Tagging and Resource Management
Relevant source files
The following files were used as context for generating this wiki page:
Tagging and resource management provides a unified framework for identifying, categorizing, and controlling cloud resources across multiple providers. This system enables administrators to enforce governance, track costs, and automate lifecycle actions through a standardized vocabulary of filters and actions.
The framework supports basic operations like adding and removing tags, alongside advanced features such as dynamic tag value resolution, tag-based delayed actions (e.g., "stop in 4 days"), and tag normalization to maintain consistency across large-scale environments.
Core Tagging Actions
The project implements several core actions to manipulate resource tags. These actions are often specialized for specific cloud services but share a common logic for interpolation and batching.
Tag and RemoveTag
The Tag action adds metadata to resources, while RemoveTag deletes specific keys. The system handles batching and retries to account for API limits and resource deletion races.
Sources: c7n/tags.py:488-600, c7n/resources/airflow.py:59-100
TagTrim
TagTrim automatically removes tags from resources to free up space when a service-defined limit is reached. For example, EC2 resources have a limit of 50 tags. TagTrim allows users to specify a list of "preserve" tags that must not be deleted while reclaiming a target amount of "space".
Sources: c7n/tags.py:341-411
Universal Tagging
For resources that support the AWS Resource Groups Tagging API, the system uses UniversalTag and UniversalUntag. These classes provide a consistent interface for managing tags on a wide variety of resources without requiring service-specific implementation details for every resource type.
Sources: c7n/tags.py:804-862
Tag Value Resolution
Tag values are not restricted to static strings. The TagValueResolver mixin enables resources to look up values dynamically from resource attributes using JMESPath.
The interpolation process automatically replaces placeholders such as {account_id}, {now}, and {region} in tag values.
Sources: c7n/tags.py:127-195
Delayed Resource Operations
Delayed operations allow the system to mark a resource for a future action, providing a grace period for compliance remediation.
The mark-for-op Action
The mark-for-op action applies a specialized tag (defaulting to maid_status) that contains a target operation and a timestamp (e.g., stop@2023/12/25).
Sources: c7n/tags.py:698-757, c7n/resources/ecs.py:734-754
The marked-for-op Filter
The marked-for-op filter parses the status tag on a resource. It succeeds only if the current time is greater than or equal to the timestamp specified in the tag, optionally adjusted by a skew or skew_hours parameter.
Sources: c7n/tags.py:414-485
Sources: c7n/tags.py:456-485
Specialized Tagging Logic
Different cloud resources require unique handling due to API variations or structural differences.
Tag Normalization
The NormalizeTag action transforms existing tag values. Supported actions include:
lower: Converts value to lowercase.upper: Converts value to uppercase.title: Capitalizes the first letter.strip: Removes specified characters.
Sources: c7n/tags.py:760-802
Related Resource Tagging
CopyRelatedResourceTag enables propagating tags from a parent or related resource to the current resource. For example, tags from an EBS Volume can be copied to its Snapshots.
Sources: c7n/tags.py:910-1004
ECS Tagging Constraints
Tagging ECS resources (Tasks, Services, Container Instances) requires the resource to have a specific ARN format. The ECSTaggable filter identifies resources that support tagging based on their identifier structure.
Sources: c7n/resources/ecs.py:27-36, c7n/resources/ecs.py:757-781
Configuration and Metadata
Resource management involves specific configuration schemas and metadata structures.
| Component | Description | Default Key |
|---|---|---|
| Status Tag | The default tag used to track future operations. | maid_status |
| Interpolation | Placeholders available for tag values. | {account_id}, {now}, {region} |
| Tag Limit | The maximum number of tags allowed (EC2-specific). | 50 |
| Batch Size | Default number of resources tagged in a single API call. | 25 (Varies by service) |
| Sources: c7n/tags.py:47, c7n/tags.py:136-140, c7n/tags.py:372 |
Summary of Resource Management Features
Tagging and Resource Management enables policy-driven lifecycle management. By standardizing how tags are applied, validated, and used as triggers for future actions, the project ensures that cloud environments remain compliant and cost-effective. Key capabilities include:
- Consistency: Normalizing tag values and enforcing required keys.
- Automation: Marking resources for delayed deletion or stopping.
- Efficiency: Using universal APIs where available and batching calls to avoid throttling.
- Flexibility: Resolving tag values dynamically based on resource attributes.
Sources: c7n/tags.py, c7n/resources/fsx.py:161-190