Tag Governance

Tag governance is the foundation of Guardian Pro's governance capabilities. It evaluates every discovered resource against your tag policies, surfaces violations, and provides tools to fix them -- individually, in bulk, or automatically.

Accessing Tag Governance

Navigate to Governance from the left sidebar, then expand the Tag Compliance section. You need governance:read permission to view compliance data and governance:write to fix violations or run scans.

Tag Policies

Tag policies define your tagging standards. Each policy contains rules that specify which tags are required, what values are allowed, and which resource types the rules apply to.

Creating a Tag Policy

1. Expand the Tag Policies section on the Governance page.
2. Click Create Policy.
3. Enter a policy name and optional description.
4. Add rules:
   • Tag key -- The tag key to enforce (e.g., Environment, CostCenter).
   • Required -- Whether the tag must be present on applicable resources.
   • Allowed values -- Optional list of permitted values (e.g., production, staging, development).
   • Enforced for -- Optional list of resource types the rule applies to. If omitted, the rule applies to all resource types.
5. Assign targets -- select which OUs, accounts, or your entire organisation root the policy applies to.
6. Click Save.

Managing Policies

From the Tag Policies section you can:

• Edit a policy -- Modify rules, name, or description.
• Delete a policy -- Remove the policy and its rules. Existing violations from this policy will be resolved on the next assessment.
• Manage targets -- Attach or detach OUs and accounts from a policy.

tip

Start with a small set of foundational tags (e.g., Environment, Owner, CostCenter) and expand over time. The AI Tag Strategy can recommend tags tailored to your infrastructure.

Tag Compliance Dashboard

The compliance dashboard provides a real-time view of how well your resources adhere to your tag policies.

Score Cards

Four metric tiles at the top of the section:

Metric	Description
Compliance Score	Percentage of resources that pass all applicable tag policy rules. Colour-coded: green (good), yellow (needs attention), red (critical).
Total Resources	Number of resources evaluated against your tag policies.
Compliant Resources	Resources that pass all applicable rules.
Non-Compliant Resources	Resources with one or more tag violations.

Compliance Trend

An area chart showing your compliance score over time. Use the date range filter to focus on specific periods. The trend helps you track whether your compliance posture is improving or degrading.

Account Compliance Heat Map

For multi-account setups, a visual grid shows each account coloured by its compliance score. This helps you quickly identify which accounts need the most attention.

Breakdown Tables

Two side-by-side views of your compliance data:

• By Service -- Shows total, compliant, and violation counts per AWS service.
• By Policy -- Shows total, compliant, and violation counts per tag policy.

Cost Impact

When cost data is available, Guardian Pro calculates the estimated monthly spend represented by non-compliant resources. This helps you quantify the financial impact of unattributable resources and prioritise remediation.

Violations

Viewing Violations

The violations table lists all resources with tag policy violations. Each row shows:

Column	Description
Resource	Resource name and ID
Type	AWS resource type
Service	AWS service
Region	AWS region
Violation	Type of violation with a count badge if multiple
Tag Key	The tag key involved
Severity	Critical, High, Medium, or Low
Status	Open, Resolved, Suppressed, or Auto-Remediated

Violation Types

Type	Description
Missing	A required tag is not present on the resource
Invalid Value	The tag exists but its value is not in the allowed values list
Case Mismatch	The tag key exists but uses incorrect capitalisation

Filtering Violations

Combine filters to focus on specific violations:

• Search -- Filter by resource ID or ARN.
• Status -- Show only Open, Resolved, Suppressed, or all.
• Service -- Filter by AWS service.
• Severity -- Filter by severity level.
• Sort -- Order by severity, service, or violation type.

Investigating a Violation

Click any resource in the violations table to open the detail drawer. The drawer shows:

• Full resource details (ID, ARN, type, region).
• Each violation with its type, tag key, actual value (if any), and allowed values.
• Individual Fix and Suppress actions per violation.

For resources with multiple violations, click the row to expand an inline summary showing each violation before opening the full drawer.

Remediation

Fixing Violations

You can fix tag violations individually or in bulk.

Individual fix: Open the violation detail drawer and click Fix next to a specific violation. Guardian Pro applies the tag directly to the resource.

Bulk fix:

1. Select multiple violations using the checkboxes.
2. Click Fix Tags (N).
3. A dialog shows all unique tag keys from your selection with suggested values:
   • Missing tags are pre-populated with the default value from your policy.
   • Case mismatches are pre-populated with the corrected key name.
   • Invalid values show a dropdown of allowed values if multiple options exist, or auto-populate if only one value is allowed.
4. Review and adjust values as needed.
5. Click Apply to fix all selected violations.

caution

Tag remediation modifies your AWS resources directly. Guardian Pro applies tags using your connected IAM role. Ensure your role has the necessary tagging permissions for the affected resource types.

Auto-Remediation

When enabled, Guardian Pro automatically fixes tag violations where a default value is available -- for example, adding a missing tag with its configured default value. Auto-remediated violations are marked with an Auto-Remediated status.

To enable auto-remediation:

1. Navigate to Governance.
2. Toggle the Auto-Remediation setting.

info

Auto-remediation only applies fixes where the correct value can be determined automatically (e.g., a missing tag with a single default value). Violations requiring human judgement (e.g., choosing from multiple allowed values) are left as open violations for manual review.

Suppressing Violations

If a violation is expected or intentional (e.g., a temporary resource that does not need full tagging), you can suppress it:

1. Select one or more violations.
2. Click Suppress (N).
3. Enter a reason for suppression.
4. Click Confirm.

Suppressed violations remain in your history but are excluded from your compliance score. You can reopen suppressed violations at any time.

Prevention Guidance

Below the violations table, Guardian Pro shows actionable recommendations to prevent future violations. These may include:

• Creating tag policies to enforce standards.
• Deploying SCPs to block untagged resource creation.
• Adopting tagging best practices.

Items already enforced by your existing policies are automatically excluded.

Running a Compliance Scan

Click Run Scan in the Tag Compliance section header to trigger an on-demand compliance evaluation. The scan evaluates all discovered resources against your current tag policies and updates the compliance dashboard.

note

Compliance is also evaluated automatically as part of the daily governance assessment.

Exporting Compliance Data

Click Download PDF in the Tag Compliance section to generate a PDF report of your current compliance posture, including scores, breakdowns, and violation details.

For bulk data export, use the Export button in the page header to download violations as CSV or the full governance dataset as JSON.

Next Steps

• AI Tag Strategy -- Generate AI-recommended tags tailored to your infrastructure.
• SCP Management -- Enforce tagging at the AWS level with service control policies.
• Maturity Assessment -- See how tag governance contributes to your overall governance score.