Tagging and the asset register

Open Tags and costs in Strays

This is the Tags and costs page. Tags say who owns a resource, what it is for and who pays for it. Without them, nobody knows whether a forgotten volume or bucket is safe to delete. Every scan, Strays lists the resources in each connected AWS account with their tags, checks them against your tag policy, and suggests who should own the ones that have no owner tag.

The tag policy

Admins set it in Settings, under Tag policy. Until you do, Strays suggests four tags: Owner, Environment, CostCentre and Project.

• Required tags: one per line, up to 20. A resource follows the policy when every one is present with a value. Tag keys are case sensitive in AWS, so owner doesn't count as Owner; the report tells you when that's the problem.
• Allowed values (optional): one line per key, like Environment: prod, staging, dev. A tag with any other value is flagged as wrong.

The policy applies to the next scan; the report page uses it straight away.

The tagging report

• Compliance as a percentage: overall, by account, by service and by owner, and how it has moved scan by scan.
• Resources to tag: what is missing or wrong, and the suggested Owner. That's the owner tag if the resource has one, or else who created it according to CloudTrail (the last 90 days) when Strays already found that for a finding.
• Ready-to-run fixes: for each resource an AWS CLI command and a Terraform tags block, each with a copy button. REPLACE_ME marks a value Strays can't know. Strays never changes anything in AWS: you run the command, or add the tags in Terraform.

What is listed

EC2 instances, volumes, snapshots, images and Elastic IPs; RDS databases; S3 buckets; Lambda functions; load balancers; EKS clusters; customer-managed KMS keys; Secrets Manager secrets; ECR repositories; CloudWatch log groups; IAM users, roles and customer-managed policies; and AWS Backup vaults and plans. Resources AWS manages for you (AWS-managed keys, service-linked roles) can't be tagged and are left out. Strays reads each service directly rather than through the Resource Groups Tagging API, which doesn't list resources that never had a tag.

The inventory needs a few more read-only permissions than the first version of the setup template. If a service shows as "not everything could be read", update your stack from the latest template.

The asset register

Every resource with its account, region, owner and tags, as a CSV (Suggested owner and Suggested owner found from, then one Tag: ... column for each required tag, so there are never two columns called Owner) for a spreadsheet or a printable document you can save as PDF. ISO 27001 and SOC 2 both ask for an inventory of assets with owners; this is it, dated, from your latest scan.

Cost by tag, the other half of Tags and costs, is explained in its own topic.

The tagging report and asset register are on the Team plan and above, and during the trial. Everyone in your organisation can read them; only admins change the tag policy.