Recommended AWS Resource Tagging Strategy

This document provides a comprehensive tagging framework for AWS EC2 and other AWS resources, including S3, RDS,
Lambda, and networking components. Tagging improves visibility, cost allocation, governance, and automation across environments.

Core Identification Tags

Cost Allocation & FinOps Tags

Security & Compliance Tags

Operations & Automation Tags

Cloud Migration & Governance Tags

Networking & Infrastructure Tags

Example Tagging Policy (JSON)

You can enforce tagging consistency via AWS Organizations Tag Policies or AWS Config rules. Example baseline policy:

{
  "tags": {
    "Environment": { "tag_key": "Environment", "tag_value": ["dev", "test", "prod"] },
    "Owner": { "tag_key": "Owner", "tag_value": ".*@company.com" },
    "CostCenter": { "tag_key": "CostCenter", "tag_value": "^[A-Z]{2}[0-9]{4}$" }
  }
}

The post AWS Resource Tag Recommendations appeared first on AWS Security Architect.

AWS Patterns for Storing Audit Artifacts

Proven Storage Pattern (Backbone)

• Central S3 “evidence” bucket in a dedicated Audit/Log Archive account:
  • Enable Versioning, S3 Object Lock (Compliance mode), SSE-KMS (customer-managed key), and Block Public Access.
  • Route writes via VPC Gateway Endpoints (no internet); enable Server Access Logging or S3 Access Logs.
  • Set Lifecycle rules to transition to Glacier / Glacier Deep Archive for long-term retention.
• Integrity: Turn on CloudTrail log file integrity validation; consider Glacier Vault Lock and AWS Backup Vault Lock for immutability.
• Access control: Tight bucket policies, SCPs, least-privilege IAM, and KMS key policies scoped to the audit team.

How to Generate & Ingest the Artifacts

Make It Audit-Friendly (Controls & Integrity)

Automate Evidence Collection & Mapping

• AWS Audit Manager: Build assessments mapped to CIS/ISO/NIST/PCI; ingests evidence from CloudTrail, Config, Security Hub; attach manual artifacts; export assessment reports to S3.
• EventBridge rules + Lambda: Nightly/weekly exports (Security Hub, Backup reports, IAM credential report) into dated S3 prefixes, e.g.:
  s3://evidence/org=acme/svc=securityhub/yr=2025/mo=10/dy=21/…

Reference Target Architecture (Quick Steps)

1. Create Log Archive/Audit account; centralized S3 evidence bucket with versioning + Object Lock.
2. Enable org-level CloudTrail to that bucket; turn on integrity validation.
3. Turn on AWS Config (all regions/accounts) with delivery to the bucket.
4. Aggregate security signals with Security Hub (org level) and export findings to S3.
5. Standardize CloudWatch Logs → S3 exports for app/OS/EKS audit logs.
6. Enable AWS Backup + Backup Audit Manager; enforce Vault Lock.
7. Stand up Audit Manager assessments mapped to frameworks; schedule evidence exports.
8. Add Glue + Athena for queries; apply Lake Formation permissions.
9. Apply SCPs that prevent disabling CloudTrail/Config; deny S3 deletes that bypass Object Lock.
10. Document owners, retention, retrieval SOP; run quarterly restore/query drills.

Copy-Paste Checklist

• S3 evidence bucket (versioning, Object Lock, KMS, lifecycle)
• Org CloudTrail (+ data events where in scope) & integrity validation
• AWS Config (all regions/accounts) + conformance packs
• Security Hub/GuardDuty/Inspector/Macie enabled & exported
• CloudWatch Logs export jobs defined (EC2/EKS/Lambda)
• AWS Backup + Vault Lock + Audit Manager reports to S3
• Audit Manager assessments for your frameworks
• Glue/Athena schemas over S3 prefixes
• SCPs + bucket policies + VPC endpoints + access reviews
• Quarterly evidence retrieval drill

The post AWS Audit Artifacts appeared first on AWS Security Architect.