Terraform Naming & Tagging Standards

Status: Adopted Last Updated: March 2026 Owner: IT / Security
Applies To: All Azure and AWS infrastructure managed via Terraform

---

1. Why This Matters

Consistent naming and tagging enables:

• Cost allocation and chargeback visibility
• Compliance audit evidence (resource ownership, data classification)
• Operational clarity — knowing what something is without opening Terraform
• Automated policy enforcement via Azure Policy and AWS Config

---

2. Naming Conventions

2.1 General Pattern

{resource-type}-{environment}-{workload/purpose}-{region-shortcode}-{optional-index}

All lowercase. Hyphens as separators. No underscores (Azure resource names vary — use hyphens where allowed).

2.2 Environment Codes

Code	Meaning
prod	Production (Azure primary tenant — ciriusgroup.com)
dde	DDE / Customer-facing (Azure DDE tenant — ciriusdde.com)
dev	Development / Test
mgmt	Management
dr	Disaster Recovery (AWS)
shared	Shared services (identity, firewall, etc.)

2.3 Region Shortcodes

Azure Region	Code	AWS Region	Code
US West 2	usw2	us-west-2	usw2
US Central	usc	us-east-1	use1

2.4 Resource Type Prefixes

Resource	Prefix	Example
Virtual Network	vnet	vnet-prod-hub-usw2
Subnet	snet	snet-prod-firewall-usw2
Network Security Group	nsg	nsg-prod-app-usw2
Virtual Machine	vm	vm-prod-app-usw2-01
Storage Account	st	stprodtfstateusw2 (no hyphens — Azure limit)
Key Vault	kv	kv-prod-secrets-usw2
Resource Group	rg	rg-prod-network-usw2
Public IP	pip	pip-prod-firewall-usw2
Route Table	rt	rt-prod-spoke-usw2
Network Interface	nic	nic-prod-app-usw2-01
Log Analytics Workspace	law	law-prod-security-usw2
Recovery Services Vault	rsv	rsv-prod-backup-usw2
AWS
VPC	vpc	vpc-dr-main-usw2
Subnet	snet	snet-dr-app-usw2
EC2 Instance	ec2	ec2-dr-app-usw2-01
S3 Bucket	s3	s3-dr-tfstate-usw2
IAM Role	role	role-dr-github-actions

Storage Account exception: Azure storage account names cannot contain hyphens and are limited to 24 characters. Use concatenated lowercase: st{env}{purpose}{region}.

---

3. Required Tags

Every resource must have all required tags. Optional tags should be applied where relevant.

3.1 Required Tags

Tag Key	Description	Allowed Values / Format
environment	Deployment environment	production, development, management, dr, shared
owner	Team or individual responsible	e.g. it-security, platform
managed-by	How the resource is managed	terraform (all IaC resources)
data-classification	Sensitivity of data handled	phi, confidential, internal, public
cost-center	Cost allocation	e.g. it, operations — align with finance
compliance-scope	Compliance frameworks in scope	hipaa, soc2, hitrust, hipaa-soc2-hitrust

3.2 Optional Tags (Apply Where Relevant)

Tag Key	Description	Example
workload	Specific application or service	palo-alto, domain-services, scrapy
dr-pair	Paired DR resource identifier	azure-prod-01
backup-policy	Backup schedule applied	daily-30day, weekly-90day
patch-group	Patch management group	group-a, group-b
created-date	Resource creation date (ISO 8601)	2026-02-01

3.3 Terraform Default Tags Pattern

Apply required tags via a locals block and merge at the resource level:

locals {
  required_tags = {
    environment       = var.environment
    owner             = "it-security"
    managed-by        = "terraform"
    data-classification = var.data_classification
    cost-center       = "it"
    compliance-scope  = "hipaa-soc2-hitrust"
  }
}

# Merge at resource level — allows resource-specific tag overrides
resource "azurerm_resource_group" "example" {
  name     = "rg-prod-network-usw2"
  location = "westus2"

  tags = merge(local.required_tags, {
    workload = "networking"
  })
}

---

4. Terraform Variable Standards

4.1 Variable Naming

Pattern	Use
snake_case	All variable names
Descriptive, not abbreviated	virtual_network_name not vnet_nm
Boolean vars prefixed with enable_ or is_	enable_diagnostics, is_public

4.2 Required Variables (All Modules)

variable "environment" {
  description = "Deployment environment (production, development, management, dr, shared)"
  type        = string
  validation {
    condition     = contains(["production", "development", "management", "dr", "shared"], var.environment)
    error_message = "Environment must be one of: production, development, management, dr, shared."
  }
}

variable "location" {
  description = "Azure region for resource deployment"
  type        = string
}

variable "data_classification" {
  description = "Data classification for resources (phi, confidential, internal, public)"
  type        = string
  default     = "internal"
  validation {
    condition     = contains(["phi", "confidential", "internal", "public"], var.data_classification)
    error_message = "Data classification must be one of: phi, confidential, internal, public."
  }
}

---

5. What the Audit Will Check

When we run the Terraform audit against these standards, we're looking for:

• Resources missing required tags
• Resources with tags using non-standard keys (e.g. Env instead of environment)
• Resource names that don't match the naming pattern
• Resources using hardcoded values that should be variables
• Inconsistent environment/region codes across repos

---

Document History

Date	Author	Change
Apr 2026	Kobe	Added dde environment code for Azure DDE tenant (ciriusdde.com)
Mar 2026	Rory	Updated status to Adopted after code audit of 301+ files
Feb 2026	Rory	Initial draft