AWS Resource Groups Tagging API

Name: AWS Resource Groups Tagging API API
Brand: AWS Resource Groups Tagging API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentCloud InfrastructureComputehmac8 EndpointsREST

For Agents

Apply, remove, and audit tags across 100+ AWS resource types from one API and generate organisation-wide tag-compliance reports.

Connect the AWS Resource Groups Tagging API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the AWS Resource Groups Tagging API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with AWS Resource Groups Tagging API API.

Apply tags to many AWS resources at once with TagResources, regardless of underlying service

Remove tags in bulk from arbitrary AWS ARNs with UntagResources

Search resources by tag key and value across services using GetResources with filtering and pagination

Enumerate the distinct tag keys and values used in an account via GetTagKeys and GetTagValues

GET STARTED

Start building with AWS Resource Groups Tagging API API

Explore with Jentic

View OpenAPI Document

Use for: I need to apply CostCenter and Owner tags to a list of AWS resources, Find all S3 buckets in this account tagged Environment=prod, List every distinct tag key used across resources in this AWS account, Remove the legacy ProjectCode tag from every resource that has it

Not supported: Does not provision or delete the underlying AWS resources, does not work cross-region in a single call, and does not cover every AWS service — use for cross-service tag application, removal, and compliance reporting only.

Jentic publishes the only available OpenAPI document for AWS Resource Groups Tagging API, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for AWS Resource Groups Tagging API, keeping it validated and agent-ready. The Tagging API provides a unified interface for applying, removing, and querying tags across more than 100 supported AWS resource types — EC2, RDS, S3, Lambda, ECS, and more — without calling each service's individual tag operation. It also exposes tag-compliance reporting, so finance and platform teams can audit which resources are missing required cost-allocation tags. This is the operational backbone of cross-service tagging in AWS.

Use Cases

Patterns agents use AWS Resource Groups Tagging API API for, with concrete tasks.

★ Cross-service cost-allocation tagging

Finance teams use the Tagging API to roll out cost-allocation tags such as CostCenter, Project, and Owner across hundreds of resources spanning EC2, RDS, S3, and Lambda from a single integration. TagResources accepts a batch of ARNs and a tag map, so a one-time backfill takes minutes instead of writing per-service automation. The same API then drives ongoing audits via GetResources and GetComplianceSummary.

Call TagResources with a batch of 50 ARNs spanning EC2 and RDS, applying CostCenter=marketing-2026 and Owner=platform-team to each.

Tag-compliance auditing

Governance and FinOps teams use StartReportCreation and GetComplianceSummary to identify resources missing required tags or violating an AWS Config tag policy. The report is written to S3 and lists each non-compliant ARN along with which required keys are missing. Agents can then call TagResources to remediate without leaving the same API.

Trigger StartReportCreation against the configured S3 bucket, poll DescribeReportCreation until SUCCEEDED, then parse the report to find resources missing the CostCenter tag.

Tag-driven resource discovery

Platform teams use GetResources with TagFilters to find every resource matching a tag query across services in one call — for example, all production-tier resources owned by a specific team. This replaces ad-hoc per-service calls (DescribeInstances, ListBuckets, ListFunctions) with a single paginated request, which keeps inventory tools simple and consistent.

Call GetResources with TagFilters [{Key: 'Environment', Values: ['prod']}, {Key: 'Team', Values: ['payments']}] and paginate through all results.

Agent-driven tag remediation through Jentic

AI agents that detect drift in cost-allocation tags use Jentic to call TagResources and UntagResources without holding raw AWS access keys. Jentic stores the agent's AWS credentials in MAXsystem, signs each request with SigV4, and returns the structured response — letting the agent confirm each tag change before moving to the next batch.

Search Jentic for 'apply tags to AWS resources', load the TagResources schema, and execute it against 25 ARNs identified as non-compliant in a prior compliance summary.

Key Endpoints

8 endpoints — jentic publishes the only available openapi specification for aws resource groups tagging api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.TagResources

Apply tags to a batch of resource ARNs

POST

/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.UntagResources

Remove tags from a batch of resource ARNs

POST

/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.GetResources

List resources matching tag filters

POST

/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.GetTagKeys

List all tag keys used in the account

POST

/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.GetTagValues

List all values for a given tag key

POST

/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.GetComplianceSummary

Retrieve tag-policy compliance metrics

POST

/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.StartReportCreation

Generate a compliance report to S3

POST

/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.DescribeReportCreation

Poll the status of an in-flight compliance report

POST

/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.TagResources

Apply tags to a batch of resource ARNs

POST

/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.UntagResources

Remove tags from a batch of resource ARNs

POST

/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.GetResources

List resources matching tag filters

POST

/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.GetTagKeys

List all tag keys used in the account

POST

/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.GetTagValues

List all values for a given tag key

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

AWS credentials are stored encrypted in the Jentic vault (MAXsystem). Each Tagging API call is signed with SigV4 server-side; the agent only receives a scoped, short-lived authorisation, so raw access keys never enter the agent's context.

Intent-based discovery

Agents search by intent (e.g., 'apply tags to AWS resources') and Jentic returns the matching Tagging API operations with their input schemas, so the agent calls TagResources or GetResources without browsing AWS docs.

Time to first call

Direct integration: 1-2 days for SigV4 signing, batch handling, and ThrottlingException backoff. Through Jentic: under 30 minutes — search, load schema, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Complementary

AWS Resource Groups

Define logical groupings of resources by tag query — the Tagging API then operates on the members

Use Resource Groups to define and persist a target set; use the Tagging API as the operational layer that applies, removes, or audits tags on those ARNs.

Complementary

AWS Cost Explorer

Analyse cost data sliced by the tags you apply with the Tagging API

Use Cost Explorer when you need to query cost and usage by tag; use the Tagging API to ensure those tags exist and stay consistent.

Alternative

Amazon EC2

EC2's CreateTags is the per-service tag operation for instances and volumes

Choose EC2 CreateTags when you only need to tag EC2 resources and want the per-service operation; choose the Tagging API when you need cross-service tagging in one call.

FAQs

Specific to using AWS Resource Groups Tagging API API through Jentic.

Why is there no official OpenAPI spec for AWS Resource Groups Tagging API?

AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call AWS Resource Groups Tagging API via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the AWS Resource Groups Tagging API use?

It uses AWS Signature Version 4 HMAC signing with an access key ID, secret access key, and optional session token. Through Jentic, your AWS credentials sit in the MAXsystem vault and Jentic signs each request server-side, so the agent never sees raw secrets.

Can I tag resources across multiple AWS regions in one call to the AWS Resource Groups Tagging API?

No — the Tagging API is regional. TagResources only operates on ARNs in the region you call. To tag a multi-region fleet, iterate per region: list ARNs in each region with GetResources, then call TagResources against the regional endpoint.

What are the rate limits for the AWS Resource Groups Tagging API?

AWS does not publish a fixed RPS in the spec; standard AWS API throttling applies and the service returns ThrottlingException on overage. TagResources also has a per-call cap (typically 20 ARNs per request), so high-volume agents should batch and back off with jitter.

How do I generate a tag-compliance report with the AWS Resource Groups Tagging API through Jentic?

Search Jentic for 'generate AWS tag compliance report', load StartReportCreation, and call POST /#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.StartReportCreation with the destination S3 bucket. Then poll DescribeReportCreation until status is SUCCEEDED and read the report from S3. Install with pip install jentic.

Can the AWS Resource Groups Tagging API tag every AWS service?

It supports 100+ resource types but not every service is covered — for example, some IAM resources and a small set of legacy services still require their own tag operations. Check the AWS docs for the supported resource list before assuming a service is tag-API addressable, and fall back to the per-service tag operation when not.