> For the complete documentation index, see [llms.txt](https://docs.duplocloud.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.duplocloud.com/docs/aws-extension/aws-extension/policy-model/resource-group.md).

# Resource Group

The isolation boundary that holds Kubernetes and cloud resources.

A Resource Group is the isolation boundary of the AWS Extension. Each one provisions its own IAM role and policies, security groups, KMS key, and EC2 key pair, and every resource created inside it inherits those boundaries.

A Resource Group holds two kinds of children:

* **Kubernetes resources** — namespaces, workloads, jobs and cron jobs, ingress, config maps, secrets, storage, and Helm releases
* **Cloud resources** — S3 buckets, RDS instances and clusters, ElastiCache, SNS topics, SQS queues, Lambda functions, Secrets Manager secrets, SSM parameters, EFS, MSK, ECR, and EC2 hosts

## Spec

| Field           | Description                                                                    |
| --------------- | ------------------------------------------------------------------------------ |
| **Name**        | The name of the resource group                                                 |
| **Environment** | The Environment this group belongs to                                          |
| **Cluster**     | The Cluster Baseline whose EKS cluster the group's Kubernetes resources run on |
| **Region**      | The AWS region                                                                 |
| **Tags**        | Optional. User-defined tags inherited by every resource in the group           |

## Tags

Tags set on a Resource Group are inherited by every resource inside it — applied as **AWS tags** on cloud resources and as **Kubernetes labels** on Kubernetes resources. Because a tag has to be valid in both systems, keys and values must satisfy the stricter of the two rule sets:

* A key may optionally carry a prefix, written `prefix/name`
* Key names, prefixes, and values must be valid Kubernetes label segments
* The `duplocloud.ai/` prefix is reserved and cannot be used
* A resource group can carry at most **50** tags

The platform stamps its own mandatory `duplocloud-ai-*` tags — workspace, environment, resource type, and managed-by — on top of whatever you set. Those are added automatically and don't count against your own tagging scheme.

{% hint style="info" %}
On Azure resource groups there is a second, separate tag list that applies only to the Azure resource group object itself, not to the resources inside it. The **Tags** field described here is the cloud-agnostic one that propagates to children.
{% endhint %}

## Deprovisioning

Deleting a Resource Group removes every resource inside it, so the platform requires an explicit confirmation of the whole contents rather than a single click.

Requesting deprovision first returns a **preview** listing every direct child that would be destroyed. You then confirm that list in full — the request is rejected if it omits any child that the preview returned. There is no partial deprovision: a Resource Group comes down with all of its children or not at all.

Individual resources have their own safeguards:

* **Delete** has been removed from resource views in favour of **Deprovision**, which tears down the cloud resource rather than just dropping the platform's record of it
* **Deprovision** and **Delete** are both disabled while delete protection is enabled on a resource
* Deprovisioning an imported network asks for confirmation first, since the network may have existed before the platform adopted it

## Dependencies

A Resource Group requires an **Environment**. Its Kubernetes resources additionally require the Environment's **Cluster Baseline**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.duplocloud.com/docs/aws-extension/aws-extension/policy-model/resource-group.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.