Add tags to s3 backend resources

[ArtyMaury]

Current Terraform Version

1.0.11

Use-cases

In my company we'd like to simplify terraform backend management and use a unique s3 bucket for all projects.
We already have a custom rôle by project, but to secure access by folder we've reached a limit in aws bucket policies.
The best solution would be to tag the s3 objects to better handle access.

Proposal

Looking at the code for remote-state/s3, the tags would work a lot like the current acl work. It would be another option in the s3 backend config with small impact in the client.
https://github.com/hashicorp/terraform/blob/main/internal/backend/remote-state/s3/client.go#L175

[apparentlymart]

Hi @ArtyMaury! Thanks for sharing this use-case.

Assuming you're talking about tagging individual the S3 objects inside buckets rather than the buckets themselves, that does seem like a reasonable use-case to consider but I also wanted to note that if you want to achieve that with Terraform as it exists today then I expect (but have not actually verified) that subsequent writes to the state after you manually add tags via the S3 API should preserve the tags you set, because the S3 backend is writing a new version of the object in-place and isn't currently setting any tags explicitly itself. If you've tried that and found that it didn't work for some reason, please let us know!

[ArtyMaury]

Hi @apparentlymart

I've just tried and it doesn't work. But I think that but modifying the Put method in the s3 client it will push the tags every time so it should work.
I can try to do a pull request if you're ok.

[bjornrog]

Another use-case for tags on the state object.

We tag resources with git repository information. If we could tag the state object, we could easily locate the correct repository using the given state object tags.

[KylePeterDavies]

I don't understand why this has not been implemented as far as I know (and I could be naive) it's just add some extra parameter to the backend to pass to the put object function call with the provided tags when the state file is created. Would you be open to a pull request?