canonical: https://jentic.com/apis/amazonaws.com/aws-resource-groups-tagging-api

# AWS Resource Groups Tagging API

Jentic publishes the only available OpenAPI specification for AWS Resource Groups Tagging API, keeping it validated and agent-ready. The Tagging API provides a unified interface for applying, removing, and querying tags across more than 100 supported AWS resource types - EC2, RDS, S3, Lambda, ECS, and more - without calling each service's individual tag operation. It also exposes tag-compliance reporting, so finance and platform teams can audit which resources are missing required cost-allocation tags. This is the operational backbone of cross-service tagging in AWS.

## For AI agents

Apply, remove, and audit tags across 100+ AWS resource types from one API and generate organisation-wide tag-compliance reports.

## Scope

Does not provision or delete the underlying AWS resources, does not work cross-region in a single call, and does not cover every AWS service - use for cross-service tag application, removal, and compliance reporting only.

## Capabilities

- Apply tags to many AWS resources at once with TagResources, regardless of underlying service
- Remove tags in bulk from arbitrary AWS ARNs with UntagResources
- Search resources by tag key and value across services using GetResources with filtering and pagination
- Enumerate the distinct tag keys and values used in an account via GetTagKeys and GetTagValues
- Generate organisation-wide tag-compliance reports with StartReportCreation
- Retrieve account-level tag-compliance summaries to find untagged or non-compliant resources

## Use cases

### Cross-service cost-allocation tagging

Finance teams use the Tagging API to roll out cost-allocation tags such as CostCenter, Project, and Owner across hundreds of resources spanning EC2, RDS, S3, and Lambda from a single integration. TagResources accepts a batch of ARNs and a tag map, so a one-time backfill takes minutes instead of writing per-service automation. The same API then drives ongoing audits via GetResources and GetComplianceSummary.

Example prompt: Call TagResources with a batch of 50 ARNs spanning EC2 and RDS, applying CostCenter=marketing-2026 and Owner=platform-team to each.

### Tag-compliance auditing

Governance and FinOps teams use StartReportCreation and GetComplianceSummary to identify resources missing required tags or violating an AWS Config tag policy. The report is written to S3 and lists each non-compliant ARN along with which required keys are missing. Agents can then call TagResources to remediate without leaving the same API.

Example prompt: Trigger StartReportCreation against the configured S3 bucket, poll DescribeReportCreation until SUCCEEDED, then parse the report to find resources missing the CostCenter tag.

### Tag-driven resource discovery

Platform teams use GetResources with TagFilters to find every resource matching a tag query across services in one call - for example, all production-tier resources owned by a specific team. This replaces ad-hoc per-service calls (DescribeInstances, ListBuckets, ListFunctions) with a single paginated request, which keeps inventory tools simple and consistent.

Example prompt: Call GetResources with TagFilters [{Key: 'Environment', Values: ['prod']}, {Key: 'Team', Values: ['payments']}] and paginate through all results.

### Agent-driven tag remediation through Jentic

AI agents that detect drift in cost-allocation tags use Jentic to call TagResources and UntagResources without holding raw AWS access keys. Jentic stores the agent's AWS credentials in your Jentic One instance, signs each request with SigV4, and returns the structured response - letting the agent confirm each tag change before moving to the next batch.

Example prompt: Search Jentic for 'apply tags to AWS resources', load the TagResources schema, and execute it against 25 ARNs identified as non-compliant in a prior compliance summary.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.TagResources | Apply tags to a batch of resource ARNs |
| POST | /#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.UntagResources | Remove tags from a batch of resource ARNs |
| POST | /#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.GetResources | List resources matching tag filters |
| POST | /#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.GetTagKeys | List all tag keys used in the account |
| POST | /#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.GetTagValues | List all values for a given tag key |
| POST | /#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.GetComplianceSummary | Retrieve tag-policy compliance metrics |
| POST | /#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.StartReportCreation | Generate a compliance report to S3 |
| POST | /#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.DescribeReportCreation | Poll the status of an in-flight compliance report |

## Key resources

- **Resources** — ARN-addressed AWS resources targetable for tag operations
- **Tags** — Key-value pairs applied to or removed from resources
- **ComplianceReport** — Account-wide tag-compliance report generated to S3
- **ComplianceSummary** — Aggregated compliance metrics by region, service, and policy

## Why Jentic

- **Setup:** Wiring the Resource Groups Tagging API by hand means computing SigV4 HMAC signatures, setting the X-Amz-Target header per action, routing to the regional tagging host, batching resource ARNs, and backing off on throttling yourself. Through Jentic you install once, import AWS Resource Groups Tagging API from the API Directory, store your AWS access keys once, and your agent calls it with signing and targeting handled per request.
- **Permission scoping:** Resource ARNs and tag keys travel in the request body rather than the URL path, so you limit the agent to the operations it needs, such as GetResources and GetComplianceSummary for read and reporting. Mutating operations like TagResources and UntagResources are not included unless you add them.
- **Credential handling:** Your AWS access keys are stored once, encrypted, by your own Jentic One instance and used to produce a SigV4 signature per request. The raw secret access key never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'report on tags across AWS resources', and Jentic returns GetResources with its input schema for TagFilters and ResourceTypeFilters so the agent calls the right endpoint directly.

## Related APIs

- **AWS Resource Groups** — Define logical groupings of resources by tag query - the Tagging API then operates on the members
- **AWS Cost Explorer** — Analyse cost data sliced by the tags you apply with the Tagging API
- **Amazon EC2** — EC2's CreateTags is the per-service tag operation for instances and volumes

## FAQ

### Why is there no official OpenAPI spec for AWS Resource Groups Tagging API?

AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call AWS Resource Groups Tagging API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the AWS Resource Groups Tagging API use?

It uses AWS Signature Version 4 HMAC signing with an access key ID, secret access key, and optional session token. Through Jentic, your AWS credentials sit in your Jentic One instance and Jentic signs each request server-side, so the agent never sees raw secrets.

### Can I tag resources across multiple AWS regions in one call to the AWS Resource Groups Tagging API?

No - the Tagging API is regional. TagResources only operates on ARNs in the region you call. To tag a multi-region fleet, iterate per region: list ARNs in each region with GetResources, then call TagResources against the regional endpoint.

### What are the rate limits for the AWS Resource Groups Tagging API?

AWS does not publish a fixed RPS in the spec; standard AWS API throttling applies and the service returns ThrottlingException on overage. TagResources also has a per-call cap (typically 20 ARNs per request), so high-volume agents should batch and back off with jitter.

### How do I generate a tag-compliance report with the AWS Resource Groups Tagging API through Jentic?

Search Jentic for 'generate AWS tag compliance report', load StartReportCreation, and call POST /#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.StartReportCreation with the destination S3 bucket. Then poll DescribeReportCreation until status is SUCCEEDED and read the report from S3. Install with pip install jentic.

### Can the AWS Resource Groups Tagging API tag every AWS service?

It supports 100+ resource types but not every service is covered - for example, some IAM resources and a small set of legacy services still require their own tag operations. Check the AWS docs for the supported resource list before assuming a service is tag-API addressable, and fall back to the per-service tag operation when not.

### Can I limit what my agent is allowed to do with the AWS Resource Groups Tagging API?

Yes. Because Jentic One is self-hosted, your own rules decide which operations and credentials the agent may use, so you can grant only the endpoints it needs, such as GetResources and GetComplianceSummary for read and reporting. Mutating operations like TagResources and UntagResources are not available to the agent unless you add them. Resource ARNs and tag keys travel in the request body rather than the URL path, so scoping is done per operation rather than by parsing paths.