What is TagOps?

When was the last time you wrote an automation in AWS and said to yourself "I wish I had a way to differentiate the instances from one another easily"?

Maybe you were configuring AWS Backup and it asked you for tags on which you would like to apply the Backup, and you thought "oh man, now I have to go and tag all my resources??"

How about security? You felt like the existing ways of restricting/giving access are just not granular enough. You have a single AWS Account and want to give specific teams access to specific resources - this is a challenge!

Or maybe you're having a hard time identifying who created what? And you wish there was some more data on the resources like who created them and when.

Yeah, all of these are valid challenges and you are not alone, we've been facing them too!

AWS itself has been promoting tagging as a way to solve these challenges, and they have been actively promoting it across their services.

Look at all of these blogs and features AWS has released around tagging:

• AWS Security Blog - Blog posts about implementing ABAC based on tags
• AWS Operations Blog - Blog posts about tagging strategies, cost, monitoring and more
• A whole blog post about how to implement tagging
• AWS Solution Guidance - Tagging on AWS
• Adding support of ABAC for new services

and there are many more, but you get the point.

However, we find that 1 of the core things that is missing is the ability to have a centralized way to manage tags across all your AWS Accounts.
Some might say that there is a way via SCP + Tag Policies, but we find that it is not as flexible as we need it to be, and that itself doesn't enforce the tags on the resources.
Resources can still be created without the tags, and if you want to enforce the tags, you need to create a new SCP for each tag that you want to enforce, new actions that you need to research and restrict, etc.

Tagging is so important that Amazon actually dedicated a whole whitepaper for creating your tagging strategy: AWS Tagging Strategy Whitepaper

From the whitepaper:

The tagging strategy cycle is a process that helps you create a tagging strategy for your AWS environment.
It has 4 steps:

1. Define your tagging strategy
2. Implement your tagging strategy
3. Monitor your tagging strategy
4. Optimize your tagging strategy

Some of you may say, but hey what if I'm using terraform + tag policies to manage my tagging strategy?
Well, yes, terraform is sure much more flexible, and easy to implement tagging with, but is your environment really 100% terraform?
From our experience, the answer is no.
There are still many resources that are not managed by terraform, and that are not tagged.


All of that is a headache, and that is where TagOps comes in.

What is TagOps?

With TagOps, you can create rules that dynamically tag resources in your AWS Accounts.

TagOps helps you implement your tagging strategy in every step of the tagging strategy cycle.
Define your tagging strategy - TagOps team collected some use cases which can help you define your tagging strategy
Implement your tagging strategy - With TagOps rules that dynamically tag resources based on the conditions you have configured
Monitor your tagging strategy - With TagOps inventory page, you can see all of your tagged resources and their tags
Optimize your tagging strategy - With TagOps rules that can be optimized based on the usage and compliance of the tags

Example Use Cases

Resource Creation Tracking: Suppose you want to know who created the resource and when. You can create a rule in TagOps that does just that!

AWS Backup Configuration: You want to easily deploy relevant backup tags across your resources, and make sure future resources are automatically tagged. You can create a rule with TagOps that does just that.

ABAC Implementation: Same goes for Attribute-Based Access Control (ABAC). You can create a comprehensive set of rules that automatically apply tags based on conditions like Resource Name, Type, Region, Account ID, and more.

Key Benefits of TagOps