Infrastucture Tagging Standard

Purpose

This standard defines the mandatory metadata that must be applied to cloud resources across the Ministry of Justice.

Tags enable:

Cost allocation and showback reporting
Financial accountability
Sustainable technology and GreenOps reporting
Resource ownership and operational support
Security and compliance management
Platform governance and policy enforcement
Application and service inventory management

All cloud resources should be tagged consistently to ensure they can be accurately attributed, managed, reported on and optimised.

Tagging your infrastructure

All of our existing cloud hosting providers support tagging (AWS, Azure. If your infrastructure is defined in code (as it should be), you can probably specify your tags in that code.

AWS limits the names and values of tags to alphanumeric, space, and a limited set of punctuation (+-=._:/), so it's worth avoiding characters outside this set on all providers for maximum portability.

Tags you should use

To ensure we can consistently search for, and report on, the tags we use, you should use the following tags. In all values, only use acronyms if you're confident that someone from another part of government would understand them.

Mandatory

business-unit: Should be one of HMPPS, OPG, LAA, Central Digital, Technology Services, HMCTS, CICA, OCTO, YJB, or HQ. If none of these are appropriate, please contact us via #cloud-optimisation-and-accountability-team Slack channel or submit a pull-request against the policy managed in code.
service-area : Should be the full name of the Service Area in which your team is based e.g. Education Skills & Work, Manage a Workforce, Hosting. If unsure please speak to your Service Owner, Product Manager, Delivery Manager, or the person accountable for spend within your area. This tag is used to group costs to the appropriate area and identify the person responsible for approving and managing those costs.
application: Should be the full name of the application or service (and acronym version, if commonly used), e.g. Prison Visits Booking, Claim for Crown Court Defence/CCCD.
is-production: true or false, to indicate if the infrastructure is part of, or supports, live production services
owner: Should be of the form <team-name>: <team-email>. This is the team responsible for the overall service.

Optional

environment-name: The name the owners use to refer to the environment; typically something like production, staging, test, or development.
component: Which part of the application this infrastructure is for, e.g. Staff booking interface, API gateway. If there's a common name for the type of component, use that (e.g. front-end, api, message-queue)
infrastructure-support: The team responsible for managing the infrastructure. Should be of the form <team-name>: <team-email>.
runbook: The URL of the service's runbook.
source-code: The URL(s) for any source code repositories related to this infrastructure, comma separated.

Platform specific guidance for applying mandatory tags

Cloud Platform - Updating Mandatory Tags for AWS provider in Cloud Platform namespace resources
Modernisation Platform - How to Add Default Tags

Platform specific tagging configuration examples

Examples for illistrative purposes. Replace with your values.

Cloud Platform

Tag values found in the variables.tf file in the resources directory:

variable "vpc_name" {
  description = "VPC name to create security groups in for the ElastiCache and RDS modules"
  type        = string
}

variable "kubernetes_cluster" {
  description = "Kubernetes cluster name for references to secrets for service accounts"
  type        = string
}

variable "application" {
  description = "Name of the application you are deploying"
  type        = string
  default     = "COAT Cost API"
}

variable "namespace" {
  description = "Name of the namespace these resources are part of"
  type        = string
  default     = "coat-cost-api-prod"
}

variable "service_area" {
  description = "Service area responsible for this service"
  type        = string
  default     = "Hosting"
}

variable "business_unit" {
  description = "Area of the MOJ responsible for this service"
  type        = string
  default     = "OCTO"
}

variable "team_name" {
  description = "Name of the development team responsible for this service"
  type        = string
  default     = "cloud-optimisation-and-accountability"
}

variable "environment" {
  description = "Name of the environment type for this service"
  type        = string
  default     = "production"
}

variable "infrastructure_support" {
  description = "Email address of the team responsible this service"
  type        = string
  default     = "cloudoptimisationandaccountabilityteam@justice.gov.uk"
}

variable "is_production" {
  description = "Whether this environment type is production or not"
  type        = string
  default     = "true"
}

variable "slack_channel" {
  description = "Slack channel name for your team, if we need to contact you about this service"
  type        = string
  default     = "cloud-optimisation-and-accountability-team"
}

variable "github_owner" {
  description = "The GitHub organization or individual user account containing the app's code repo. Used by the Github Terraform provider. See: https://user-guide.cloud-platform.service.justice.gov.uk/documentation/getting-started/ecr-setup.html#accessing-the-credentials"
  type        = string
  default     = "ministryofjustice"
}

variable "github_token" {
  type        = string
  description = "Required by the GitHub Terraform provider"
  default     = ""
}

Modernisation Platform

Tag values found in the relevant json file in your directory in the Modernisation Platform environments repository:

{
  "account-type": "member",
  "environments": [
    {
      "name": "development",
      "access": [
        {
          "sso_group_name": "cloud-optimisation-and-accountability",
          "level": "developer"
        }
      ],
      "nuke": "rebuild"
    },
    {
      "name": "production",
      "access": [
        {
          "sso_group_name": "cloud-optimisation-and-accountability",
          "level": "developer"
        },
        {
          "sso_group_name": "modernisation-platform-audit",
          "level": "security-audit"
        }
      ]
    }
  ],
  "tags": {
    "application": "coat",
    "business-unit": "Platforms",
    "infrastructure-support": "CloudOptimisationandAccountabilityTeam@justice.gov.uk",
    "owner": "CloudOptimisationandAccountabilityTeam@justice.gov.uk",
    "critical-national-infrastructure": false,
    "service-area": "Hosting"
  },
  "github-oidc-team-repositories": [],
  "go-live-date": ""
}

Last reviewed: 9 November 2026Review status: ✓ Up to dateOwner: #coat-notificationsSource: View source on GitHub

Was this page useful?