Select your cookie preferences

We use essential cookies and similar tools that are necessary to provide our site and services. We use performance cookies to collect anonymous statistics, so we can understand how customers use our site and make improvements. Essential cookies cannot be deactivated, but you can choose “Customize” or “Decline” to decline performance cookies.

If you agree, AWS and approved third parties will also use cookies to provide useful site features, remember your preferences, and display relevant content, including relevant advertising. To accept or decline all non-essential cookies, choose “Accept” or “Decline.” To make more detailed choices, choose “Customize.”

Preferences
Contact Us
Feedback
AWS Documentation
Create an AWS Account

AWS Resource Tagging Standard

PDF
RSS
Focus mode
AWS Resource Tagging Standard - AWS Security Hub
What is the AWS Resource Tagging Standard?Controls in the AWS Resource Tagging Standard

This section provides information about the AWS Resource Tagging Standard.

Note

The AWS Resource Tagging Standard isn't available in the Canada West (Calgary), China, and AWS GovCloud (US) Regions.

What is the AWS Resource Tagging Standard?

Tags are key and value pairs that act as metadata for organizing your AWS resources. With most AWS resources, you have the option of adding tags when you create the resource or after creation. Examples of resources include an Amazon CloudFront distribution, an Amazon Elastic Compute Cloud (Amazon EC2) instance, or a secret in AWS Secrets Manager. Tags can help you manage, identify, organize, search for, and filter resources.

Each tag has two parts:

  • A tag key—for example, CostCenter, Environment, or Project. Tag keys are case sensitive.

  • A tag value—for example, 111122223333 or Production. Like tag keys, tag values are case sensitive.

You can use tags to categorize resources by purpose, owner, environment, or other criteria.

For information about adding tags to AWS resources, see the Tagging AWS Resources and Tag Editor User Guide.

The AWS Resource Tagging Standard, developed by AWS Security Hub, helps you determine whether any of your AWS resources are missing tag keys. You can customize the requiredTagKeys parameter to specify tag keys that you want the controls to check for. If specific tags aren't provided, the controls only check for the existence of at least one tag key.

When you enable the AWS Resource Tagging Standard, you'll begin receiving findings in the AWS Security Finding Format (ASFF).

Note

When you enable the AWS Resource Tagging Standard, Security Hub may take up to 18 hours to generate findings for controls that use the same AWS Config service-linked rule as enabled controls in other enabled standards. For more information, see Schedule for running security checks.

This standard has the following Amazon Resource Name (ARN): arn:aws:securityhub:region::standards/aws-resource-tagging-standard/v/1.0.0.

You can also use the GetEnabledStandards operation of the Security Hub API to find the ARN of an enabled standard.

Controls in the AWS Resource Tagging Standard

The AWS Resource Tagging Standard includes the following controls. Choose a control to review a detailed description of it.

On this page

PrivacySite termsCookie preferences
© 2025, Amazon Web Services, Inc. or its affiliates. All rights reserved.