This is one of the bread butter use cases on the opensource cloud custodian project (auto tagging, tag enforcement workflows, retro-active tagging from cloudtrail, etc). https://cloudcustodian.io (now a cncf sandbox project).