Terratag CLI
The CLI adds tags and labels to Terraform and OpenTofu files for consistent agent-prepared AWS, GCP and Azure configuration.
- 1,058 ★ on the repository
- Last commit
- MPL-2.0
Extended access
Why this level
- The CLI rewrites infrastructure files; a later apply can change real resource tags.
Install
Manual install
brew install env0/terratag/terratagFirst Homebrew installation block, preserving README indentation.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The CLI rewrites infrastructure files; a later apply can change real resource tags.
This is third-party code. Review the repository files before installing.
What it does
Terratag adds shared tags or labels to existing infrastructure files. An agent can assign an environment, project or owner to multiple resources without editing every block manually. Users choose a directory and resource types, then inspect the resulting Git diff. The CLI uses provider schemas after Terraform or OpenTofu initialization. Include and exclude filters scope the work. Processed files and backups appear locally; infrastructure deployment remains a separate project workflow.
Who it is for. Infrastructure engineers introducing shared cost and ownership tags into an existing Terraform project.
Good fit when
- An agent adds a project tag before cost allocation work.
- Only S3 and DynamoDB resources should be tagged in a larger configuration.
- An environment change needs a reviewable file update.
- An OpenTofu team has agreed on shared cloud labels.
Not a fit when
- Resources exist only in the cloud without supported configuration files.
- Infrastructure plans must be applied automatically as part of tagging.
- You expect billing allocation without setting up reporting.
Example request
Prepare environment tags for S3 in a project copy, preserve existing values and show changed files before deployment.Limitations
Initialize modules before running the CLI so provider schemas and child modules are available. New values override matching existing tags by default; `--keep-existing-tags` preserves the old values. Support is limited to the documented AWS, Google and Azure providers, so arbitrary resource blocks may not accept tagging. Explicit Terragrunt stacks are not directly supported; the documentation describes working with individual units instead.
How to disable. Stop invoking Terratag and inspect the version-control diff. Restore originals from backups or Git before the next infrastructure apply.
FAQ
When should Terratag run?
After `tofu init` or `terraform init` has loaded modules and schemas.
Will existing tags remain?
New values win on matching keys by default. Use `--keep-existing-tags` to preserve old values.
How do I select resource types?
Use a regular expression with `-filter`; exclusions use `-skip`.
What files appear next to the originals?
The default example produces `.terratag.tf` files and `.tf.bak` backups.
Will cloud resources change immediately?
No. Files change first; apply separately after reviewing the plan.
Discussion
No questions or reviews yet.
Related
CLI toolsA terminal coding agent that picks a model for each request on its own and shows spend in real time
A CLI that keeps RFCs, ADRs and work items as TOML in your repo and stops an agent from closing work until checks pass
A CLI turns Git changes into a guided code walkthrough with questions and explanations written by your existing agent
The official Amazon EKS CLI creates and manages Kubernetes clusters from configuration that an agent can prepare for review.
The tode command opens a VS Code interface inside the terminal for reviewing files and changes alongside agent work.
The Kubernetes terminal interface shows resources and logs so users can inspect cluster state alongside agent work.
README in short
Environment variables can supply options, with CLI arguments taking precedence. OpenTofu is preferred when installed.