Tagging standard and PR-time enforcement across IaC stacks (#114)

[ms280690]

Closes #114. Stacked on #151 (issue-77-k8s-policy) for the conftest bundle; retarget to main once that merges.

What

• Standard: policies/tags/standard.yml (single source: owner, project, environment, data-class with the patterns and enums from the issue; label_pattern for Kubernetes where @ is not a legal label character) and docs/tagging-standard.md.
• Terraform, tflint: policies/tags/tflint/{aws,azurerm}.tflint.hcl enable aws_resource_missing_tags / azurerm_resource_missing_tags with the four keys. The tflint composite gains require-tags (default true) and tags-provider: a second pass tflint --config <bundled> --only <provider>_resource_missing_tags --minimum-failure-severity=notice, so the consuming repo's .tflint.hcl is untouched. AWS provider default_tags satisfy the rule. lint-iac.yml exposes both inputs. No Google label rule exists in that ruleset; documented.
• Terraform, checkov: policies/tags/checkov/spk_tag_{1,2}.yaml: provider.aws must declare default_tags.tags.<key> and provider.google default_labels.<key> for the four keys (--external-checks-dir policies/tags/checkov). Wiring a require-tags input into iac-scan.yml is a one-line follow-up once feat(#6): IaC misconfiguration scan reusable workflow — checkov #141 merges.
• Kubernetes, conftest: tags.rego added to the k8s-policy bundle: required labels, enum and pattern checks on every workload kind and Namespace. Dormant unless the standard is loaded as data (two -d files cannot both set a key, so off means not loaded). The composite loads it when require-tags (default true); k8s-policy.yml exposes the input. The feat: IaC/K8s — org policy gate on rendered manifests with conftest (PR/CI) #77 chart and kustomize fixtures gain the labels so their dogfood stays green; tests/k8s-policy/run.sh is unaffected (no data, policy dormant).
• CDK: docs/examples/cdk/required_tags_aspect.py and required-tags-aspect.ts: READONLY-priority aspect that reads the resolved TagManager values and adds an error annotation per missing key or out-of-enum value; tokens skipped. dr-check-cdk.yml wiring follows feat: DR readiness — cdk-nag resilience rules for AWS CDK (PR/CI) #94.
• CI: Tagging job installs tflint, conftest, checkov (same checksum-verified downloads as the composites) and aws-cdk-lib, runs tests/tagging/run.sh, then dogfoods the tflint and k8s-policy composites on tagged (must pass) and untagged (must fail) fixtures. The root tflint smoke job sets require-tags: "false" because the fixtures include a deliberately untagged stack.
• README rows for both composites and workflows plus a "Tagging standard" section.

Tests

tests/tagging/run.sh: tflint aws and azurerm pass/fail, checkov SPK_TAG_1/SPK_TAG_2 pass/fail (and SPK_TAG_2 ignoring AWS), conftest exact deny set on the untagged manifests (missing labels, bad enum, bad patterns), tagged manifests clean, policy dormant without data, and the CDK aspect (tagged stack clean, untagged stack exactly three errors) when aws-cdk-lib is importable. Verified locally with tflint 0.63.1, conftest 0.71.1, checkov 3.3.27 and aws-cdk-lib 2.273.0.

Deferred

• iac-scan.yml require-tags input (after feat(#6): IaC misconfiguration scan reusable workflow — checkov #141), dr-check-cdk.yml require-tags input (after feat: DR readiness — cdk-nag resilience rules for AWS CDK (PR/CI) #94), enum cross-check with the classification doc once docs: PII — data classification policy template and recognizer mapping #100 lands.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NPH9145e4gFo6bmXvMgBoF