AWS Amazon EC2 Tag

aws_ec2_tag (Terraform)

The Tag in Amazon EC2 can be configured in Terraform with the resource name aws_ec2_tag. The following sections describe 2 examples of how to use the resource and its parameters.

Example Usage from GitHub

rubenivanyan/epam_final_project

resource "aws_ec2_tag" "mytagS0" {
  resource_id = module.vpc.public_subnets[0]
  key         = "Name"
  value       = "instances_samples"
}
resource "aws_ec2_tag" "mytagS1" {

streamnative/terraform-aws-cloud

resource "aws_ec2_tag" "vpc_tag" {
  resource_id = var.vpc_id
  key         = var.cluster_name
  value       = "shared"
}

Parameters

• id optional computed - string
• key required - string
• resource_id required - string
• value required - string

Explanation in Terraform Registry

Manages an individual EC2 resource tag. This resource should only be used in cases where EC2 resources are created outside Terraform (e.g., AMIs), being shared via Resource Access Manager (RAM), or implicitly created by other means (e.g., Transit Gateway VPN Attachments).

NOTE: This tagging resource should not be combined with the Terraform resource for managing the parent resource. For example, using aws_vpc and aws_ec2_tag to manage tags of the same VPC will cause a perpetual difference where the aws_vpc resource will try to remove the tag being added by the aws_ec2_tag resource. NOTE: This tagging resource does not use the provider ignore_tags configuration.

Tips: Best Practices for The Other AWS Amazon EC2 Resources

In addition to the aws_default_vpc, AWS Amazon EC2 has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

aws_default_vpc

Ensure to avoid using default VPC

It is better to define the own VPC and use it.

aws_network_acl_rule

Ensure your network ACL rule blocks unwanted inbound traffic

It is better to block unwanted inbound traffic.

aws_ebs_volume

Ensure to use a customer-managed key for EBS volume encryption

It is better to use a customer-managed key for EBS volume encryption. It can be gain more control over the encryption by using customer-managed keys (CMK).

aws_instance

Ensure to avoid storing AWS access keys in user data

It is better to avoid storing AWS access keys in user data. `aws_iam_instance_profile` could be used instead.

aws_security_group

Ensure your security group blocks unwanted inbound traffic

It is better to block unwanted inbound traffic.