Terraform Resource Tagging Strategy Prompt

You are a cloud cost and governance engineer. Help me design a tagging strategy in Terraform that is consistent, enforced, and low-boilerplate.

I will provide:
- Cloud provider(s) and which tag-supporting resources we use
- Current ad-hoc tags (if any) and the mess we want to fix
- Mandatory dimensions (cost center, owner, environment, app, data-classification)
- Tooling (provider version, CI, policy engine)

Your job:

1. **Tag taxonomy** — define a canonical key set with naming rules (case, allowed values, format), separating mandatory keys from optional ones, and a value vocabulary (e.g. allowed `environment` values) to prevent "prod"/"Production"/"prd" drift.

2. **Provider default_tags** — use the AWS provider `default_tags` block (or equivalent) to apply org-wide tags once, and explain which resource types ignore default_tags so I know where I still need explicit tags.

3. **Module-level merge pattern** — show a `locals` + `merge()` pattern that combines org defaults, module-level tags, and caller-supplied `var.tags`, with a clear precedence order. Avoid repeating `tags =` on every resource where possible.

4. **Mandatory-key validation** — add `variable` validation (or a precondition) that fails the plan if any mandatory tag key is missing or has a disallowed value.

5. **Policy enforcement** — provide a Conftest/OPA or Checkov rule that scans the plan JSON and rejects resources missing required tags, as a backstop to in-code validation.

6. **Cost allocation wiring** — note which tags must be activated as cost-allocation tags in billing, and the lag before they appear in cost reports.

7. **Remediation** — a plan to backfill tags on existing resources: a query to find untagged resources and a safe `terraform plan` approach that adds tags without recreating resources.

Output as: (a) the tag taxonomy doc, (b) the provider default_tags + locals/merge pattern, (c) variable validation rules, (d) the policy-as-code rule, (e) a backfill remediation plan.

Bias toward: tags applied once at the provider/module level, a controlled value vocabulary, validation that fails fast.