resource tag contract audit derived

{
  "input": {
    "body": {
      "contract": {
        "required": [
          "owner",
          "environment",
          "cost_centre"
        ],
        "case_sensitive": true,
        "value_patterns": {
          "cost_centre": "CC-[0-9][0-9][0-9][0-9]"
        },
        "permitted_values": {
          "environment": [
            "development",
            "staging",
            "production"
          ]
        },
        "forbid_unknown_keys": false
      },
      "resources": [
        {
          "id": "arn:aws:s3:::exports",
          "tags": {
            "owner": "data",
            "cost_centre": "CC-1001",
            "environment": "production"
          },
          "type": "aws_s3_bucket"
        },
        {
          "id": "arn:aws:s3:::staging-exports",
          "tags": {
            "Owner": "data",
            "cost_centre": "CC1001",
            "environment": "stage"
          },
          "type": "aws_s3_bucket"
        },
        {
          "id": "arn:aws:ec2:us-east-1:123456789012:instance/i-1",
          "tags": {
            "owner": "  ",
            "cost_centre": "CC-1002",
            "environment": "production"
          },
          "type": "aws_instance"
        },
        {
          "id": "arn:aws:ec2:us-east-1:123456789012:instance/i-2",
          "type": "aws_instance"
        }
      ]
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "limits": {
        "maxFindings": 500,
        "maxJsonBytes": 1048576,
        "maxResources": 5000,
        "maxTextBytes": 262144,
        "maxEnvEntries": 2000,
        "maxPatchOperations": 1000
      },
      "passed": false,
      "checked": {
        "required": 3,
        "case_sensitive": true,
        "value_patterns": 1,
        "permitted_values": 1,
        "unknown_keys_forbidden": false
      },
      "complete": false,
      "findings": [
        {
          "tag": "owner",
          "code": "REQUIRED_TAG_ABSENT",
          "detail": "arn:aws:s3:::staging-exports is missing the required tag owner.",
          "resource": "arn:aws:s3:::staging-exports"
        },
        {
          "tag": "environment",
          "code": "TAG_VALUE_NOT_PERMITTED",
          "detail": "arn:aws:s3:::staging-exports sets environment to \"stage\" and the contract permits development, staging, production.",
          "resource": "arn:aws:s3:::staging-exports"
        },
        {
          "tag": "cost_centre",
          "code": "TAG_VALUE_DOES_NOT_MATCH_PATTERN",
          "detail": "arn:aws:s3:::staging-exports sets cost_centre to a value the declared pattern does not accept.",
          "resource": "arn:aws:s3:::staging-exports"
        }
      ],
      "tag_keys": [
        {
          "key": "environment",
          "resources": 3
        },
        {
          "key": "cost_centre",
          "resources": 3
        },
        {
          "key": "owner",
          "resources": 2
        }
      ],
      "resources": [
        {
          "id": "arn:aws:s3:::exports",
          "type": "aws_s3_bucket",
          "tag_count": 3
        },
        {
          "id": "arn:aws:s3:::staging-exports",
          "type": "aws_s3_bucket",
          "tag_count": 3
        },
        {
          "id": "arn:aws:ec2:us-east-1:123456789012:instance/i-1",
          "type": "aws_instance",
          "tag_count": 3
        }
      ],
      "conformant": false,
      "request_id": "example-request",
      "service_id": "resource_tag_contract_audit",
      "assumptions": [
        "Tag keys differing only in case are reported, because cloud APIs treat them as different keys and a cost or ownership report built on them splits silently across the variants.",
        "A caller-supplied value pattern is restricted to character classes, anchors and simple quantifiers. Groups, alternation and escapes are refused rather than compiled, so matching is cheap by constructi...",
        "An empty tag value is reported: it satisfies a presence check and carries no information, which is how a tagging mandate comes to be met on paper."
      ],
      "limitations": [
        "The inventory supplied against the contract supplied. Nothing is fetched, so a resource absent from the inventory is not assessed and is not assumed compliant.",
        "conformant is true only when every rule that ran found nothing and nothing was left unchecked."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [
        "VALUE_NOT_CHECKED: arn:aws:ec2:us-east-1:123456789012:instance/i-2 does not carry environment, so its permitted values were not checked.",
        "PATTERN_NOT_CHECKED: arn:aws:ec2:us-east-1:123456789012:instance/i-2 does not carry cost_centre, so its value pattern was not checked."
      ],
      "finding_count": 9,
      "resource_count": 4,
      "service_version": "1.0.0",
      "findings_by_code": {
        "TAG_VALUE_EMPTY": 1,
        "REQUIRED_TAG_ABSENT": 4,
        "TAG_VALUE_NOT_PERMITTED": 1,
        "TAG_KEY_USED_IN_SEVERAL_CASES": 1,
        "TAG_VALUE_HAS_SURROUNDING_SPACE": 1,
        "TAG_VALUE_DOES_NOT_MATCH_PATTERN": 1
      },
      "distinct_tag_key_count": 4
    }
  }
}