Report Missing AWS Tags

Not sure this is the correct Category, but going to give it a try.

I am attempting to locate AWS Resources that DO NOT have a required set of Tags applied at the Resource level. I have found a question posed by @KokFen.Chia asking a similar question but no responses as yet.

I can run a basic NRQL query to find all that I would like IF the Tag DOES in fact exist, but I would like a report or dashboard showing me if a Tag is completely missing, or is somehow incorrect. An implicit missing state is fine, say if a Tag exists but the spelling or capitalization is off, then I would like to know about it.

Example:
EC2 Instances should have Tags for “Cost center” and “Project”, for example. If an existing or new EC2 Instance comes online without a “Cost center” tag, or if the tag key is something different than “Cost center” (“Cost Center” for example) than I would like this to appear in my dashboard/query.

My existing query is similar to the following, but this returns only if the Tag does exist, I need to know when this Tag is missing. Changing “IS NOT NULL” to “IS NULL” changes the query output but not in a way that helps with this use case.

FROM SystemSample SELECT hostname,awsAccountId,ec2PrivateIpAddress WHERE ec2Tag_Cost center IS NOT NULL LIMIT MAX

Thanks in advance!

Try doing like so:

Select * from SystemSample where aws.arn IS NOT NULL and ec2Tag_Costcenter IS NULL limit 1

Switch to the JSON view of the chart. Look at the attributes.

1 Like

Let us know how that works out for you @michael.ellis!

Thanks once again @6MM . Your code seems close enough to serve a purpose. Now I just have to get the query into something a bit more useful at a glance for people that don’t read JSON.

I more just meant to show you that it works and then what tags you have on an event that was returned. Seems like you can use the IS NULL approach and I think that simple test shows it. It did for my AWS tags, but I didn’t know if it would work for you.

Yessir, @6MM, it does seem to work for my needs. Thank you very much, as always. I have not prettied up the query into a Dashboard just yet, but this does give me a great start. Thanks again!