How to tag an instance's eni?

When I create an instance or an LB it automatically creates an eni network interface for it behind the scenes.

Is there a way to get at that to tag it?

I see that for aws_instances with EBS volumes there’s a “volume_tags” option to propagate the tags but I don’t see anything for network interfaces.

I suppose I could get artistic and create a dummy resource with a provisioner which executes an AWS CLI call against the resource’s “primary_network_interface_id” output, but that seems a bit of a stretch…

Well, of course I found out how to do it immediately after posing the question…

resource "aws_ec2_tag" "ecs_node_eni" {
  resource_id = aws_instance.ecs_node.primary_network_interface_id
  key         = "Name"       
  value       = var.tags["Name"]
}

Presumably I could step through the tags with a for_each to get all of them included.

yep.

resource "aws_ec2_tag" "ecs_node_eni" {
  resource_id = aws_instance.ecs_node.primary_network_interface_id
  for_each    = var.tags
  key         = each.key
  value       = each.value
}