and `enforce_for_values`.

Additionally, you can change `tag_value` and `region` if you want.

```
# Tag Policy Vars
region      = "eu-north-1"
policy_name = "Techiescamp"
policy_type = "TAG_POLICY"
target_id   = "814200988517"

name_tag_key         = "Name"
environment_tag_key  = "Environment"
owner_tag_key        = "Owner"
owner_tag_value      = ["techiescamp"]
costcenter_tag_key   = "CostCenter"
costcenter_tag_value = ["techiescamp-commerce"]
application_tag_key  = "Application"
enforce_for_values   = ["dynamodb:*", "ec2:dhcp-options", "ec2:elastic-ip", "ec2:fpga-image", "ec2:instance",
                        "ec2:internet-gateway", "ec2:launch-template", "ec2:natgateway", "ec2:network-acl",
                        "ec2:network-interface", "ec2:route-table", "ec2:security-group", "ec2:snapshot",
                        "ec2:subnet", "ec2:volume", "ec2:vpc", "ec2:vpc-endpoint", "ec2:vpc-endpoint-service",
                        "ec2:vpc-peering-connection", "ec2:vpn-connection", "ec2:vpn-gateway", "elasticfilesystem:*",
                        "elasticloadbalancing:*", "iam:instance-profile", "iam:mfa", "iam:policy", "kms:*",
                        "lambda:*", "rds:cluster-pg", "rds:cluster-endpoint", "rds:es", "rds:og", "rds:pg", "rds:db-proxy",
                        "rds:db-proxy-endpoint", "rds:ri", "rds:secgrp", "rds:subgrp", "rds:target-group", "resource-groups:*",
                        "route53:hostedzone", "s3:bucket", "s3:bucket"]                

```

### **Step 2:** Initialize Terraform Configuration:

Once the modifications are completed, save the code.

Open the parent directory.

```
cd infra/tag-policy
```

Inside the "**tag-policy**" folder, you will find the "**main.tf**" file, which contains the configurations of the `tag-policy` module.

```
provider "aws" {
  region = var.region
}

module "tag-policy" {
  source      = "../../modules/tag-policy"
  region      = var.region
  policy_name = var.policy_name
  policy_type = var.policy_type
  target_id   = var.target_id

  name_tag_key         = var.name_tag_key
  environment_tag_key  = var.environment_tag_key
  owner_tag_key        = var.owner_tag_key
  owner_tag_value      = var.owner_tag_value
  costcenter_tag_key   = var.costcenter_tag_key
  costcenter_tag_value = var.costcenter_tag_value
  application_tag_key  = var.application_tag_key
  enforce_for_values   = var.enforce_for_values
}
```

### **Step 3**: Verify Terraform Plan

Assuming you are in the `infra/tag-policy` directory, and to preview the changes, use the Terraform plan command.

```
terraform plan -var-file=../../vars/dev/tag-polcy.tfvars
```

### **Step** 4: Apply Terraform Changes

Apply the Terraform configuration to create the AWS resources by using the following command.

```
terraform apply -var-file=../../vars/dev/tag-policy.tfvars
```

Confirm the action by typing "yes" when prompted.

Terraform will now implement the tag policy based on your customized configuration.

### **Step 5:** Validate the Output

After applying the Terraform configuration, use the Terraform output command to retrieve essential details

The `output.tf` file is configured to show the Policy ID as the output.

Verify the output to ensure that the tag policy has been successfully implemented in your AWS account.

### **Step** 6: Clean Up Setup

If you plan to remove the tag policy across your AWS account, you can destroy the configuration using the Terraform destroy command.

```
terraform destroy -var-file=../../vars/dev/tag-policy.tfvars
```

Confirm the action by typing "yes" when prompted. Terraform will remove all the resources created in the previous steps.

## Conclusion

Using a Tag Policy will improve the organization's tagging strategy and prevent users from creating resources with non-compliant tags.

With **AWS Resource Groups & Tag Editor**, resources and their related tags can be effectively managed. This service allows for filtering AWS Resources based on tags, making resource management more efficient and organized.

You can also check out the [AWS autoscaling terraform](https://devopscube.com/terraform-autoscaling-group/) guide to deploy autoscaling groups and [AWS load balancers](https://devopscube.com/aws-load-balancers/) using Terraform.