{{ summaryHeading }} {{ summaryPrimary }} {{ summaryLine }} {{ badge.label }} {{ badge.value }}
Header aliases such as id, resource_id, type, provider, region, tags, and labels are recognized.
{{ sourceStatus }}
Auto detect reports the resolved delimiter in the summary and evidence exports.
This label appears in evidence and handoff exports without changing coverage.
Example: Owner, Environment=prod|stage|dev, CostCenter, DataClass=public|internal|confidential.
Per-tag chart rows remain evidence; the gate uses whole resources that satisfy every required tag.
%
Use strict matching for enforcement evidence and case-insensitive matching for early inventory cleanup.
Allowed values in Required tags are always enforced when supplied.
Comma- or newline-separated type names are matched case-insensitively.
Priority changes queue order only; it does not change coverage, debt, or the pass/fail decision.
MeasureValueInterpretationCopy
{{ row.label }}{{ row.value }}{{ row.context }}
ResourceTypeProviderRegionMissing or invalid tagsStatusCopy
{{ row.resource_id }}{{ row.type }}{{ row.provider }}{{ row.region }}{{ row.gap_display }}{{ row.status }}
Required tagCoverageMissingInvalidExamplesNext actionCopy
{{ row.tag_key }}{{ row.coverage_display }}{{ row.missing_count }}{{ row.invalid_count }}{{ row.examples_display }}{{ row.action }}

{{ chartLoading ? 'Loading chart…' : chartError }}

Config Drift Checker Compare approved and observed configuration snapshots, classify meaningful drift, and prioritize changed or missing security settings.
Terraform Variable Defaults Checker Review Terraform variable blocks for unsafe defaults and secret-like values, then prioritize type mismatches, version conflicts and fixes.
Terraform Plan Summary Analyzer Analyze Terraform plan JSON or text before apply, flag destructive changes and drift, and rank resources by review risk without uploading plan data.
IAM Policy Permissions Analyzer Review AWS IAM policy JSON for wildcard breadth, privilege paths, and policy-shape issues before validating effective access in AWS.

Cloud metadata becomes valuable when it answers operational questions consistently. An owner tag routes an incident, an environment tag separates production from test, and a cost-center tag makes shared spending assignable. A tag key names the category; its value supplies the detail used by people, reports, policies, and automation.

Inventory drift is inevitable when resources arrive through several paths. Infrastructure code may apply the full policy, while a console experiment, migration, managed child resource, or old project may omit part of it. Measuring coverage exposes that drift before missing ownership or classification data becomes a cleanup, billing, or response problem.

  • Presence asks whether the required key exists.
  • Value completeness also rejects a blank value.
  • Allowed vocabulary accepts only declared values such as Environment=prod|stage|dev.
  • Whole-resource coverage counts a resource only when every required tag passes its rule.

A per-tag chart can look strong while whole-resource coverage remains weak. If different resources are each missing a different key, every key may have high individual coverage but few resources are fully compliant. The policy target should therefore match the decision: whole-resource coverage for enforcement, and per-tag gaps for remediation planning.

Provider rules differ in case sensitivity, supported resource types, inheritance, and naming restrictions. An inventory audit is most reliable when its scope, exclusions, required keys, and accepted values are frozen before teams compare one run with another.

How to Use This Tool:

Audit one account, subscription, project, or comparable export slice against one explicit tag policy.

  1. Paste CSV or TSV inventory rows containing a resource identifier and tags. Pin the input format if automatic delimiter detection chooses the wrong one.
  2. Enter required keys, adding allowed values after = when a controlled vocabulary matters.
  3. Choose strict key matching for enforcement evidence or case-insensitive matching for discovery. Decide whether blank values fail, then set the whole-resource coverage target.
  4. Exclude only resource types that the policy intentionally omits. Check Coverage evidence for scope and counts, then use the gap ledger and remediation queue to assign fixes.

Interpreting Results:

Resource coverage is the policy gate. It is the percentage of checked resources that satisfy every required tag, and the target passes at equality. Tag debt counts missing and invalid tag slots, so one resource can contribute several gaps.

Use the worst-tag result to find the broadest policy weakness, then read the resource gap ledger before changing automation. A missing key, a blank value, and an unapproved value need different fixes. Priority tags change queue order only; they do not alter coverage, debt, or the pass/fail result.

A high percentage does not prove that the inventory is complete or that tag values are truthful. Compare the checked resource count with the provider inventory and review ignored types before accepting the result as governance evidence.

Technical Details:

Coverage analysis parses each resource's tag set, applies the selected key and value rules, and classifies each required slot as valid, missing, or invalid. A resource is complete only when it has no missing or invalid required slots.

Rule Core

StageDecision
Key lookupStrict mode preserves key case. Case-insensitive mode lowercases keys and allowed values before comparison.
MissingNo matching key exists on the resource.
InvalidThe key exists but its value is blank under the non-empty rule, or its value is outside the declared vocabulary.
ValidThe key exists, satisfies the blank-value rule, and matches an allowed value when a vocabulary was declared.
Complete resourceEvery required tag is valid. One missing or invalid slot changes the resource to Needs tags.

Allowed values are always enforced when supplied, even when key-only mode permits blank values for requirements without an allowed vocabulary. Duplicate required keys are rejected after the selected case-matching rule is applied.

Formula Core

Whole-resource coverage divides complete resources by all checked, non-ignored resources.

C=NcompleteNchecked×100%

Each required tag uses the same denominator, while tag debt adds every missing and invalid slot.

D=Nmissing+Ninvalid

The coverage target accepts 0% to 100%, and the gate passes when C is greater than or equal to the target. Percentages retain full calculation precision and are displayed to one decimal place.

Input and Scope Limits

The source accepts up to 500,000 characters and analyzes at most the first 5,000 resource rows. A policy may contain up to 100 unique required tags. Header aliases cover common resource, type, provider, region, tags, and labels columns; a missing tags column makes resources appear untagged.

Inventory text and selected local files remain in the browser. Tag exports can still contain resource names, account structure, ownership, or data-classification labels, so remove sensitive fields before sharing results.

References: