Assign Tags Before Account Suspension

Automatically tag AWS accounts with suspension metadata before migrating them to a suspended organizational unit (OU).

Overview

When AWS accounts are suspended or moved into a suspended OU, it becomes harder to trace ownership, cost center responsibility, and reactivation requirements. Tagging accounts with suspension context—such as reason codes, business owners, and reactivation contacts—before migration preserves accountability and aligns with AWS tagging best practices for organizational changes. TagOps can automatically apply these tags whenever an account is flagged for suspension, ensuring consistent metadata across your organization.

What TagOps Can Do

TagOps can automatically tag accounts slated for suspension so you maintain visibility and governance:

  • Automatic Suspension Tags: Apply tags such as Status: PendingSuspension, CostCenter: Suspended, Owner, and ReactivationContact as soon as an account is marked for suspension.
  • Reason & Timeline Metadata: Capture why the account is being suspended (SuspensionReason) and when the suspension took effect (SuspendedOn) to support audits and downstream workflows.
  • OU Migration Readiness: Ensure every account entering the suspended OU already carries required tags so reporting, budgeting, and cost allocation tools remain accurate.
  • Reactivation Workflow: Use tags to route suspended accounts to the correct teams if reactivation is requested (e.g., ReactivationRequired: Yes).
  • Consistent Governance: Enforce tagging policies across all accounts, preventing untagged or partially tagged accounts from being moved to the suspended OU.

Example TagOps Rule

Create a TagOps rule to automatically tag accounts pending suspension:

  • Condition: Account has tag Lifecycle=PendingSuspension or is added to an “accounts to suspend” list.
  • Action: Add tags:
    • Status: PendingSuspension
    • CostCenter: Suspended
    • SuspensionReason: <<value>>
    • Owner: ${accountOwner}
    • ReactivationContact: <<email>>
    • SuspendedOn: ${currentDate}

Once applied, these tags travel with the account into the suspended OU, ensuring cost management, compliance audits, and future reinstatement requests have the context they need.

Additional Resources