Cannot add Tag to root_block_device

Hello Team,

Terraform version : terraform_0.12.24_windows_amd64

We have enabled a service in AWS such that there should be a mandatory tags for instance as well as for the root volume during the creation of instance.

We have implemented a terraform scripts for the creation of EC2 instances in aws account. below is the script

Launch EC2 Server

resource “aws_instance” “windows” {
ami = “{data.aws_ami.aws_windows_ami.id}" instance_type = "{var.instance_type}”
subnet_id = “{var.subnet_id}" disable_api_termination = true iam_instance_profile = "{var.iam_instance_profile}”
vpc_security_group_ids = ["{var.sg_id_1}","{var.sg_id_2}"]
key_name = “{var.key_name}" get_password_data = "true" associate_public_ip_address = "{var.auto_assign_publicip}”
tags = {
Name = “{upper(var.server_name)}" PURPOSE = "{var.server_purpose}”
ENVIRONMENT = “{upper(var.server_environment)}" SYSTEM = "{upper(var.server_system)}”
}
root_block_device {
delete_on_termination = true
volume_size = “{var.root_disk_size}" volume_type = "gp2" tags = { Name = "{upper(var.server_name)}”
PURPOSE = “{var.server_purpose}" ENVIRONMENT = "{upper(var.server_environment)}”
SYSTEM = “{upper(var.server_system)}" } } connection { type = "winrm" user = "{var.default_user_name}”
password = “{rsadecrypt(self.password_data, file("{var.private_key_path}”))}"
port =
insecure = true
https = true
# set from default of 5m to 10m to avoid winrm timeout
timeout = “10m”
}

Note that terraform uses Go WinRM which doesn’t support https at this time. If server is not on a private network,

user_data = <<EOF

Invoke-Expression ((New-Object System.Net.Webclient).DownloadString(‘https://raw.githubusercontent.com/ansible/ansible/devel/examples/scripts/ConfigureRemotingForAnsible.ps1’))
Import-Module ECSTools
Initialize-ECSAgent -Cluster '{var.ecs_cluster_name}' -EnableTaskIAMRole </powershell> EOF provisioner "file" { source = "{var.devops_script_path}\nla-timezone-telnet.ps1"
destination = “C:\Script\nla-timezone-telnet.ps1”
}

provisioner “file” {
source = “{var.devops_script_path}\\metricbeat.ps1" destination = "C:\\Script\\metricbeat.ps1" } provisioner "file" { source = "{var.devops_script_path}\local-user.ps1”
destination = “C:\Script\local-user.ps1”
}
provisioner “file” {
source = “{var.devops_script_path}\\language.admin.ps1" destination = "C:\\Script\\language.admin.ps1" } provisioner "file" { source = "{var.devops_script_path}\docker-base-images.ps1”
destination = “C:\Script\docker-base-images.ps1”
}
provisioner “remote-exec” {
inline = [
#Set computer name
“powershell.exe Rename-Computer -NewName ${upper(var.server_name)} -Force”,
#Enable NLA
“powershell.exe -File C:\Script\nla-timezone-telnet.ps1”,
#Installing ELK Agent - Metricbeat
“powershell.exe -File C:\Script\metricbeat.ps1”,
#create local user then add to admin group
“powershell.exe -File C:\Script\local-user.ps1”,
#create local user then add to admin group
“powershell.exe -File C:\Script\language.admin.ps1”,
#Download docker base images
“powershell.exe -File C:\Script\docker-base-images.ps1”,
]
}
}

where i am adding tags for the root volume during the creation of instance but i am getting below error
terraform plan

Error: Unsupported argument

on ec2-windows-ecs.tf line 22, in resource “aws_instance” “windows”:
22: tags = {

An argument named “tags” is not expected here.

Please help me out in this. We have to add tags for both Instance as well as root volume during the creation of EC2 instance.