I think I hit discard by mistake… nice. (apparently not, ignore the deleted post please)
I found another suggestion like this one (that being this one).
Keeping it in user configs is fine, metadata would be nicer since the tag isn’t supposed to be something that affects the instance? Might be better to use metadata if possible, in the case of many instances with many configs set.
In theory, it should only require an operator that the filter can use to read the value as a string slice and check if that value/regex is in that slice?
Depending on how the terraform module is set up, the type may or may not need to be changed unless the type is something arbitrary like any. Yaml has support for arrays or it could be a json string, either should work.
If this is something that can be done without much changing to other systems I could try and implement it, I am familiar with go.