Hub Tags (Create, Change, Delete)

Standard changes: Creation and changing of tags and Deletion of tags, on the landing zone hub.

Effect: Azure tags on hub resources are added, changed or removed in place. No resources are recreated.

Spoke tags are owned by the workload team. They are set in the spoke JSON tags block (see Change spoke), not here.

Request fields

Field	Use
Tag Name	The tag key (case-sensitive in Terraform; Azure treats tag names case-insensitively)
Tag value	The value (create/change only)
Rationale	Change record
Environment	Platform environment (canary / prod)
Comments	Which hub resources should carry the tag, if not all

How hub tags work

There is no single "tag everything" variable in the hub. Each layer exposes one tag variable per component, of type map(string) with default null. A component without a tag variable cannot be tagged through code.

Layer	Tag variable	Applied to
foundation	module_tags	Foundation resource groups (merged with resource_group_tags) and the DDoS protection plan
foundation	resource_group_tags	Foundation resource groups only
foundation	network_ddos_protection_plan_tags	DDoS protection plan
foundation	monitor_action_group_general_tags, monitor_action_group_xpirit_tags	The two action groups
connectivity	virtual_network_hub_tags	Hub virtual network (when use_virtual_network_hub_module)
connectivity	firewall_module_tags	Azure Firewall
connectivity	vpn_gateway_tags, express_route_gateway_tags	Virtual hub VPN / ExpressRoute gateways
connectivity	virtual_network_gateway_module_tags	Virtual network gateway (non-vWAN)
connectivity	express_route_circuit_module_tags	ExpressRoute circuit
connectivity	point_to_site_vpn_gateway_tags, point_to_site_vpn_server_configuration_tags	Point-to-site VPN
connectivity	virtual_hub_security_partner_provider_tags	Security partner provider
connectivity	application_gateway_module_tags	Application Gateway
connectivity	web_application_firewall_policy_module_tags	WAF policies
connectivity	private_dns_zone_tags	Private DNS zones
connectivity	network_watcher_module_tags	Network Watcher
identity	virtual_network_hub_tags	Identity virtual network
management	virtual_network_hub_tags	Management virtual network
management	key_vault_module_tags, automation_account_module_tags, log_analytics_module_tags, storage_account_module_tags	Management components

Some objects also have a tags attribute inside their own configuration map, for example the entries of network_security_groups and route_tables in connectivity.auto.tfvars.

Not taggable through code today:

• the connectivity resource groups (this, appgw and privatedns in infra/deploy/connectivity/main.tf);
• the firewall policy: firewall_policy_tags is passed to infra/templates/firewall_policy, but the template only forwards firewall_policy_module_tags, which connectivity never sets;
• Azure Bastion, the Private DNS Resolver and the forwarding ruleset: no tag variable is exposed in connectivity;
• the hub 24/7 action group (tags = {} is hard-coded);
• variables that are declared but not used: monitor_resource_group_tags (foundation) and activity_log_alert_module_tags (management, not used inside infra/templates/management).

Create or change a tag

1. Pick the variable(s) for the resources that should carry the tag (table above).
2. Set or extend the map in the layer's tfvars for each region, for example <env-folder>/weu/connectivity.auto.tfvars:

firewall_module_tags = {
  costcenter  = "IT-NET"
  environment = "prod"
}
virtual_network_hub_tags = {
  costcenter  = "IT-NET"
  environment = "prod"
}

To use the same value in every region, you can put the variable in <env-folder>/<layer>.auto.tfvars (environment level). Don't also set it in a region file: when a variable is in both, the environment-level file wins (see which tfvars files a layer reads). 3. Run hub and check the plan: only ~ update in-place with changes to tags.

Delete a tag

Remove the key from the map. To remove all code-managed tags of a component, remove the variable or set it to null. The plan shows ~ update in-place with the tag removed.

If Azure Policy or a person added a tag outside Terraform, Terraform shows it as a change and removes it on the next apply, unless the module ignores tag changes. Check the plan for tags you did not expect to lose.

Verify

Azure portal → the resource → Tags, or:

az resource show --ids <resource-id> --query tags

Roll back

Revert the tfvars change and run hub again.