I am currently building a solution on Azure (though the question should relate to AWS equally) and I am using a UniqueId tag to locate and use objects.

For instance, we have a storage account that is used for caching applications' blobs. The storage account is created with a random name but is found and presented to the application through its UniqueId=AppCache tag.

At the moment I am taking the approach that as more tags become useful I'll start to add them.

Ultimately we're looking for a hands off 'ChatOps' style solution. So everything created should be automated.

Should I be looking at a structured approach to tagging (and what does that look like) or is the organic approach more sensible?


1 Answer 1


I would set up a base taxonomy to start with, you can use automation across your estate to ensure that all resources follow the taxonomy. You have a choice between simply deleting resources that don't comply or reporting on it to a central team who are responsible for chasing down and educating the owners.

I have followed the Best Practice set out by Microsoft for both Azure and Amazon:

  • Owner - normally this is a team distribution list although sometimes it is an individual if it is a "10% time" project. To make sure that the e-mail address entered is valid we run a hourly scan of our estate to detect if there are new e-mail addresses in this field then send an e-mail with an activation link, failing to activate results in deletion after three days.
  • CostCenter - the numeric cost centre, we use this to feed into the end of month reconciliation.
  • SDLCPhase - one of Development, Test, SIT, UAT, PerfTest, PreProduction, Production. We use this to define different automated behavour:
    • Development and Test: deleted overnight and at weekends to save on costs. Teams are responsible for reprovisioning using the automation in the morning.
    • SIT, UAT and PerfTest: deleted when the cost center in our finance system is closed down.
    • PreProduction: scaled down overnight and when the cost center is closed down.
    • Production: we validate that all resources deployed to the production subscription have this tag, if they don't we send out e-mails extensively.
  • DropDeadDate - for us, this is a required field for everything except Production. We run a nightly scan and send e-mails to the owner 7 days and 1 day before the DropDeadDate then delete the resource after it has passed.

In terms of the automation around this I have a tendency to use Janitor Monkey and some custom bots written is Azure Functions that sit in Slack Channels and do my bidding.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.