A comprehensive cloud governance tool to audit resource tags, enforce compliance schemas, and generate remediation scripts across major cloud providers.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install cloud-tagging-enforcer
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install cloud-tagging-enforcer using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Cloud Tagging Enforcer?
Cloud Tagging Enforcer is a powerful addition to the Openclaw Skills library designed to solve the persistent challenge of untagged or incorrectly tagged cloud infrastructure. It provides an automated way to scan AWS, GCP, and Azure environments for resources that violate organizational tagging policies, which are critical for cost allocation, security compliance, and operational governance.
By integrating this skill into an AI agent's workflow, teams can move beyond manual audits to a continuous compliance model. The skill not only identifies drift—such as variations in case or spelling like "prod" versus "production"—but also generates actionable remediation scripts and preventive Service Control Policies (SCPs) to stop non-compliant resource creation at the source.
Cloud Tagging Enforcer Use Cases
- Auditing multi-cloud environments to find untagged resources for cost center attribution.
- Standardizing tag values to prevent drift and ensure consistent reporting in billing dashboards.
- Generating compliance reports for stakeholders to visualize governance gaps across AWS, GCP, and Azure.
- Creating remediation scripts to apply placeholder tags to legacy resources for immediate identification.
- Drafting preventive IAM or SCP policies to enforce tagging at the time of resource creation.
How Cloud Tagging Enforcer Works
- Policy Definition: The skill identifies existing tagging schemas or prompts the user to define a required set of keys, allowed values, and regex patterns.
- Infrastructure Scanning: It executes provider-specific CLI commands (e.g., Resource Groups Tagging API for AWS) to fetch metadata for all active resources.
- Compliance Validation: A validation engine compares the current tags against the defined policy, flagging missing, empty, or malformed entries.
- Report Generation: The skill produces a detailed compliance report summarizing the audit results, including percentage of compliance and estimated unattributable costs.
- Remediation & Enforcement: It generates executable shell scripts or Terraform updates to fix non-compliant resources and provides code for preventive enforcement rules.
Cloud Tagging Enforcer Setup
Ensure you have the relevant Cloud CLIs installed and authenticated (AWS CLI, gcloud CLI, or Azure CLI). Install the skill into your agent environment and verify your cloud access permissions.
# Verify AWS connectivity
aws sts get-caller-identity
# Clone and initialize the tagging policy
# Search for existing policy files in your repository
rg -l "tagging.policy|tag.schema|required.tags" . -g '*.{json,yaml,yml,toml}'
Cloud Tagging Enforcer Data Schema & Taxonomy
The skill organizes audit data and policies using the following structure:
| Data Component | Format | Description |
|---|---|---|
| Tagging Policy | YAML/JSON | Defines required keys, allowed values, and naming patterns. |
| Violation List | JSON Object | Maps resource ARNs/IDs to specific missing or invalid tag keys. |
| Compliance Report | Markdown | A human-readable summary of the infrastructure's health status. |
| Remediation Script | Bash/Python | Generated scripts containing CLI commands for bulk tag updates. |
| Infrastructure Code | Terraform | HCL snippets for default_tags blocks to ensure source-of-truth compliance. |
Cloud Tagging Enforcer Advanced Features
- Multi-Cloud Support: Unified workflows for AWS, Google Cloud Platform, and Microsoft Azure.
- Drift Detection: Identification of inconsistent tag values (e.g., casing or hyphenation differences) that break automation.
- Preventive Controls: Automated generation of AWS Service Control Policies (SCPs) to deny non-compliant resource provisioning.
- Infrastructure as Code (IaC) Integration: Scans Terraform files directly to fix tagging issues at the source rather than just in the live environment.
- Cost Impact Estimation: Correlates untagged resources with billing data to estimate unallocated cloud spend.
SKILL.md
Loading
Related Openclaw Skills
Prompt Injection Tester
A comprehensive security auditing tool designed to simulate adversarial attacks and harden LLM-powered applications against prompt injection.
Site Health Monitor
A comprehensive monitoring tool for tracking website uptime, SSL certificate health, and server response times.
Error Budget Tracker
A reliability management tool that transforms SLO targets into actionable engineering decisions by tracking budget consumption and burn rates.
API Mock Generator
A high-performance utility to generate live mock API servers or static JSON fixtures directly from OpenAPI and Swagger specifications.
Client Report Generator
An automated reporting engine that converts raw CSV, JSON, and analytics data into professional, structured client-facing documents.
Architecture Decision Record Generator
A specialized tool for analyzing codebases and conversations to document the strategic reasoning behind technical choices.
Featured*
