Skip to content

Commit b40868f

Browse files
ashwinimanojashwinimanoj
authored
Merge pull request #52 from infraspecdev/blog/aws-tags-strat
Blog:Essential AWS Tagging Strategies for Better Cloud Control
2 parents 4c520bd + e1c6797 commit b40868f

File tree

2 files changed

+231
-0
lines changed

2 files changed

+231
-0
lines changed

‎content/blog/tag-strat-blog.md

Lines changed: 231 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,231 @@
1+
---
2+
title: "Essential AWS Tagging Strategies for Better Cloud Control"
3+
authorId: "rohit"
4+
date: 2024-07-29
5+
draft: false
6+
featured: true
7+
weight: 1
8+
---
9+
10+
## Introduction
11+
12+
Managing cloud resources efficiently in AWS requires a robust tagging strategy. Tags are key-value pairs attached to resources, providing crucial metadata for resource management, cost allocation, security, and automation. This blog will guide you through defining mandatory and discretionary tags and establishing detection and enforcement mechanisms to ensure compliance across your AWS environment.
13+
14+
## The Problem: Untracked Resources and Rising Costs
15+
16+
At Infraspec, we started noticing some major issues with how we were managing our AWS resources. We had several AWS accounts in use, but no tagging standards were enforced. This meant that anyone could create resources, and sometimes, these resources were left running long after they were needed.
17+
18+
As a result, our cloud costs were steadily increasing each month, and we had no clear way to track who was responsible for which resources. Without any tags, it was impossible to tie costs back to specific teams or projects, leaving us in the dark about where our budget was really going. This lack of accountability was causing both operational and financial headaches.
19+
20+
## Our Approach: Structuring AWS Accounts and Enforcing a Tagging Policy
21+
22+
Realizing that we needed a way to get things under control, we started exploring how AWS tags could help. By enforcing a tagging policy across all our AWS accounts, we could ensure that every resource was labeled with essential information like the owner, team, and environment.
23+
24+
But we didn’t stop there. To make sure everyone followed the rules, we implemented Service Control Policies (SCPs) that would block the creation of any resources that didn’t have the necessary tags. This added a layer of enforcement that gave us confidence that our tagging strategy would actually be used.
25+
26+
<p align="center">
27+
<img src="/images/blog/tag-strat-aws/aws-organization.png" alt="AWS Organization">
28+
</p>
29+
30+
### Step 1: Organizing Accounts
31+
32+
Our first step was to create an AWS Organizations structure that mirrored our operational needs. We separated our accounts into two main Organizational Units (OUs): `Infraspec OU` and `Core OU`. The `Infraspec OU` contains all the accounts related to our primary operations, including `Dev`, `Staging`, and `Prod`. The `Core OU` contains our `Core Account`, which handles shared services such as networking and also handles policy management instead of root account.
33+
34+
This structure allowed us to clearly distinguish between different environments and core services, making it easier to enforce policies and manage resources.
35+
36+
### Step 2: Implementing Tagging Policy
37+
38+
With our accounts organized, we moved on to enforce a tagging policy across all our AWS accounts. We established a set of mandatory tags that would be required for specific resource, ensuring that resources were labeled with essential information like the owner, management of the rescource etc.
39+
40+
To ensure compliance, we implemented Service Control Policies (SCPs) that blocked the creation of any resources without the necessary tags. This enforcement layer gave us the confidence that our tagging strategy would be consistently applied across all environments.
41+
42+
We defined the following tags as mandatory across our AWS environment and implemented them using AWS Organizations Tag Policies. Below is an example of how these tags were structured and enforced:
43+
44+
```json
45+
{
46+
"tags": {
47+
"Owner": {
48+
"tag_key": {
49+
"@@assign": "Owner"
50+
},
51+
"enforced_for": {
52+
"@@assign": [
53+
"ec2:instance",
54+
"ec2:vpc",
55+
"ec2:subnet",
56+
"ec2:natgateway",
57+
"ec2:security-group",
58+
"ec2:route-table",
59+
"ec2:internet-gateway"
60+
]
61+
}
62+
},
63+
"ManagedBy": {
64+
"tag_key": {
65+
"@@assign": "ManagedBy"
66+
},
67+
"tag_value": {
68+
"@@assign": [
69+
"Terraform",
70+
"Manual"
71+
]
72+
},
73+
"enforced_for": {
74+
"@@assign": [
75+
"ec2:instance",
76+
"ec2:vpc",
77+
"ec2:subnet",
78+
"ec2:natgateway",
79+
"ec2:security-group",
80+
"ec2:route-table",
81+
"ec2:internet-gateway"
82+
]
83+
}
84+
}
85+
}
86+
}
87+
```
88+
89+
### Step 2: Implementing Service Control Policy
90+
91+
We created SCPs in AWS Organizations to prevent the creation of resources without mandatory tags. For example, the following SCP blocks the creation of EC2 instances and other resources if the `Owner` and `ManagedBy` tag is missing:
92+
93+
```json
94+
{
95+
"Version": "2012-10-17",
96+
"Statement": [
97+
{
98+
"Sid": "DenyEC2CreationWithNoOwnerTag",
99+
"Effect": "Deny",
100+
"Action": [
101+
"ec2:RunInstances",
102+
"ec2:CreateVpc",
103+
"ec2:CreateSubnet",
104+
"ec2:CreateNatGateway",
105+
"ec2:CreateSecurityGroup",
106+
"ec2:CreateRouteTable",
107+
"ec2:CreateInternetGateway"
108+
],
109+
"Resource": [
110+
"arn:aws:ec2:*:*:vpc/*",
111+
"arn:aws:ec2:*:*:subnet/*",
112+
"arn:aws:ec2:*:*:natgateway/*",
113+
"arn:aws:ec2:*:*:security-group/*",
114+
"arn:aws:ec2:*:*:route-table/*",
115+
"arn:aws:ec2:*:*:internet-gateway/*",
116+
"arn:aws:ec2:*:*:instance/*"
117+
],
118+
"Condition": {
119+
"Null": {
120+
"aws:RequestTag/Owner": "true"
121+
}
122+
}
123+
},
124+
{
125+
"Sid": "DenyEC2CreationWithNoManagedByTag",
126+
"Effect": "Deny",
127+
"Action": [
128+
"ec2:RunInstances",
129+
"ec2:CreateVpc",
130+
"ec2:CreateSubnet",
131+
"ec2:CreateNatGateway",
132+
"ec2:CreateSecurityGroup",
133+
"ec2:CreateRouteTable",
134+
"ec2:CreateInternetGateway"
135+
],
136+
"Resource": [
137+
"arn:aws:ec2:*:*:vpc/*",
138+
"arn:aws:ec2:*:*:subnet/*",
139+
"arn:aws:ec2:*:*:natgateway/*",
140+
"arn:aws:ec2:*:*:security-group/*",
141+
"arn:aws:ec2:*:*:route-table/*",
142+
"arn:aws:ec2:*:*:internet-gateway/*",
143+
"arn:aws:ec2:*:*:instance/*"
144+
],
145+
"Condition": {
146+
"Null": {
147+
"aws:RequestTag/ManagedBy": "true"
148+
}
149+
}
150+
}
151+
]
152+
}
153+
```
154+
### Step 3: Attaching the Service Control Policy and Tag Policy
155+
156+
After defining the policies, the next crucial step is to attach them to the appropriate Organizational Units (OUs) within AWS Organizations. By attaching both the Service Control Policy (SCP) and Tag Policy to the `Infraspec OU`, you ensure that all accounts under this OU enforce the mandatory tagging policy.
157+
158+
#### Attaching the Service Control Policy (SCP) to an OU
159+
160+
- **Navigate to the SCP Policy Section:**
161+
- Sign in to the AWS Management Console and go to the AWS Organizations console at [https://console.aws.amazon.com/organizations](https://console.aws.amazon.com/organizations).
162+
163+
- **Attach the SCP:**
164+
- Go to the `Service control policies` tab and click `Create policy` to define your SCP.
165+
- After creating the policy, click on `Targets` to attach it to the desired OU.
166+
167+
#### Attaching the Tag Policy to an OU
168+
169+
- **Navigate to the Tag Policy Section:**
170+
- Sign in to the AWS Management Console and go to the AWS Organizations console at [https://console.aws.amazon.com/organizations](https://console.aws.amazon.com/organizations).
171+
172+
- **Attach the Tag Policy:**
173+
- Go to the `Tag policies` tab and click `Create policy` to define your Tag Policy.
174+
- After creating the policy, click on `Targets` to attach it to the desired OU.
175+
176+
## Handling Existing Resources Without Tags
177+
178+
Addressing the challenge of existing resources that were created before implementing the tagging policy was crucial. To bring these resources into compliance without causing any unexpected downtime, we followed a structured approach:
179+
180+
- **Tagging Existing Resources**:
181+
We utilized the AWS Tag Editor to identify all untagged resources. This tool enabled us to efficiently apply the necessary tags to multiple resources across various regions and accounts, ensuring consistency and compliance.
182+
183+
## Testing the Policy
184+
185+
After implementing the tagging and scp policies, we conducted rigorous testing to ensure compliance across our EC2 resources. We deployed several EC2 instances with and without the mandatory tags to verify the enforcement mechanisms.
186+
187+
- **Success Case**: When an EC2 instance was launched with all mandatory tags (`Owner`, `ManagedBy`), the instance creation proceeded without any issues.
188+
189+
- **Failure Case**: When an attempt was made to launch an EC2 instance without the `ManagedBy` tag, the operation was denied, demonstrating the effectiveness of our SCP in enforcing tag compliance.
190+
191+
## The Impact of Tags in Our Organization
192+
193+
### Resource Identification and Ownership
194+
195+
- **Owner Tag**: By tagging each resource with an `Owner`, we could quickly identify who was responsible for any given resource. This became critical when tracking down resources that were running unexpectedly or were no longer needed. The `Owner` tag provided clear accountability, making it easier to manage and decommission resources no longer in use.
196+
197+
### Operational Efficiency and Automation
198+
199+
- **ManagedBy Tag**: The `ManagedBy` tag helped us distinguish between resources managed by Terraform and those managed manually. This was particularly useful for automating resource management and ensuring that Terraform-managed resources were consistent with our infrastructure-as-code policies.
200+
201+
## Tag Naming and Usage Conventions
202+
203+
To ensure consistency and avoid conflicts, adhere to the following conventions:
204+
205+
1. **Tag Limits**: Each resource can have a maximum of 50 tags.
206+
2. **Unique Tags**: Each tag key must be unique per resource, and each tag key can have only one value.
207+
3. **Length Limits**: The maximum tag key length is 128 Unicode characters in UTF-8. The maximum tag value length is 256 Unicode characters in UTF-8.
208+
4. **Allowed Characters**: Allowed characters are letters, numbers, spaces representable in UTF-8, and the following characters: `. : + = @ _ / -` (hyphen). Amazon EC2 resources allow any characters.
209+
5. **Case Sensitivity**: Tag keys and values are case sensitive. Decide on a strategy for capitalizing tags and consistently implement that strategy across all resource types. For example, decide whether to use `Costcenter`, `costcenter`, or `CostCenter`, and use the same convention for all tags.
210+
6. **AWS Prefix**: The `aws:` prefix is prohibited for tags; it's reserved for AWS use. You can't edit or delete tag keys or values with this prefix. Tags with this prefix do not count against your tags per resource quota.
211+
212+
## Best Practices for Tagging
213+
214+
1. **Consistency**: Use a standardized format for tags to avoid discrepancies. Decide on conventions for capitalization and delimiters and stick to them.
215+
2. **Automation**: Automate tagging to reduce manual errors and ensure compliance.
216+
3. **Documentation**: Maintain comprehensive documentation of your tagging strategy and dictionary for reference.
217+
4. **Stakeholder Involvement**: Involve all relevant stakeholders in defining and reviewing the tagging strategy to ensure it meets organizational needs.
218+
219+
## Conclusion
220+
221+
A well-defined tagging strategy is essential for effective cloud resource management. By distinguishing between mandatory and discretionary tags and implementing robust enforcement mechanisms, you can achieve better visibility, cost control, and security in your AWS environment. Start by establishing a clear tagging dictionary and ensure compliance through automation and regular audits.
222+
223+
## Additional Resources
224+
225+
For further reading and deeper insights into AWS tagging strategies, consider the following resources:
226+
227+
- [**AWS Tagging Best Practices and Strategies**](https://docs.aws.amazon.com/tag-editor/latest/userguide/best-practices-and-strats.html) – Comprehensive guide on best practices and strategies for tagging in AWS.
228+
229+
- [**AWS Organizations Tag Policies**](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies.html) – Details on implementing and managing tag policies across accounts.
230+
231+
- [**AWS Service Control Policies**](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html) – Guide on using SCPs to enforce tagging standards.

‎static/images/blog/tag-strat-aws/aws-organization.png

11 KB
Loading

0 commit comments

Comments
 (0)