Configurable Required Tags

The default required tags are: environment, team, service, cost-center. If the project defines custom required tags (in a tags.tf, locals block, or tagging policy file), use those instead and note which tag policy was detected.

Severity Levels

•Critical: production resource missing environment, team, or cost-center tag -- cannot be attributed for billing.
•High: production resource with inconsistent tag values (typos, mixed casing like Prod vs prod).
•Medium: non-production (dev/staging) resource missing required tags.
•Low: tag value exists but does not follow naming convention (abbreviations, non-standard formats).

What to Check

•Presence of all required tags on every taggable resource.
•Tag value consistency: no typos, no mixed casing, no abbreviation variants (production vs prod vs Prod).
•Resources with no tags at all (highest priority).
•Module-level tag propagation: check if modules use default_tags, tags = merge(...), or provider-level default_tags blocks. Resources inside modules may inherit tags from the module call -- verify propagation rather than flagging false positives.
•Tag propagation for auto-created resources: ASG-launched instances, ECS tasks, Lambda functions.

Output Format

Severity	Resource	Missing Tags	File:Line
Critical	aws_instance.api_prod	cost-center	infra/main.tf:42

End with:

•Compliance rate: X of Y resources fully tagged (Z%).
•Tag value inconsistencies: list any detected value variants (e.g., prod, Prod, production).

Edge Cases

•Tags at module level: if a module passes tags via default_tags or a tags variable, check whether child resources inherit them before flagging.
•Custom tag requirements: if the project has a tag policy document, use it; otherwise fall back to defaults and note the assumption.
•No taggable resources found: report that no cloud resources were detected; suggest verifying the scan path.