Two layers of tags, and which one winsAWS tagging in two layers: account-wide invariants on the provider default tags, resource specifics in the module, and which one wins on a clash.