AWS Tagging and Labels#

This guide describes two conventions that affect AWS queries across the graph: dynamic tag relationships and provider-prefixed resource labels.

Dynamic AWS tags#

An AWSTag is identified by {key}:{value} and is connected from a resource with TAGGED:

(resource)-[:TAGGED]->(:AWSTag)

Tag relationships are loaded centrally from the AWS Resource Groups Tagging API. They are dynamic relationships rather than relationships declared in each resource’s model schema. A shared declarative catalog drives both runtime matching and generated schema documentation so the supported relationships remain consistent.

The authoritative mapping is AWS_TAGGABLE_RESOURCES in cartography/models/aws_tagging.py. The current supported source labels are:

  • Compute and networking: AWSAutoScalingGroup, AWSEC2Instance, AWSEC2KeyPair, AWSEC2SecurityGroup, AWSEC2Subnet, AWSElasticIPAddress, AWSInternetGateway, AWSLambda, AWSLoadBalancer, AWSLoadBalancerV2, AWSNetworkInterface, AWSTransitGateway, AWSTransitGatewayAttachment, and AWSVpc.

  • Containers: AWSECRRepository, AWSECSCluster, AWSECSContainer, AWSECSContainerInstance, AWSECSTask, AWSECSTaskDefinition, and AWSEKSCluster.

  • Data and storage: AWSDBSubnetGroup, AWSDynamoDBTable, AWSEBSVolume, AWSElasticacheCluster, AWSEMRCluster, AWSESDomain, AWSRDSCluster, AWSRDSInstance, AWSRDSSnapshot, AWSRedshiftCluster, and AWSS3Bucket.

  • Identity, security, and messaging: AWSKMSKey, AWSRole, AWSSecretsManagerSecret, AWSSQSQueue, and AWSUser.

Because support follows the runtime mapping, check that mapping when exact coverage matters.

Find resources with a tag:

MATCH (resource)-[:TAGGED]->(:AWSTag {key: $key, value: $value})
RETURN labels(resource) AS labels, resource.id, resource.arn, resource.name
ORDER BY resource.name

Find resources missing a required tag:

MATCH (account:AWSAccount)-[:RESOURCE]->(resource)
WHERE resource.lastupdated IS NOT NULL
  AND NOT EXISTS {
    MATCH (resource)-[:TAGGED]->(:AWSTag {key: $required_key})
  }
RETURN account.id, labels(resource), resource.id, resource.arn, resource.name
ORDER BY account.id, resource.name

Narrow the second query to the resource labels relevant to your policy. Not every AWS node type is discoverable through the Resource Groups Tagging API.

Provider-prefixed labels#

AWS resource labels are provider-prefixed. New queries should use documented AWS* labels such as AWSLoadBalancer, AWSIpRange, and AWSIpPermissionInbound.

Historically unprefixed labels remain attached as compatibility aliases until v1.0.0. They preserve existing queries during migration, but they are not the preferred provider-specific interface. Some unprefixed labels are also intentional ontology labels used for cross-platform queries, so do not assume that every unprefixed label is deprecated.

Use the provider-prefixed label when the query depends on AWS-specific properties or relationships:

MATCH (load_balancer:AWSLoadBalancer)
RETURN load_balancer.id, load_balancer.region

Use an ontology label when the query intentionally spans providers:

MATCH (load_balancer:LoadBalancer)
RETURN labels(load_balancer), load_balancer.id

During the compatibility period, avoid creating new queries that depend only on a historical unprefixed provider label. This keeps queries valid when those aliases are removed.