Often you apply conditions to IAM roles to further scope their use down. It would be helpful to be able to add tags specifically to runners EC2s without having them globally applied to every resource this module deploys. This would enable me to better secure my additional roles without my TF plans being huge.

As a pratical example, when I change some tags I am applying to my stack for the purposes of conditions on roles my terraform plan results in 29 changes. If I was able to define tags soley for applying to EC2s then the change would be much smaller and much easier to review.