Tag-based resource configuration control

In a system that provides network-based infrastructure services, customer resources are tagged in accordance with policies provided by the customers. Resources may be automatically tagged upon creation based on the provided policies. In addition, existing resources may be analyzed and automatically tagged to indicate characteristics of the resources that may be of interest to the customer. The customers may also specify configuration policies in terms of resource tags, and the system may be configured to apply and/or enforce the configuration policies.