Proposal: azurerm_resource_missing_tags check tag for a valid value

[kleytonn]

Nowadays azurerm_resource_missing_tags rule only check for tags present in resources but don't allow any verification on tag value like:

• tag value is not blank;
• tag value is a valid value of a list;

[wata727]

I agree that such a rule could be useful to some extent, but I'm wondering whether such an option should be added to the azurerm_resource_missing_tags rule.

What about using the OPA ruleset to enforce these organization-specific policies? It is difficult for OPA to determine whether a resource can be tagged, but if all resources are tagged, I think it should be relatively easy to inspect what the tags are.

[kleytonn]

Hi @wata727,

I'm using OPA to check resource tags and validate that. I didn't know about OPA rulset, it seems very useful. I will try it.

Thanks