Terraform · Infrastructure as code

How do you design a consistent tagging strategy?

Easytaggingcost allocationgovernanceUpdated Oct 2026
Quiz this track

Short answer

Define a small required tag set such as project, environment, owner and cost centre, and apply it consistently with provider default_tags. Let resources override only when they need a specific value.

Tags drive cost allocation, ownership, automation and incident response. A useful strategy names a small mandatory set, defines allowed values, and applies it automatically so engineers do not have to remember every key on every resource.

hcl
locals {
  common_tags = {
    project     = "vocalhire"
    environment = var.environment
    owner       = "platform"
    managed_by  = "terraform"
  }
}

provider "aws" {
  region = "us-east-1"

  default_tags {
    tags = local.common_tags
  }
}
default_tags applies the common set to every taggable resource in the provider. Resource-level tags override duplicate keys.

A workable minimum

  • project or service: what the resource belongs to
  • environment: dev, staging or prod
  • owner: a team, not an individual who may leave
  • cost_centre: the finance code used for allocation

Enforce the required tags with policy as code so a plan fails before an untagged resource is created. Keep the tag vocabulary stable; renaming a key breaks cost reports and automation that query it. Watch for services that do not support default_tags or that have tag length limits.

Tags are not a security boundary. Do not rely on a tag alone for access control when the provider supports real IAM conditions on resource attributes.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

  1. 1Why use provider default_tags instead of repeating tags?
  2. 2How do you enforce required tags?
  3. 3What happens when a resource sets a tag that also exists in default_tags?
  4. 4Which tag would you use for ownership?

Say it in the interview

I define a small mandatory tag set for project, environment, owner and cost centre, then apply it through provider default_tags so it is consistent by default. Resources can override a key when they genuinely need to. I enforce the set with policy checks in CI, and I keep the key names stable because cost reports depend on them. Tags help governance, but I do not treat them as a security boundary.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Related questions

Reading is step one

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Terraform mock interview and get scored feedback on depth, clarity and confidence.