Terraform for FinOps: Tagging Standards That Actually Get Enforced

Tagging standards fail 90% of the time because they are not enforced at the Terraform layer. Here is the pattern that actually sticks across hundreds of resources and dozens of contributors.

The 4-Layer Enforcement Pattern

The Tag Module

variable "service" { type = string }
variable "team"    { type = string }
variable "env"     { type = string }
variable "cost_center" { type = string }

locals {
  required_tags = {
    Service     = var.service
    Team        = var.team
    Env         = var.env
    CostCenter  = var.cost_center
    ManagedBy   = "terraform"
    Provisioner = "ohveda-tags-v3"
  }
}

output "tags" { value = local.required_tags }

The OPA Policy

package terraform.tags

required := {"Service", "Team", "Env", "CostCenter"}

deny[msg] {
  resource := input.resource_changes[_]
  not resource.change.after.tags
  msg := sprintf("%s missing tags entirely", [resource.address])
}

deny[msg] {
  resource := input.resource_changes[_]
  tags := resource.change.after.tags
  missing := required - {k | tags[k]}
  count(missing) > 0
  msg := sprintf("%s missing required tags: %v", [resource.address, missing])
}