Traceability and Use of Tags in IaC Projects

🌟 Objective

Ensure that all changes, resources and environments defined via Infrastructure as Code (IaC) are traceable, auditable and identifiable, through tagging conventions, metadata and control of versioned changes.

Traceability is a pillar of organisational security: it makes it possible to understand "who changed what, when, with what justification, and with what impact".

---

🔖 What must be done

1. Apply mandatory tags to all resources created via IaC, including environment, owner, criticality and origin;
2. Maintain formal naming conventions for resources, files, environments and releases;
3. Record all changes in a version control system, with readable commit messages linked to tickets;
4. Include metadata in the code that makes it possible to map changes to the affected resource and context;
5. Document the relationships between files, modules and impacted environments;
6. Include application, team and purpose identification in IaC manifests, outputs or logs.

---

⚖️ How it must be done

Element	Recommended practice
Tags on resources	Environment, Owner, Application, Criticality, ManagedBy
Informative comments	Indicate the task ID, context and objective of the change
Commit messages	Pattern: [IaC] Alterar recurso X em ambiente Y (issue-123)
Metadata in the manifests	locals with application, team, version and date
Release tracking	Git tags: iac-prod-v2025.07.10, versioned artefacts with hash and timestamp
Execution output	Logs with author, date, PR, executed plan, target environment

---

🗓️ When to apply

Moment	Expected action
Creation of a new resource	Apply mandatory tags
Significant change	Record the justification, environment and associated ticket
Execution of plan/apply	Keep the output with hash, date and author identity
Audit or security review	Verify metadata, naming, tagging and traceability per version

---

💼 Practical examples

🌍 Tags in Terraform

resource "aws_s3_bucket" "logs" {
  bucket = "app-logs-prod"

  tags = {
    Environment = "prod"
    Owner       = "devops-team"
    Criticality = "high"
    Application = "web-api"
    ManagedBy   = "Terraform"
  }
}

🔍 Local metadata

locals {
  app_name    = "billing-service"
  maintainer  = "infra-team@org"
  version     = "v1.3.2"
  last_update = "2025-07-10"
}

💪 Commit message with traceability

[IaC] Corrigir timeout no ALB do ambiente staging (ISSUE-8723)

---

✅ Direct benefits

• Enables auditing and incident investigation in an objective way;
• Increases visibility of the impact and authorship of changes;
• Supports rollback or approval decisions based on documented context;
• Reduces the risk of inconsistencies and facilitates quality control.

---

🔗 Aligned with requirements IAC-002, IAC-005, IAC-008, REQ-004, REQ-006, SSDF (CM.5), SAMM (AA2.1), CIS Controls (8.3, 4.6).