amazon-web-servicesterraformterraform-provider-aws

Constant tag values in Terraform


We would like to use a tag to identify the team who has authored the HCL code we are using to deploy AWS resources.

We wish to use this tag value so we can have Wiz provide a snapshot of the resources running on the estate at a particular time.

Is it possible to declare a tag in terraform HCL so that its value is constant?


Solution

  • I am only going to guess you would like the tags to be consistent across different deployments of AWS resources. In that case, I would suggest using default_tags. They will be propagated to all resources. If there are however more specific ones, the result will be a merge of all the tags, unless there's overlap, in which case the non-default ones take precedence. Example:

    provider "aws" {
      default_tags {
        tags = {
          Author = "John Doe"
          # other tags go here
        }
      }
    }
    
    resource "aws_vpc" "example" {
      # ..other configuration...
    }
    
    output "vpc_resource_level_tags" {
      value = aws_vpc.example.tags
    }
    
    output "vpc_all_tags" {
      value = aws_vpc.example.tags_all
    }
    

    I would say the usual default tag when using terraform is CreatedBy = "terraform". If you need to really get down to the bottom of who really created a resource, I would argue tags are not really a best place for that. Using CloudTrail would help understanding who actually ran apply. Ideally, the apply command shouldn't be run by a person, rather by CI/CD, but that's a bit off-topic here.