Add tags to AWS resources

Implement with AI

Send this guide to your coding agent.

Prerequisite: Install Port MCP

Open in ClaudeOpen in CodexOpen in Cursor

Open plan mode if your tool supports it; otherwise present the plan below filled in and wait for my approval. Implement this Port guide in my org via MCP:

https://docs.port.io/guides/all/add-tags-to-aws-resources

Read the raw markdown version at https://docs.port.io/guides/all/add-tags-to-aws-resources.md - it contains every tab and code block without page markup.

Goal: get the guide's core flow working end-to-end in my org; adapting it to fit my existing setup takes priority over matching the guide 1:1.

Plan:
1. Confirm MCP is connected, in the right org, with sufficient permissions.
2. If the guide offers alternative implementation paths (tabs), pick the one matching my installed integrations and tools, confirm it with me, and implement only that path.
3. Diff the guide's data model (blueprints, properties, relations, workflows, actions, agents, automations, integrations, webhook data sources, secrets) against mine.
4. Propose adaptations for gaps, reusing existing blueprints/relations over guide-named duplicates.
5. Flag what needs a UI click, credential, or secret from me, testing MCP capability empirically before ruling anything out. If the guide has a "Set up via API" section, use it for anything MCP can't do before treating a step as UI-only.
6. Stop on any blocker and give me options. Approving this plan authorizes the writes it lists; pause only for writes beyond what's listed.

Build:
- Extend blueprint schema additively when upserting; don't remove or overwrite existing properties, and treat type conflicts as a blocker, not an auto-fix.
- Never print secret values into the chat or logs; ask me to set them in Port, or write them via the secrets API without echoing them back.
- List any mock data in the plan, minimal and labeled mock; once approved, seed it without re-asking, and tell me what you seeded.
- For anything the guide writes downstream (e.g. a webhook target), use a real entity, not a mock.
- For pages/widgets, use the real page identifier from the app URL, not a guessed slug.
- When you hit a UI step confirmed (not assumed) unsupported via MCP and not covered by the guide's API sections, pause, give exact clicks, then resume via MCP.
- Validate and give links after each meaningful step (only a tool-returned URL, no guessed paths); don't proceed if the last run wasn't a success.

Done:
- Run the guide's "Let's test it" steps where possible (e.g. execute a workflow test run) and confirm the expected output exists in Port.
- Summarize adaptations, seeded data, what was mocked or skipped, remaining UI steps, and how to verify.

This guide demonstrates how to add tags to AWS S3 buckets and ECR repositories using Port workflows and GitHub Actions. Each workflow collects the resource and tags from the user, then dispatches a GitHub Actions workflow that applies the tags in AWS.

Common use cases

• Standardize ownership, environment, and cost allocation tags on AWS resources.
• Let developers update resource tags without direct AWS console access.
• Apply consistent tagging workflows for S3 buckets and ECR repositories from Port.

Prerequisites

1. An AWS access key and secret key pair. See the AWS access keys documentation to create one.

2. The required AWS permissions for the resources you want to tag:

   • S3 buckets: AmazonS3FullAccess.
   • ECR repositories: AmazonEC2ContainerRegistryFullAccess.

3. Your AWS account ID. This is required for tagging ECR repositories.

4. A GitHub repository for the workflows dispatched by these Port workflows.

5. Port's GitHub Ocean integration installed.

6. The following GitHub Actions secrets in your workflow repository:

   • AWS_REGION - The AWS region where your S3 buckets or ECR repositories are located.
   • AWS_ACCOUNT_ID - Your AWS account ID. This is required for ECR repositories.
   • AWS_ACCESS_KEY_ID - Your AWS access key ID.
   • AWS_SECRET_ACCESS_KEY - Your AWS secret access key.

Set up data model

Create the blueprints for the AWS resource types you want to manage.

You can also ingest AWS resources instead of creating the blueprints manually:

• For S3 buckets, use the AWS exporter to ingest S3 buckets.
• For ECR repositories, use the ECR images and repositories example to create the blueprint and ingest repository entities.

Create the S3 bucket blueprint

1. Go to the Builder page.

2. Click + Blueprint.

3. Click Edit JSON.

4. Copy and paste the following JSON configuration into the editor.

   S3 bucket blueprint (Click to expand)

   {
     "identifier": "s3_bucket",
     "description": "",
     "title": "S3 Bucket",
     "icon": "Bucket",
     "schema": {
       "properties": {
         "arn": {
           "type": "string",
           "title": "ARN"
         },
         "encryption": {
           "type": "array",
           "title": "Encryption"
         },
         "lifecycleRules": {
           "type": "array",
           "title": "Lifecycle Rules"
         },
         "link": {
           "type": "string",
           "title": "Link",
           "format": "url"
         },
         "publicAccess": {
           "type": "object",
           "title": "Public Access"
         },
         "regionalDomainName": {
           "type": "string",
           "title": "Regional Domain Name"
         },
         "tags": {
           "type": "array",
           "title": "Tags"
         },
         "versioningStatus": {
           "type": "string",
           "title": "Versioning Status",
           "enum": [
             "Enabled",
             "Suspended"
           ]
         }
       },
       "required": []
     },
     "mirrorProperties": {},
     "calculationProperties": {},
     "aggregationProperties": {},
     "relations": {}
   }

5. Click Save.

Create the ECR repository blueprint

1. Go to the Builder page.

2. Click + Blueprint.

3. Click Edit JSON.

4. Copy and paste the following JSON configuration into the editor.

   ECR repository blueprint (Click to expand)

   {
     "identifier": "ecrRepository",
     "description": "This blueprint represents an ECR repository",
     "title": "ECR Repository",
     "icon": "AWS",
     "schema": {
       "properties": {
         "registryId": {
           "type": "string",
           "title": "Registry ID",
           "description": "The ID of the registry"
         },
         "arn": {
           "type": "string",
           "title": "Repository ARN",
           "description": "The ARN of the repository"
         },
         "uri": {
           "type": "string",
           "title": "Repository URI",
           "description": "The URI of the repository"
         },
         "createdAt": {
           "type": "string",
           "title": "Created At",
           "description": "Date and time the repository was created",
           "format": "date-time"
         },
         "imageTagMutability": {
           "type": "string",
           "title": "Image Tag Mutability",
           "description": "The image tag mutability setting for the repository",
           "enum": [
             "MUTABLE",
             "IMMUTABLE"
           ],
           "enumColors": {
             "MUTABLE": "green",
             "IMMUTABLE": "darkGray"
           }
         },
         "configurationScanOnPush": {
           "type": "boolean",
           "title": "Configuration Scan on Push",
           "description": "Image scanning configuration when pushing images to this repository"
         },
         "encryptionType": {
           "type": "string",
           "title": "Encryption Type",
           "description": "The encryption type of the repository",
           "enum": [
             "AES256",
             "KMS"
           ],
           "enumColors": {
             "AES256": "green",
             "KMS": "blue"
           }
         },
         "kmsKey": {
           "type": "string",
           "title": "KMS Key",
           "description": "The KMS key used for encryption"
         }
       },
       "required": []
     },
     "mirrorProperties": {},
     "calculationProperties": {},
     "aggregationProperties": {},
     "relations": {}
   }

5. Click Save.

Add tags to an S3 bucket

Set up the workflow

To create the workflow:

1. Go to the Workflows page of your portal.

2. Click on the + Workflow button in the top-right corner.

3. In the Name field, enter Add Tags to AWS S3 Bucket, then click Confirm.

4. On the editor page, click the see workflow JSON button (the code icon) to open the JSON editor.

5. Copy and paste the workflow JSON below to replace the example workflow:

   Replace the variables

   • <GITHUB_ORG> - your GitHub organization or user name.
   • <GITHUB_REPO> - your GitHub repository name.
   • <YOUR_GITHUB_OCEAN_INTEGRATION_ID> - your GitHub Ocean integration installation ID.
   Add tags to S3 bucket workflow (Click to expand)

   {
     "identifier": "add_tags_to_s3_bucket",
     "title": "Add Tags to AWS S3 Bucket",
     "icon": "AWS",
     "description": "Add tags to an S3 bucket",
     "nodes": [
       {
         "identifier": "trigger",
         "title": "Add Tags to AWS S3 Bucket",
         "config": {
           "type": "SELF_SERVE_TRIGGER",
           "userInputs": {
             "properties": {
               "bucket": {
                 "icon": "Bucket",
                 "title": "S3 Bucket",
                 "type": "string",
                 "format": "entity",
                 "blueprint": "s3_bucket",
                 "description": "Select the S3 bucket entity to tag."
               },
               "tags": {
                 "icon": "DefaultProperty",
                 "title": "Tags",
                 "type": "object",
                 "description": "Tags should be in key-value pairs like so: {\"key\": \"value\"}"
               }
             },
             "required": ["bucket", "tags"],
             "order": ["bucket", "tags"]
           }
         }
       },
       {
         "identifier": "add_tags",
         "title": "Add tags to S3 bucket",
         "config": {
           "type": "INTEGRATION_ACTION",
           "installationId": "<YOUR_GITHUB_OCEAN_INTEGRATION_ID>",
           "integrationProvider": "github-ocean",
           "integrationInvocationType": "dispatch_workflow",
           "integrationActionExecutionProperties": {
             "org": "<GITHUB_ORG>",
             "repo": "<GITHUB_REPO>",
             "workflow": "add-tags-to-s3-bucket.yml",
             "workflowInputs": {
               "bucket_name": "{{ .outputs.trigger.bucket }}",
               "tags": "{{ .outputs.trigger.tags | tostring }}"
             },
             "reportWorkflowStatus": true
           }
         }
       }
     ],
     "connections": [
       {
         "sourceIdentifier": "trigger",
         "targetIdentifier": "add_tags"
       }
     ]
   }

6. Click Save to save the workflow.

Add the GitHub backend workflow

The workflow dispatches a GitHub Actions workflow that applies the tags in AWS. Create a workflow file under .github/workflows/add-tags-to-s3-bucket.yml with the content below:

Add tags to S3 bucket GitHub workflow (Click to expand)

name: Add tags to S3 bucket

on:
  workflow_dispatch:
    inputs:
      bucket_name:
        required: true
        type: string
      tags:
        required: true
        type: string

jobs:
  tag-s3-bucket:
    runs-on: ubuntu-latest
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Install jq
        run: sudo apt-get install jq

      - name: Add tags to S3 bucket
        env:
          BUCKET_NAME: ${{ inputs.bucket_name }}
          TAGS_JSON: ${{ inputs.tags }}
        run: |
          TAGGING=$(echo "${TAGS_JSON}" | jq -c '{TagSet: [to_entries[] | {Key: .key, Value: .value}]}')

          aws s3api put-bucket-tagging \
            --bucket "${BUCKET_NAME}" \
            --tagging "${TAGGING}"

Test the flow

1. Go to the Self-service page in Port.

2. Click on the Add Tags to AWS S3 Bucket workflow.

3. Select the S3 bucket entity and enter the tags as key-value pairs.

4. Click Execute to trigger the GitHub workflow.

Add tags to an ECR repository

Set up the workflow

To create the workflow:

1. Go to the Workflows page of your portal.

2. Click on the + Workflow button in the top-right corner.

3. In the Name field, enter Add Tags to AWS ECR Repository, then click Confirm.

4. On the editor page, click the see workflow JSON button (the code icon) to open the JSON editor.

5. Copy and paste the workflow JSON below to replace the example workflow:

   Replace the variables

   • <GITHUB_ORG> - your GitHub organization or user name.
   • <GITHUB_REPO> - your GitHub repository name.
   • <YOUR_GITHUB_OCEAN_INTEGRATION_ID> - your GitHub Ocean integration installation ID.
   Add tags to ECR repository workflow (Click to expand)

   {
     "identifier": "add_tags_to_ecr_repository",
     "title": "Add Tags to AWS ECR Repository",
     "icon": "AWS",
     "description": "Add tags to an AWS ECR repository",
     "nodes": [
       {
         "identifier": "trigger",
         "title": "Add Tags to AWS ECR Repository",
         "config": {
           "type": "SELF_SERVE_TRIGGER",
           "userInputs": {
             "properties": {
               "repository": {
                 "icon": "AWS",
                 "title": "Repository",
                 "type": "string",
                 "format": "entity",
                 "blueprint": "ecrRepository",
                 "description": "Select the ECR repository entity to tag."
               },
               "tags": {
                 "icon": "DefaultProperty",
                 "title": "Tags",
                 "type": "object",
                 "description": "Tags should be in key-value pairs like so: {\"key\": \"value\"}"
               }
             },
             "required": ["repository", "tags"],
             "order": ["repository", "tags"]
           }
         }
       },
       {
         "identifier": "add_tags",
         "title": "Add tags to ECR repository",
         "config": {
           "type": "INTEGRATION_ACTION",
           "installationId": "<YOUR_GITHUB_OCEAN_INTEGRATION_ID>",
           "integrationProvider": "github-ocean",
           "integrationInvocationType": "dispatch_workflow",
           "integrationActionExecutionProperties": {
             "org": "<GITHUB_ORG>",
             "repo": "<GITHUB_REPO>",
             "workflow": "add-tags-to-ecr-repository.yml",
             "workflowInputs": {
               "repository": "{{ .outputs.trigger.repository }}",
               "tags": "{{ .outputs.trigger.tags | tostring }}"
             },
             "reportWorkflowStatus": true
           }
         }
       }
     ],
     "connections": [
       {
         "sourceIdentifier": "trigger",
         "targetIdentifier": "add_tags"
       }
     ]
   }

6. Click Save to save the workflow.

Add the GitHub backend workflow

The workflow dispatches a GitHub Actions workflow that applies the tags in AWS. Create a workflow file under .github/workflows/add-tags-to-ecr-repository.yml with the content below:

Add tags to ECR repository GitHub workflow (Click to expand)

name: Add tags to ECR repository

on:
  workflow_dispatch:
    inputs:
      repository:
        type: string
        required: true
      tags:
        type: string
        required: true
        description: 'Tags should be in key-value pairs like so: {"key": "value"}'

jobs:
  tag-ecr-repository:
    runs-on: ubuntu-latest
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Install jq
        run: sudo apt-get install jq

      - name: Add tags to ECR repository
        env:
          TAGS_JSON: ${{ inputs.tags }}
        run: |
          TAGS=$(echo "${TAGS_JSON}" | jq -r '. | to_entries[] | "Key=\(.key),Value=\(.value)"' | tr '\n' ' ')

          aws ecr tag-resource \
            --resource-arn arn:aws:ecr:${{ secrets.AWS_REGION }}:${{ secrets.AWS_ACCOUNT_ID }}:repository/${{ inputs.repository }} \
            --tags ${TAGS}

Test the flow

1. Go to the Self-service page in Port.

2. Click on the Add Tags to AWS ECR Repository workflow.

3. Select the ECR repository entity and enter the tags as key-value pairs.

4. Click Execute to trigger the GitHub workflow.

Related guides

• Track Azure resource tagging compliance.