Tags that Are Required, Validated and Tracked
A tag default with is_required = false applies a value silently and lets anyone overwrite or blank it; required is the only enforcement OCI tagging has, and a required free-text tag enforces presence and nothing about meaning. Every default is required and validated against an allowed list unless accepted otherwise; the ten cost-tracking slots are counted; retirement is the only delete that works.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-14 · how we verify
Use it from the registry
terraform · opentofumodule "tag_namespace" {
source = "www.iac-bazaar.com/iac-bazaar/oci-tag-namespace/oci"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
oci-tag-namespace
A tag namespace whose tags are required, validated, and tracked. Works with
Terraform and OpenTofu (>= 1.6), oci provider >= 8.0, < 9.0.
A tag default that is not required is a suggestion. Defaults apply a
value to every new resource in a compartment; with is_required = false the
value is filled in silently and anyone can replace or blank it. With
is_required = true the console and the API refuse to create a resource
without the tag - the only enforcement OCI tagging has. Every default here
is required unless accept_suggested_defaults.
A required free-text tag enforces presence, not meaning. A required
default on a tag with no allowed_values needs accept_free_text_required.
Cost tracking is a flag, and there are ten per tenancy. Spend them on the tags finance filters by.
Retiring is the only delete that works once a tag is in use.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
oci-budget
The budget and its alert rules are separate resources, and recipients on a rule is optional: a budget created with no rule, or a rule with no address, computes actual and forecast spend and tells nobody but the console list. Refuses a budget no rule of which reaches an address, and insists on a FORECAST rule so the first alert is a warning rather than a receipt.
oci-iam-foundation
Tenancy landing-zone core: compartment hierarchy, groups, dynamic groups, policy statements and tag namespaces from a single map.