Propagating Tags from provider level down to all resources using Terraform Template
Inheriting Tags from Top-to-Bottom
Resource Tagging is one of the most important steps in knowing your assets in the public cloud. With proper tag, you know the resource purpose, ownership, environment, data classification, regulatory compliance requirement, cost center, and many other attributes. This allows you to know your risk based on the data sensitivity, define security controls to protect assets, and allow for cost-benefit analysis.
Identifying the public cloud resources and ownership is the first step in satisfying asset management.
Organizations are using Terraform to manage their Infrastructure as a code (IaaC). Meaning the whole cloud infrastructure can be defined in the Terraform template (i.e., ec2 instance, type, what image, EBSvolume, encryption, subnet, elastic IP address, etc, etc). Terraform plan command lets you see all the new additions, removal, and modification to the infrastructure before applying them. Terraform lets you define resources within config files such as variables, resources, and modules. Overall, it's the best-in-class tool that allows infrastructure to be built, modified, and to track changes with ease.
This is a known issue where the developer unintentionally forgets to define the tag and another developer copy-reuses the code for their purpose. This leads to a greater volume of resources to be stood up without a tag. We know we want to solve this problem at the root cause and in a simple manner. The questions we’ve all asked several times are — “Can we define the tags at the provider level?” and “Can this be propagated to other resources?”
Terraform AWS Provider is a plugin that is maintained internally by HashiCorp. With version 3.38.0, Terraform AWS Provider supports tagging at the provider level. Below is an example-
Finally, Terraform allows you to define the tag at the provider level — this is AWESOME!
- You need Terraform version 0.12 or later.
- You must have Terraform AWS Provider version 3.38.0 or later.
- Any tags defined at the provider level are inherited by dependent modules.
- Propagation of tag is available for all Terraform AWS Provider resources that currently support
- Tags at the resource level take priority/precedence over those defined at the provider level.
- The only exception to this rule is one resource — Auto Scaling Group.
- Don’t forget to define the tag separately for Auto Scaling Group.
In the below example, we have defined the common_tags as local and merged them later in the configuration of the Auto Scaling Group (ASG).
GitHub Page for Terraform AWS Provider: https://github.com/hashicorp/terraform-provider-aws