add tags to s3 backend files

[ArtyMaury]

closes #30054

[hashicorp-cla]

All committers have signed the CLA.

[crw]

Thanks for this submission. Although I cannot commit to having this PR reviewed at this time, we acknowledge your contribution and appreciate it! I've notified the appropriate team internally, as well. Thanks again for the submission!

[Lutherwaves]

Hey, we have also recently identified some potential added value in this feature.

@crw do we have any updates on this?

Thank you for the contribution, @ArtyMaury!

[suddrey]

The updates provided by @ArtyMaury would definitely help solve a problem we are facing.

Is there any update on this?

[crw]

No updates on my end, the AWS provider team would need to review.

[lorengordon]

@crw Does the AWS provider team monitor this repo? How would we get their attention on it?

[justinretzolk]

Hey @lorengordon 👋 I'm the community manager for the AWS provider. Someone from the team has assigned this to themselves for review, however, they're currently focused on finishing up the last bit of work needed for the next major AWS provider release. Unfortunately I can't provide an ETA on when this will be reviewed/merged due to the potential of shifting priorities. We prioritize by count of 👍 reactions and a few other things (more information on our prioritization guide if you're interested).

[michelefacco]

Hello, any update on this? It looks like a very useful feature!

[TechIsCool]

@justinretzolk Curious if you have any update on this, we just started looking at how to manage what we consider validation states that are short lived but exist in different paths. We wanted to lifecycle them using AWS tags but it seems we can't assign tags to a backend in terraform directly.

[chrisahl]

@justinretzolk Would be interested in using this feature. Any plans to get this in soon? Been sitting here a long time. Thanks.

[Lutherwaves]

I'm also looking to see if we can get this out there - very useful feature.

[bschaatsbergen]

It might be worth considering renaming this argument to object_tags or bring it under an object block to clearly indicate where the tags are being applied. Have you thought about this already?

Added, I think that a more Terraform-native approach is cleaner than a string of tags, in a way similar to the tags block used for AWS provider-managed resources:

object_tags = {
  Environment = "Test"
}

See the existing assume_role block schema, already featuring tags. I would imagine that this simply uses cty.Map(cty.String).

[jdesulme]

@bschaatsbergen @ArtyMaury We have a strong use case for this feature as well. Our organization uses object-level tags for permissions, and currently, we rely on custom workarounds to tag objects after creation. Having this capability during creation or update (as supported by this PR) would significantly improve our workflows and reduce complexity.
Could you share any updates on the review status or expected timeline? This would be a great quality-of-life enhancement for many users.

[iain-raidiam]

Given support for ABAC within S3 buckets now this also adds to this feature - https://aws.amazon.com/blogs/aws/introducing-attribute-based-access-control-for-amazon-s3-general-purpose-buckets/