diff --git a/docs/data-sources/account.md b/docs/data-sources/account.md
index 5d8e8b9c..cd095a86 100644
--- a/docs/data-sources/account.md
+++ b/docs/data-sources/account.md
@@ -16,6 +16,10 @@ Accounts are users that have access to strongDM. There are two types of accounts
 data "sdm_account" "user-queries" {
     type = "user"
     email = "*@strongdm.com"
+    tags = {
+        region = "us-west"
+        env = "dev"
+    }    
 }
 ```
 ## Argument Reference
@@ -27,6 +31,7 @@ The following arguments are supported by a Accounts data source:
 * `last_name` - (Optional) The User's last name.
 * `name` - (Optional) Unique human-readable name of the Service.
 * `suspended` - (Optional) The Service's suspended state.
+* `tags` - (Optional) Tags is a map of key, value pairs.
 ## Attribute Reference
 In addition to provided arguments above, the following attributes are returned by a Accounts data source:
 * `id` - a generated id representing this request, unrelated to input id and sdm_account ids.
diff --git a/docs/data-sources/node.md b/docs/data-sources/node.md
index f45fa0c2..45415818 100644
--- a/docs/data-sources/node.md
+++ b/docs/data-sources/node.md
@@ -16,6 +16,10 @@ Nodes make up the strongDM network, and allow your users to connect securely to
 ```hcl
 data "sdm_node" "gateway_query" {
     type = "gateway"
+    tags = {
+        region = "us-west"
+        env = "dev"
+    }    
 }
 ```
 ## Argument Reference
@@ -28,6 +32,7 @@ The following arguments are supported by a Nodes data source:
 * `id` - (Optional) Unique identifier of the Gateway.
 * `listen_address` - (Optional) The public hostname/port tuple at which the gateway will be accessible to clients.
 * `name` - (Optional) Unique human-readable name of the Gateway. Node names must include only letters, numbers, and hyphens (no spaces, underscores, or other special characters). Generated if not provided on create.
+* `tags` - (Optional) Tags is a map of key, value pairs.
 ## Attribute Reference
 In addition to provided arguments above, the following attributes are returned by a Nodes data source:
 * `id` - a generated id representing this request, unrelated to input id and sdm_node ids.
diff --git a/docs/data-sources/resource.md b/docs/data-sources/resource.md
index 3152336d..84566042 100644
--- a/docs/data-sources/resource.md
+++ b/docs/data-sources/resource.md
@@ -14,6 +14,10 @@ A Resource is a database or server for which strongDM manages access.
 data "sdm_resource" "aurora_datasources" {
     name = "us-west*"
     type = "aurora_mysql"
+    tags = {
+        region = "us-west"
+        env = "dev"
+    }    
 }
 ```
 ## Argument Reference
diff --git a/docs/data-sources/role.md b/docs/data-sources/role.md
index e2fb58c6..03205fbc 100644
--- a/docs/data-sources/role.md
+++ b/docs/data-sources/role.md
@@ -13,6 +13,10 @@ A Role is a collection of access grants, and typically corresponds to a team, Ac
 ```hcl
 data "sdm_role" "composite_role_query" {
     composite = true
+    tags = {
+        region = "us-west"
+        env = "dev"
+    }    
 }
 ```
 ## Argument Reference
@@ -21,6 +25,7 @@ The following arguments are supported by a Roles data source:
 * `name` - (Optional) Unique human-readable name of the Role.
 * `access_rules` - (Optional) AccessRules JSON encoded access rules data.
 * `composite` - (Optional) True if the Role is a composite role.
+* `tags` - (Optional) Tags is a map of key, value pairs.
 ## Attribute Reference
 In addition to provided arguments above, the following attributes are returned by a Roles data source:
 * `id` - a generated id representing this request, unrelated to input id and sdm_role ids.
diff --git a/docs/data-sources/secret_store.md b/docs/data-sources/secret_store.md
index 7710544c..db1cfde5 100644
--- a/docs/data-sources/secret_store.md
+++ b/docs/data-sources/secret_store.md
@@ -19,6 +19,7 @@ The following arguments are supported by a SecretStores data source:
 * `name` - (Optional) Unique human-readable name of the SecretStore.
 * `region` - (Optional) 
 * `server_address` - (Optional) 
+* `tags` - (Optional) Tags is a map of key, value pairs.
 ## Attribute Reference
 In addition to provided arguments above, the following attributes are returned by a SecretStores data source:
 * `id` - a generated id representing this request, unrelated to input id and sdm_secret_store ids.
diff --git a/docs/resources/account.md b/docs/resources/account.md
index 00c66d5c..e717c093 100644
--- a/docs/resources/account.md
+++ b/docs/resources/account.md
@@ -18,12 +18,20 @@ resource "sdm_account" "test-user" {
         first_name = "al"
         last_name = "bob"
         email = "albob@strongdm.com"
+        tags = {
+            region = "us-west"
+            env = "dev"
+        }    
     }
 }
 
 resource "sdm_account" "test-service" {
     service {
         name = "test-service"
+        tags = {
+            region = "us-west"
+            env = "dev"
+        }    
     }
 }
 ```
@@ -34,9 +42,11 @@ The following arguments are supported by the Account resource:
 	* `first_name` - (Required) The User's first name.
 	* `last_name` - (Required) The User's last name.
 	* `suspended` - (Optional) The User's suspended state.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 * service:
 	* `name` - (Required) Unique human-readable name of the Service.
 	* `suspended` - (Optional) The Service's suspended state.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 ## Attribute Reference
 In addition to provided arguments above, the following attributes are returned by the Account resource:
 * `id` - A unique identifier for the Account resource.
diff --git a/docs/resources/node.md b/docs/resources/node.md
index 8f4d3a26..c5338a9d 100644
--- a/docs/resources/node.md
+++ b/docs/resources/node.md
@@ -19,12 +19,20 @@ resource "sdm_node" "gateway" {
         name = "test-gateway"
         listen_address = "165.23.40.1:21222"
         bind_address = "0.0.0.0:21222"
+        tags = {
+            region = "us-west"
+            env = "dev"
+        }    
     }
 }
 
 resource "sdm_node" "relay" {
     relay {
         name = "test-relay"
+        tags = {
+            region = "us-west"
+            env = "dev"
+        }    
     }
 }
 ```
@@ -32,6 +40,7 @@ resource "sdm_node" "relay" {
 The following arguments are supported by the Node resource:
 * relay:
 	* `name` - (Optional) Unique human-readable name of the Relay. Node names must include only letters, numbers, and hyphens (no spaces, underscores, or other special characters). Generated if not provided on create.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `gateway_filter` - (Optional) GatewayFilter can be used to restrict the peering between relays and
  gateways.
 * gateway:
@@ -39,6 +48,7 @@ The following arguments are supported by the Node resource:
 	* `listen_address` - (Required) The public hostname/port tuple at which the gateway will be accessible to clients.
 	* `bind_address` - (Optional) The hostname/port tuple which the gateway daemon will bind to.
  If not provided on create, set to "0.0.0.0:<listen_address_port>".
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `gateway_filter` - (Optional) GatewayFilter can be used to restrict the peering between relays and
  gateways.
 ## Attribute Reference
diff --git a/docs/resources/resource.md b/docs/resources/resource.md
index aa78422c..553ac528 100644
--- a/docs/resources/resource.md
+++ b/docs/resources/resource.md
@@ -16,6 +16,10 @@ resource "sdm_resource" "redis-test" {
         name = "redis-test"
         hostname = "example.com"
         port_override = 4020
+        tags = {
+            region = "us-west"
+            env = "dev"
+        }
     }
 }
 
@@ -27,6 +31,10 @@ resource "sdm_resource" "postgres-test" {
         username = "admin"
         password = "hunter2"
         port = 5432
+        tags = {
+            region = "us-west"
+            env = "dev"
+        }
     }
 }
 ```
@@ -34,6 +42,7 @@ resource "sdm_resource" "postgres-test" {
 The following arguments are supported by the Resource resource:
 * rabbitmq_amqp_091:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -47,6 +56,7 @@ The following arguments are supported by the Resource resource:
 	* `tls_required` - (Optional) 
 * amazonmq_amqp_091:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -60,6 +70,7 @@ The following arguments are supported by the Resource resource:
 	* `tls_required` - (Optional) 
 * athena:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `access_key` - (Optional) 
@@ -78,6 +89,7 @@ The following arguments are supported by the Resource resource:
 	* `secret_store_role_external_id_key` - (Optional)
 * aws:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `access_key` - (Optional) 
@@ -95,6 +107,7 @@ The following arguments are supported by the Resource resource:
 	* `secret_store_role_external_id_key` - (Optional)
 * big_query:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `private_key` - (Optional) 
@@ -105,6 +118,7 @@ The following arguments are supported by the Resource resource:
 	* `username` - (Optional) 
 * cassandra:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -118,6 +132,7 @@ The following arguments are supported by the Resource resource:
 	* `tls_required` - (Optional) 
 * db_2_i:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -131,6 +146,7 @@ The following arguments are supported by the Resource resource:
 	* `tls_required` - (Optional) 
 * db_2_luw:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -144,6 +160,7 @@ The following arguments are supported by the Resource resource:
 	* `port` - (Optional) 
 * druid:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -156,6 +173,7 @@ The following arguments are supported by the Resource resource:
 	* `port` - (Optional) 
 * dynamo_db:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `access_key` - (Optional) 
@@ -174,6 +192,7 @@ The following arguments are supported by the Resource resource:
 	* `secret_store_role_external_id_key` - (Optional)
 * amazon_es:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `region` - (Required) 
@@ -192,6 +211,7 @@ The following arguments are supported by the Resource resource:
 	* `secret_store_role_external_id_key` - (Optional)
 * elastic:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -205,6 +225,7 @@ The following arguments are supported by the Resource resource:
 	* `tls_required` - (Optional) 
 * http_basic_auth:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `url` - (Required) 
@@ -220,6 +241,7 @@ The following arguments are supported by the Resource resource:
 	* `subdomain` - (Required) 
 * http_no_auth:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `url` - (Required) 
@@ -229,6 +251,7 @@ The following arguments are supported by the Resource resource:
 	* `subdomain` - (Required) 
 * http_auth:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `url` - (Required) 
@@ -241,6 +264,7 @@ The following arguments are supported by the Resource resource:
 	* `subdomain` - (Required) 
 * kubernetes:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -257,6 +281,7 @@ The following arguments are supported by the Resource resource:
 	* `healthcheck_namespace` - The path used to check the health of your connection.  Defaults to `default`.  This field is required, and is only marked as optional for backwards compatibility.
 * kubernetes_user_impersonation:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -273,6 +298,7 @@ The following arguments are supported by the Resource resource:
 	* `healthcheck_namespace` - The path used to check the health of your connection.  Defaults to `default`.  This field is required, and is only marked as optional for backwards compatibility.
 * kubernetes_basic_auth:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -286,6 +312,7 @@ The following arguments are supported by the Resource resource:
 	* `healthcheck_namespace` - The path used to check the health of your connection.  Defaults to `default`.  This field is required, and is only marked as optional for backwards compatibility.
 * kubernetes_service_account:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -296,6 +323,7 @@ The following arguments are supported by the Resource resource:
 	* `healthcheck_namespace` - The path used to check the health of your connection.  Defaults to `default`.  This field is required, and is only marked as optional for backwards compatibility.
 * kubernetes_service_account_user_impersonation:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -306,6 +334,7 @@ The following arguments are supported by the Resource resource:
 	* `healthcheck_namespace` - The path used to check the health of your connection.  Defaults to `default`.  This field is required, and is only marked as optional for backwards compatibility.
 * amazon_eks:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `endpoint` - (Required) 
@@ -329,6 +358,7 @@ The following arguments are supported by the Resource resource:
 	* `healthcheck_namespace` - The path used to check the health of your connection.  Defaults to `default`.  This field is required, and is only marked as optional for backwards compatibility.
 * amazon_eks_user_impersonation:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `endpoint` - (Required) 
@@ -352,6 +382,7 @@ The following arguments are supported by the Resource resource:
 	* `healthcheck_namespace` - The path used to check the health of your connection.  Defaults to `default`.  This field is required, and is only marked as optional for backwards compatibility.
 * google_gke:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `endpoint` - (Required) 
@@ -364,6 +395,7 @@ The following arguments are supported by the Resource resource:
 	* `healthcheck_namespace` - The path used to check the health of your connection.  Defaults to `default`.  This field is required, and is only marked as optional for backwards compatibility.
 * google_gke_user_impersonation:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `endpoint` - (Required) 
@@ -376,6 +408,7 @@ The following arguments are supported by the Resource resource:
 	* `healthcheck_namespace` - The path used to check the health of your connection.  Defaults to `default`.  This field is required, and is only marked as optional for backwards compatibility.
 * aks:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -392,6 +425,7 @@ The following arguments are supported by the Resource resource:
 	* `healthcheck_namespace` - The path used to check the health of your connection.  Defaults to `default`.  This field is required, and is only marked as optional for backwards compatibility.
 * aks_user_impersonation:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -408,6 +442,7 @@ The following arguments are supported by the Resource resource:
 	* `healthcheck_namespace` - The path used to check the health of your connection.  Defaults to `default`.  This field is required, and is only marked as optional for backwards compatibility.
 * aks_basic_auth:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -421,6 +456,7 @@ The following arguments are supported by the Resource resource:
 	* `healthcheck_namespace` - The path used to check the health of your connection.  Defaults to `default`.  This field is required, and is only marked as optional for backwards compatibility.
 * aks_service_account:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -431,6 +467,7 @@ The following arguments are supported by the Resource resource:
 	* `healthcheck_namespace` - The path used to check the health of your connection.  Defaults to `default`.  This field is required, and is only marked as optional for backwards compatibility.
 * aks_service_account_user_impersonation:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -441,12 +478,14 @@ The following arguments are supported by the Resource resource:
 	* `healthcheck_namespace` - The path used to check the health of your connection.  Defaults to `default`.  This field is required, and is only marked as optional for backwards compatibility.
 * memcached:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
 	* `port` - (Optional) 
 * mongo_legacy_host:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -462,6 +501,7 @@ The following arguments are supported by the Resource resource:
 	* `tls_required` - (Optional) 
 * mongo_legacy_replicaset:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -478,6 +518,7 @@ The following arguments are supported by the Resource resource:
 	* `tls_required` - (Optional) 
 * mongo_host:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -492,6 +533,7 @@ The following arguments are supported by the Resource resource:
 	* `tls_required` - (Optional) 
 * mongo_replica_set:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -508,6 +550,7 @@ The following arguments are supported by the Resource resource:
 	* `tls_required` - (Optional) 
 * mysql:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -521,6 +564,7 @@ The following arguments are supported by the Resource resource:
 	* `port` - (Optional) 
 * aurora_mysql:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -534,6 +578,7 @@ The following arguments are supported by the Resource resource:
 	* `port` - (Optional) 
 * clustrix:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -547,6 +592,7 @@ The following arguments are supported by the Resource resource:
 	* `port` - (Optional) 
 * maria:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -560,6 +606,7 @@ The following arguments are supported by the Resource resource:
 	* `port` - (Optional) 
 * memsql:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -573,6 +620,7 @@ The following arguments are supported by the Resource resource:
 	* `port` - (Optional) 
 * single_store:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -586,6 +634,7 @@ The following arguments are supported by the Resource resource:
 	* `port` - (Optional) 
 * oracle:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -600,6 +649,7 @@ The following arguments are supported by the Resource resource:
 	* `tls_required` - (Optional) 
 * postgres:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -614,6 +664,7 @@ The following arguments are supported by the Resource resource:
 	* `override_database` - (Optional) 
 * aurora_postgres:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -628,6 +679,7 @@ The following arguments are supported by the Resource resource:
 	* `override_database` - (Optional) 
 * greenplum:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -642,6 +694,7 @@ The following arguments are supported by the Resource resource:
 	* `override_database` - (Optional) 
 * cockroach:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -656,6 +709,7 @@ The following arguments are supported by the Resource resource:
 	* `override_database` - (Optional) 
 * redshift:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -670,6 +724,7 @@ The following arguments are supported by the Resource resource:
 	* `override_database` - (Optional) 
 * citus:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -684,6 +739,7 @@ The following arguments are supported by the Resource resource:
 	* `override_database` - (Optional) 
 * presto:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -696,12 +752,14 @@ The following arguments are supported by the Resource resource:
 	* `tls_required` - (Optional) 
 * raw_tcp:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
 	* `port` - (Optional) 
 * rdp:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -714,6 +772,7 @@ The following arguments are supported by the Resource resource:
 	* `port` - (Required) 
 * redis:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -723,6 +782,7 @@ The following arguments are supported by the Resource resource:
 	* `port` - (Optional) 
 * elasticache_redis:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -733,6 +793,7 @@ The following arguments are supported by the Resource resource:
 	* `tls_required` - (Optional) 
 * snowflake:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -746,6 +807,7 @@ The following arguments are supported by the Resource resource:
 	* `schema` - (Required) 
 * sql_server:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -761,6 +823,7 @@ The following arguments are supported by the Resource resource:
 	* `override_database` - (Optional) 
 * ssh:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -772,6 +835,7 @@ The following arguments are supported by the Resource resource:
 	* `allow_deprecated_key_exchanges` - (Optional) 
 * ssh_cert:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -783,6 +847,7 @@ The following arguments are supported by the Resource resource:
 	* `allow_deprecated_key_exchanges` - (Optional) 
 * ssh_customer_key:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -797,6 +862,7 @@ The following arguments are supported by the Resource resource:
 	* `allow_deprecated_key_exchanges` - (Optional) 
 * sybase:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -809,6 +875,7 @@ The following arguments are supported by the Resource resource:
 	* `secret_store_password_key` - (Optional)
 * sybase_iq:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
@@ -821,6 +888,7 @@ The following arguments are supported by the Resource resource:
 	* `secret_store_password_key` - (Optional)
 * teradata:
 	* `name` - (Required) Unique human-readable name of the Resource.
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 	* `secret_store_id` - (Optional) ID of the secret store containing credentials for this resource, if any.
 	* `egress_filter` - (Optional) A filter applied to the routing logic to pin datasource to nodes.
 	* `hostname` - (Required) 
diff --git a/docs/resources/role.md b/docs/resources/role.md
index 703e65df..f0eb1d1d 100644
--- a/docs/resources/role.md
+++ b/docs/resources/role.md
@@ -14,10 +14,18 @@ A Role is a collection of access grants, and typically corresponds to a team, Ac
 resource "sdm_role" "all-dbs" {
     name = "all-database-access"
     composite = true
+    tags = {
+        region = "us-west"
+        env = "dev"
+    }    
 }
 
 resource "sdm_role" "redis-only" {
     name = "redis-role"
+    tags = {
+        region = "us-west"
+        env = "dev"
+    }    
 }
 ```
 ## Argument Reference
diff --git a/docs/resources/secret_store.md b/docs/resources/secret_store.md
index d28fe57b..8f753d17 100644
--- a/docs/resources/secret_store.md
+++ b/docs/resources/secret_store.md
@@ -14,15 +14,18 @@ The following arguments are supported by the SecretStore resource:
 * aws:
 	* `name` - (Required) Unique human-readable name of the SecretStore.
 	* `region` - (Required) 
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 * vault_tls:
 	* `name` - (Required) Unique human-readable name of the SecretStore.
 	* `server_address` - (Required) 
 	* `ca_cert_path` - (Optional) 
 	* `client_cert_path` - (Required) 
 	* `client_key_path` - (Required) 
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 * vault_token:
 	* `name` - (Required) Unique human-readable name of the SecretStore.
 	* `server_address` - (Required) 
+	* `tags` - (Optional) Tags is a map of key, value pairs.
 ## Attribute Reference
 In addition to provided arguments above, the following attributes are returned by the SecretStore resource:
 * `id` - A unique identifier for the SecretStore resource.
diff --git a/sdm/provider.go b/sdm/provider.go
index 179ac538..1ed198ed 100644
--- a/sdm/provider.go
+++ b/sdm/provider.go
@@ -11,7 +11,7 @@ import (
 	sdm "github.com/strongdm/terraform-provider-sdm/sdm/internal/sdk"
 )
 
-const userAgent = "terraform-provider-sdm/1.0.28"
+const userAgent = "terraform-provider-sdm/1.0.29"
 
 // Provider returns a terraform.ResourceProvider.
 func Provider() terraform.ResourceProvider {