From de992fe792c374cc727effdb66c09801370a42b7 Mon Sep 17 00:00:00 2001
From: Alex English <alex.english80@gmail.com>
Date: Thu, 27 Aug 2026 18:26:43 -0700
Subject: [PATCH] Document the aws provider default_tags block

---
 terraform/backend.tf | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/terraform/backend.tf b/terraform/backend.tf
index c8102b2..2e2d9c6 100644
--- a/terraform/backend.tf
+++ b/terraform/backend.tf
@@ -3,6 +3,11 @@ terraform {
   }
 }
 
+// Region and profile come from the ambient environment at run time, not from here.
+// managed-by is deliberately distinct from incubator's "terraform-incubator": account
+// 035866691871 is written to by two Terraform states, and the tag says which one owns
+// a resource. IAM groups and policy attachments cannot be tagged by any AWS API, so
+// they carry no managed-by regardless of this block.
 provider "aws" {
   default_tags {
     tags = {