tag-nag

Validate AWS tags in Terraform and CloudFormation.

Installation

go install github.com/jakebark/tag-nag@latest

You may need to set GOPATH.

Commands

Tag-nag will search a file or directory for tag keys. Directory search is recursive.

tag-nag <file/directory> --tags "Key1,Key2"

tag-nag main.tf --tags "Owner" # run against a file
tag-nag ./my_project --tags "Owner,Environment" # run against a directory
tag-nag . --tags "Owner", "Environment" # will take string or list

Search for tag keys and tag values

tag-nag <file/directory> --tags "Key[Value]"

tag-nag main.tf --tags "Owner[Jake]" 
tag-nag main.tf --tags "Owner[Jake],Environment" # mixed search possible
tag-nag main.tf --tags "Owner[Jake],Environment[Dev,Prod]" # multiple options for tag values

Flags

-c --case-insensitive  
-d --dry-run # will always exit successfully
--cfn-spec ~/path/to/CloudFormationResourceSpecification.json # path to Cfn spec file, filters taggable resources
-s --skip "file.tf, path/to/directory" # skip files and directories
-o --output json # output to json (default is text)

Config file

The above commands can be issued with a .tag-nag.yml file in the same directory where tag-nag is run.

See the example .tag-nag.yml file.

Skip Checks

Skip file

#tag-nag ignore-all

Terraform

resource "aws_s3_bucket" "this" {
  #tag-nag ignore
  bucket   = "that"
}

CloudFormation

EC2Instance:  #tag-nag ignore
    Type: "AWS::EC2::Instance"
    Properties: 
      ImageId: ami-12a34b
      InstanceType: c1.xlarge   

Filtering taggable resources

Some AWS resources cannot be tagged.

To filter out these resources with Terraform, run tag-nag against an initialised directory (terraform init).

To filter out these resources with CloudFormation, specify a path to the CloudFormation JSON spec file with the --cfn-spec input.

Docker

Run

docker pull jakebark/tag-nag:latest
docker run --rm -v $(pwd):/workspace -w /workspace jakebark/tag-nag \
  . --tags "Owner,Environment" 

Interactive shell

docker pull jakebark/tag-nag:latest
docker run -it --rm \
  -v "$(pwd)":/workspace \
  -w /workspace \
  --entrypoint /bin/sh jakebark/tag-nag:latest

The image contains terraform, allowing terraform init to be run, if required.

docker pull jakebark/tag-nag:latest
docker run --rm -v $(pwd):/workspace -w /workspace \
  --entrypoint /bin/sh jakebark/tag-nag:latest \
  -c "terraform init -input=false -no-color && tag-nag\
     . --tags 'Owner,Environment'"

CI/CD

Example CI files:

• GitHub
• GitLab
• AWS CodeBuild

Related Resources

• pkg.go.dev/github.com/jakebark/tag-nag