AWS Naming & Tagging Conventions

AWS Tagging policy and naming convention for all resources created within any AWS accounts under the AWS Master Account

Table of Contents

Terms and Abbreviations

Bibliography

Executive Summary

AWS Terms and Abbreviations

Tagging Overview

Tagging Best Practices

Resource Groups

Compound Tags

Style Rules

Tagging Region Codes

Enterprise Tagging Standards

Environment Names

Name Tag Format

AMI Versioning

Additional Tags

Operational Tags

Business Tags

Security Tags

AWS Resource Suffixes 11

Name Tag Examples 12

Terms and Abbreviations

The following table lists the Terms and Abbreviations that are referenced within the document.

Bibliography

The table below contains information about, and (where possible) links to, supporting documentation.

AWS Terms and Abbreviations

The following terms and abbreviations will be used through this design and implementation of all Enterprise applications.

N.B. In the above table the forward slash character (“/”) is part of the Value and is not being used as a delimiter.

Tagging Overview

AWS provide the ability to tag resources with descriptive metadata. Tags simplify resource management at scale and will be used for cost allocation. As the Enterprise plans to implement multiple applications, multiple application environments and multiple AWS accounts; tagging must be applied consistently to allow costs to be separated out into applications, environments and business units.

Each tag consists of a key and a value, both of which are user-defined strings. Once defined, tags can be used as a filter when requesting resources, such as Amazon EC2 instances, based on tag keys or values. Tags are also reported against in Cost Allocation Reports.

Tags provide identification and classification of AWS resources. Examples of commonly used tags include application identifier, environment, or owner.

Resource Groups

Use resource groups. A Resource Group is a collection of resources that shares one or more tags. It can span services and can be used to create a custom console that organizes and consolidates resources on a per-project basis. In AWS, a resource is an entity such as an EC2 instance, a S3 bucket and so on. Using the resource group tool, custom consoles can be created that organize and consolidate all resources for a specific project in a single view. For example, all the resources for a version of TEAM_A in production can be in one resource group whilst those resources used for TEAM_B be can be in another resource group (though the Enterprise's cloud operating model dictates that applications must exist in different accounts).

Compound Tags

There is a limit of 50 tags per resource in AWS, as such it is a good practice to combine several tag keys and values into a single compound tag. For example, rather than creating 3 keys (tags) called “OwnerName”, “OwnerPhone”, and “OwnerEmail,” the 3 keys should be combined into 1 key called “OwnerContact,” which could contain the compound values of Name, Phone, and Email address using a pipe delimiter.

We will assign the Name Tag as a compound value. We will use the hyphen as a delimiter. An example of the values assigned to the Name Tag are shown in examples section at the end of this document.

Style Rules

• Tag key names are case-sensitive and can contain mixed-case letters, numbers, underscores, and hyphens.

• Tag key names should use upper CamelCase (a.k.a. Pascal case), a convention that combines words/abbreviations by beginning each word with a capital letter such as “MiscMetadata” and “SupportEndpoints”.

• Tag values are case-sensitive and should not use the semi-colon (“;”), equal sign (“=”), or pipe (“|”) characters as these are used as delimiters in compound values.

• Compound tag value key names should use Pascal case followed by an equal sign (“=”) such as KeyName1=value1-value2-value3;KeyName2=value1-value2-value3

Tagging Region Codes

AWS’ regions codes are unique; therefore, they will be abbreviated as follows:

AMI Versioning

AMI’s will have names that uniquely identify their use, operating system, OS version, creation date (reversed), creation version and AWS resource type prefix ‘AMI’. A “golden image” RedHat Linux 7.1 AMI name would be as follows:

Business Tags

These can be used to capture business relevant information and which part of the business is responsible for this resource. Can greatly speed up the elimination process in an event of failure or attack.

Security Tags

To obtain a full visibility over account surface data we use these security classification tags in conjunction with the Additional Tags to map which classification of data is where. AWS Config Rules can also be set where PCI data can only sit in Network=Red.