Low
IAM
IAM roles should be tagged
Description
Flags IAM roles that have no user-defined tags. Tags help associate roles with their owning team and cost-attribution lineage; untagged roles are operationally opaque. Service-linked roles, Identity Center reserved roles, and AWS console-wizard service roles are excluded — they are AWS-managed or auto-created, so the team-ownership intent does not apply.
Remediation
Apply at least one user-defined tag to every IAM role.
Steps
- Open the AWS IAM console.
- Navigate to Roles and select the affected role.
- Open the Tags tab and choose Manage tags.
- Add at least one tag with a non-aws: prefixed key.
- Save the changes.