Tag log groups, Cognito pools and the website bucket with project

terraform/modules/container/main.tf

@@ -185,6 +185,7 @@ resource "aws_cloudwatch_log_group" "this" {
   name = "/ecs/${local.envappname}"
 
   tags = {
+    project = var.project_name
   }
 }
 

terraform/projects/civic-tech-index/s3.tf

@@ -10,6 +10,14 @@
 
 resource "aws_s3_bucket" "website" {
   bucket = "civictechindex.org"
+
+  # "civictechindex" is the project value from the tag standard, and it is written
+  # literally here for the same reason ecr.tf writes it literally: local.project_name
+  # in this directory is "civic-tech-index", which is not the standard's value. The
+  # two spellings are reconciled separately -- do not switch this to local.project_name.
+  tags = {
+    project = "civictechindex"
+  }
 }
 
 resource "aws_s3_bucket_website_configuration" "website" {

terraform/projects/home-unite-us/cognito-prod.tf

@@ -138,6 +138,10 @@ resource "aws_cognito_user_pool" "homeuniteus_prod" {
     default_email_option = "CONFIRM_WITH_CODE"
   }
 
+  tags = {
+    project = local.project_name
+  }
+
   // Destroying this pool destroys the production user accounts, which cannot be
   // recovered by recreating it. deletion_protection above is the AWS-side guard;
   // this is the Terraform-side one.

terraform/projects/home-unite-us/cognito-qa.tf

@@ -190,6 +190,10 @@ resource "aws_cognito_user_pool" "homeuniteus" {
   verification_message_template {
     default_email_option = "CONFIRM_WITH_CODE"
   }
+
+  tags = {
+    project = local.project_name
+  }
 }
 
 locals {