Add default tags to AWS resources created by devops-security Terraform

[ale210]

Overview

We need devops-security's Terraform to stamp a managed-by tag on every resource it creates, the same way incubator already does, so that a coverage report can tell a resource this repo manages apart from one that nothing manages. Today this repo declares no AWS provider at all, so nothing it creates carries a provenance tag.

Action Items

Context, verified 2026-08-27 against account 035866691871:

• There is no provider "aws" block anywhere under terraform/. backend.tf holds only the terraform {} block with the S3 backend, so default_tags is not set and currently cannot be.

• Live proof of the gap: aws iam list-role-tags --role-name gha-incubator returns no tags at all, while incubator-created roles such as incubator-cicd-vrms return managed-by.

• The only tags this repo sets are the per-user user_tags (Project, Access Level) in aws-users.tf, passed through modules/aws-users/main.tf:7. Those describe the person, not who manages the resource, and are not a substitute.

• In terraform/backend.tf, add a provider "aws" block containing a default_tags block that sets managed-by = "terraform-devops-security". Do not include profile or region keys — those come from the ambient environment at run time. Mirror the block in hackforla/incubator's terraform/backend.tf.

• Use the value terraform-devops-security, deliberately distinct from incubator's terraform-incubator. The point of the tag is attribution: account 035866691871 is written to by two separate Terraform states, and a report has to be able to say which one owns a resource.

• Leave the existing user_tags alone. default_tags merges with resource-level tags rather than replacing them, so tagged users keep Project and Access Level and gain managed-by.

• Run terraform plan and read it. Expect tag-only in-place updates and nothing else. If the plan proposes any create, destroy or replace, stop and report it on this issue rather than applying — this change adds metadata and must not move any IAM resource.

• Record, do not try to fix: IAM groups cannot be tagged. AWS exposes no tagging API for them — there is no iam tag-group or iam list-group-tags — so the three live groups (ops-leads, project-leads, read-only-group) will stay untagged no matter what is written here. Say so in the PR, so whoever writes the coverage report knows the group axis needs a different mechanism.

• After the PR merges and the apply runs, verify against live AWS that aws iam list-role-tags --role-name gha-incubator returns managed-by=terraform-devops-security. It returns nothing today, so this is a real before/after check — and it cannot be done from the branch, because no tag exists anywhere until the apply runs.

Resources/Instructions

• Precedent: Add default tags to AWS resources incubator#121 (closed), which did exactly this for the incubator repo and gave the reason as "in order to run reporting on what resources are managed by the current version of incubator and what are not". This issue is the devops-security half of that; the reporting itself is Write a script that reports which incubator AWS resources are managed by Terraform and which are not devops#199.
• Configure default tags for AWS resources
• The block to copy is at terraform/backend.tf lines 24-31 in hackforla/incubator. Line numbers were accurate 2026-08-27 and may drift — find it by the default_tags keyword.
• AWS account 035866691871. IAM is global, so its tags are readable from any region.
• Worth watching in the plan: terraform/imports.tf brings several resources into state via import blocks rather than by creating them. default_tags applies to them on the next apply just the same.