BlueArchLifecycle ownership
TTL, owner, environment, service, and exception tags become workflow triggers.
React route · clean URL →
Flagship product · lifecycle governanceFor SREs & solution architects
Stop being
your own
cloud janitor.
Tag Manager turns AWS tags into a workflow engine. Apply and audit tags across accounts, then attach business processes — TTL, ownership, approval, archival — directly to them. The custodial work that used to eat your sprints just runs itself.
How it works
Built for terminal speed and board-level context.
The CLI workflow, dashboard evidence, and governance data stay aligned so every recommendation has an owner and a next step.
Cost cleanup
Find idle, orphaned, oversized, or expired resources before they become spend drift.
React route · clean URL →
CLI plus web
Platform teams can enforce policies from terminal workflows and review evidence in the dashboard.
React route · clean URL →
94%
Resources with known owner after rollout
12% of AWS bill
Recoverable unmanaged spend
0
Manual cleanup spreadsheets required
48 hr
Default review window before expiration
Install · macOS Apple Silicon · Tags v0.12.5 · Core v0.2.8
Install. Launch. Replace the tag spreadsheet.
brew list --formula bluearch-aws-core >/dev/null 2>&1 || brew install bluearchio/tap/bluearch-aws-corebrew install bluearchio/tap/bluearch-aws-tagsLaunch. Core serves the local Tags dashboard on port 8096.Operate. Discover resources, choose regions, and manage tag workflows in the browser.Review. Ownership, lifecycle, and policy coverage stay together in the dashboard.
Install Core if missing
brew list --formula bluearch-aws-core >/dev/null 2>&1 || brew install bluearchio/tap/bluearch-aws-coreTypical: 1–3 minThis check does nothing when the Homebrew Core formula is already installed. Otherwise, the fully qualified install trusts only bluearch-aws-core.
Install Tags
brew install bluearchio/tap/bluearch-aws-tagsTypical: 1–3 minInstalls the signed bluearch-aws-tags binary and trusts only that formula, not the whole tap.
Authenticate AWS
aws sso login --profile my-profileexport AWS_PROFILE=my-profileTypical: 1–2 minKeep using your existing AWS SSO profile; validation and discovery can run read-only.
Launch the live server
bluearch-aws-core start --daemonbluearch-aws-core statusTypical: under 30 secCore starts its API on 127.0.0.1:8094 and the installed Tags dashboard on http://127.0.0.1:8096.
Open the Tags dashboard
Open Tags dashboard Ready when Core is healthyUse Resources to run discovery, review tag coverage, and continue into lifecycle and policy workflows without returning to the terminal.
Installing on Linux x86_64?
The release installer verifies the GitHub assets and installs Core automatically when it is missing. Add the install directory to PATH for this shell.
curl -fsSL https://github.com/bluearchio/bluearch-aws-tags/releases/latest/download/install-linux.sh | bashexport PATH="$HOME/.local/bin:$PATH"Existing tap says a formula is untrusted?
Trust only Core and Tags, then retry. Whole-tap trust and HOMEBREW_NO_REQUIRE_TAP_TRUST are not required.
brew trust --formula bluearchio/tap/bluearch-aws-corebrew trust --formula bluearchio/tap/bluearch-aws-tagsbrew install bluearchio/tap/bluearch-aws-tagsFAQ
Common questions.
Do we need perfect tags first?+
No. Tag Manager is built to discover gaps, propose owners, and create the policy trail.
Can it run read-only?+
Yes. Discovery can run read-only, then write workflows can be enabled only where your team approves them.
Can it pair with BlueArch CLI?+
Yes. Tag Manager handles lifecycle governance while BlueArch CLI prioritizes risk and operations.
Want help wiring this into your AWS operating model?
Book a short review and we will map the first workflow from scan to action.