Tag VPC Subnets in AWS CDK with Tags.of

To tag subnets created by your AWS CDK stack, iterate vpc.publicSubnets, vpc.privateSubnets, or vpc.isolatedSubnets and call Tags.of(subnet).add(). The collections are plural and can contain one subnet per configured Availability Zone.

Complete TypeScript example

Use CDK v2 and instantiate SubnetTagsStack from your app. This example creates public and isolated groups across up to two Availability Zones, with no NAT gateways:

COPY
import { Stack, StackProps, Tags } from "aws-cdk-lib";
import * as ec2 from "aws-cdk-lib/aws-ec2";
import { Construct } from "constructs";

export class SubnetTagsStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);
    const vpc = new ec2.Vpc(this, "Network", {
      ipAddresses: ec2.IpAddresses.cidr("10.0.0.0/16"),
      maxAzs: 2,
      natGateways: 0,
      subnetConfiguration: [
        { name: "web", subnetType: ec2.SubnetType.PUBLIC, cidrMask: 24 },
        { name: "data", subnetType: ec2.SubnetType.PRIVATE_ISOLATED, cidrMask: 24 },
      ],
    });
    for (const subnet of vpc.publicSubnets) {
      Tags.of(subnet).add("Environment", "dev");
      Tags.of(subnet).add("Purpose", "web");
    }
    for (const subnet of vpc.isolatedSubnets) {
      Tags.of(subnet).add("Environment", "dev");
      Tags.of(subnet).add("Purpose", "data");
    }
  }
}

Tags.of(vpc).add() would also propagate a tag to taggable descendants. Apply group-specific tags to the selected subnets when the values differ. AWS documents tag propagation and priorities in Tags and the AWS CDK.

A subnet configuration creates a group across Availability Zones, not necessarily one subnet total. Tags describe resources; they do not change routes, grant access, or move workloads.

Inspect tags before deployment

COPY
npx tsc --noEmit
npx aws-cdk synth
npx aws-cdk diff

Inspect each AWS::EC2::Subnet resource's Tags in the synthesized template. Check both the tag values and the number of subnets. This example targets CDK 2.272.0 and constructs 10.5.0 and has not been deployed to AWS for this revision.

After deploying in a sandbox, an authenticated CLI query can inspect a tag:

COPY
aws ec2 describe-subnets \
  --filters 'Name=tag:Purpose,Values=data' \
  --query 'Subnets[].{Id:SubnetId,Tags:Tags}'

Other VPCs may use the same tag; add a VPC-ID filter when you need to identify only this stack's network.

Imported subnet limitation

Vpc.fromLookup() references an existing network. It does not transfer its subnets into this stack, so applying a CDK tag aspect to a reference is not a way to update existing subnet tags. Change tags through the network's owner or an explicitly managed operation.

Use subnet selection to choose workload placement, and VPC import to reuse a network. For a temporary network, review cdk destroy and verify that no added workloads prevent deletion before cleaning up.