AWS Cloud Practitioner Study Notes · Part 46

AWS Tag Restrictions: Limits, Keys, Values, and Reserved Prefixes

AWS Cloud Practitioner study notes covering tag limits, key and value lengths, allowed characters, case sensitivity, empty values, and the aws: prefix.

Tan Chin SiangBackend & Cloud Software Engineer

21 Aug 2026 9 min read

AWS tags are key-value labels that help you identify, organise, secure, automate, and allocate costs to AWS resources. A tag consists of a key and an optional value, but AWS applies limits and naming rules that are frequently tested in the Cloud Practitioner exam.

This is Part 46 of the AWS Cloud Practitioner Study Notes. The core numbers to memorise are:

50   maximum user-defined tags per resource
128  maximum tag-key length in Unicode characters
256  maximum tag-value length in Unicode characters

AWS tag restrictions at a glance

Restriction	Rule
User-defined tags per resource	Maximum 50
Tag-key length	1–128 Unicode characters in UTF-8
Tag-value length	0–256 Unicode characters in UTF-8
Duplicate key on one resource	Not allowed; one key has one value
Duplicate values	Generally allowed across different keys/resources; set members must still be unique
Case sensitivity	Keys and values are case-sensitive
Empty value	Allowed as an empty string
Null value	Not allowed
Reserved prefix	`aws:` is reserved for AWS use
Cross-service characters	Unicode letters, digits, spaces, and `_ . : / = + - @` are generally safe

These are general tagging rules. Individual AWS services can impose stricter limits or character restrictions, so check the resource-specific documentation when a tagging schema must work across multiple services.

Maximum 50 user-defined tags

The general quota is 50 user-defined tags per resource. For example, the 51st user-defined tag on an EC2 instance exceeds the general limit.

EC2 instance
├── Environment
├── Owner
├── Team
├── Project
└── ... up to 50 user-defined tags

AWS-generated tags with the reserved aws: prefix do not count toward the user-defined tag quota. This does not mean you can create extra user tags with that prefix; AWS reserves it for AWS-generated metadata.

The quota is per resource, not per account. Two different resources can each have their own 50 user-defined tags.

Exam shortcut: How many user-defined tags can a resource have? → 50.

Tag-key length: maximum 128 characters

A tag key must be between 1 and 128 Unicode characters in UTF-8. Examples include:

Environment
CostCenter
ManagedBy
application-owner

Use short, stable, descriptive keys. A consistent key such as Environment is easier to use in IAM policies, cost allocation, automation, and reports than many variations such as Env, environment-name, and DeploymentStage.

Exam shortcut: Maximum tag-key length → 128 Unicode characters.

Tag-value length: maximum 256 characters

A tag value can contain between 0 and 256 Unicode characters in UTF-8. Values describe the resource’s classification or ownership:

Environment = Production
Owner       = BackendTeam
CostCenter  = IT001

Values are strings from the tagging system’s perspective. If an automation tool needs to interpret true, false, a date, or a number, define a consistent representation and validate it in your tagging policy.

Exam shortcut: Maximum tag-value length → 256 Unicode characters.

One key can have one value

A resource cannot have two tags with the same key. This is invalid:

Environment = Development
Environment = Production

If you add a tag whose key already exists on that resource, the new value replaces or overwrites the old value. To represent multiple concepts, use different keys:

Environment = Production
Lifecycle    = LongTerm

The same key can be used on many different resources. The uniqueness rule applies to keys on the same resource.

Keys and values are case-sensitive

AWS treats capitalization as significant:

Environment
environment
ENVIRONMENT

These are different keys. Values are also case-sensitive:

Production
production
PRODUCTION

This can create inaccurate reports or failed automation if one team uses Prod and another uses prod. Choose a standard such as Development, Staging, and Production, document it, and enforce it through infrastructure-as-code or governance controls.

Empty values are allowed; null is not

An empty string is a valid tag value:

Owner = ""

This can be useful when a key is present but its value has not yet been assigned. However, a null value is not a valid tag value:

Owner = null  ✗

Use a meaningful placeholder or omit the tag until the owner is known, depending on the organisation’s policy. Do not confuse an empty string with a missing tag; governance rules may treat those states differently.

The `aws:` prefix is reserved

Do not create user-defined tag keys or values that use the reserved aws: prefix. AWS may create system tags such as:

aws:cloudformation:stack-name

Tags with an aws: key prefix are AWS-managed. You cannot edit or delete them, and AWS-generated tags do not count against the general 50 user-defined-tag limit.

Avoid all case variations of the reserved prefix for user-defined keys, including AWS: or Aws:. The safe rule is simple:

User-defined key:  Environment
Reserved key:     aws:createdBy

Exam shortcut: Can you create a tag key beginning with aws:? → No.

Generally safe characters

For a tagging schema intended to work across many AWS services, use Unicode letters, digits, spaces, and these characters:

_  .  :  /  =  +  -  @

Examples:

Environment = Production
Project     = E-Commerce
Owner       = Alice
Cost-Center = IT-001
Application = API_V2

Some individual services have stricter rules. A key accepted by one service may be rejected by another if it uses unusual punctuation or a different length limit. Cross-service-safe names are especially important when resources are managed by Terraform, CloudFormation, or an organisation-wide tagging pipeline.

Good and poor tagging examples

Good example

Name        = payment-api
Environment = Production
Owner       = BackendTeam
Project     = Ecommerce
Department  = Finance
CostCenter  = IT001
ManagedBy   = Terraform
Application = OrderService
Backup      = Yes

These tags communicate ownership, environment, business context, operational responsibility, and automation. They can support cost allocation, IAM conditions, backup automation, reporting, and compliance checks.

Poor example

Name  = Server1
Owner = Bob
Test  = Yes
ABC   = XYZ

These tags may be syntactically valid, but they provide little durable context. Server1 may not explain the application, and ABC has no clear meaning for automation or finance.

A practical enterprise tag strategy

Many organisations define required keys such as:

Tag key	Example	Purpose
`Name`	`payment-api`	Human-readable identity
`Environment`	`Development`, `Staging`, `Production`	Lifecycle and isolation
`Owner`	`Alice`	Individual accountability
`Team`	`Backend`	Operational ownership
`Project`	`E-Commerce`	Business grouping
`CostCenter`	`IT001`	Cost allocation
`Department`	`Finance`	Organisational reporting
`ManagedBy`	`Terraform`	Provisioning ownership
`Application`	`OrderService`	Workload identity
`Backup`	`Yes`	Automation input

Good tag governance includes more than a list of names:

Define required and optional keys.
Standardise allowed values and capitalisation.
Apply tags automatically through Terraform, CloudFormation, or launch templates.
Activate appropriate user-defined tags as cost allocation tags.
Restrict tag creation or required keys with IAM policies where supported.
Detect missing, invalid, or inconsistent tags using governance tools.
Never store passwords, tokens, or other secrets in tags.

Tagging and automation

Tags are metadata, not an access-control system by themselves. They become useful when other AWS capabilities consume them.

Tag: Environment=Production
        ↓
Cost allocation and reporting
        ↓
Backup or cleanup automation
        ↓
IAM condition or governance rule
        ↓
Operational ownership

For example, an automation job can find resources with Backup=Yes, while a cost report groups spending by CostCenter. An IAM policy can use tag condition keys to control which resources a principal may create or modify, but the exact policy support depends on the AWS service.

Common exam questions

How many user-defined tags can one resource have?

What is the maximum tag-key length?

128 Unicode characters in UTF-8.

What is the maximum tag-value length?

256 Unicode characters in UTF-8.

Can a resource have two tags with the same key?

No. One key has one value per resource; adding the same key updates the value.

Are tag keys and values case-sensitive?

Yes.

Can a tag value be an empty string?

Yes.

Can a tag value be null?

No.

Can a user create a tag key beginning with aws:?

No. The prefix is reserved for AWS use.

Do AWS-generated aws: tags count against the 50-tag limit?

No, the general limit applies to user-defined tags.

Final memory trick

50 tags
128 key
256 value
One key → one value
Case-sensitive
Empty string allowed
Null not allowed
aws: reserved

The exam sequence to memorise is 50 → 128 → 256. Pair it with the rule that keys are unique per resource and aws: belongs to AWS.

Sources

AWSCloud PractitionerAWS TagsCost ManagementCloud Governance

Written by

Tan Chin Siang

Backend and cloud software engineer writing about reliable systems, infrastructure automation, and engineering practice.