diff --git a/terraform/backend.tf b/terraform/backend.tf
index c8102b2..2e2d9c6 100644
--- a/terraform/backend.tf
+++ b/terraform/backend.tf
@@ -3,6 +3,11 @@ terraform {
   }
 }
 
+// Region and profile come from the ambient environment at run time, not from here.
+// managed-by is deliberately distinct from incubator's "terraform-incubator": account
+// 035866691871 is written to by two Terraform states, and the tag says which one owns
+// a resource. IAM groups and policy attachments cannot be tagged by any AWS API, so
+// they carry no managed-by regardless of this block.
 provider "aws" {
   default_tags {
     tags = {