diff --git a/backend/src/db/migrations/20250617181915_add-dynamic-secret-tags.ts b/backend/src/db/migrations/20250617181915_add-dynamic-secret-tags.ts
deleted file mode 100644
index d11a98028..000000000
--- a/backend/src/db/migrations/20250617181915_add-dynamic-secret-tags.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  const hasCol = await knex.schema.hasColumn(TableName.DynamicSecret, "tags");
-  if (!hasCol) {
-    await knex.schema.alterTable(TableName.DynamicSecret, (t) => {
-      t.jsonb("tags").nullable();
-    });
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const hasCol = await knex.schema.hasColumn(TableName.DynamicSecret, "tags");
-  if (hasCol) {
-    await knex.schema.alterTable(TableName.DynamicSecret, (t) => {
-      t.dropColumn("tags");
-    });
-  }
-}
diff --git a/backend/src/db/schemas/dynamic-secrets.ts b/backend/src/db/schemas/dynamic-secrets.ts
index 2720aa729..637d0c632 100644
--- a/backend/src/db/schemas/dynamic-secrets.ts
+++ b/backend/src/db/schemas/dynamic-secrets.ts
@@ -29,8 +29,7 @@ export const DynamicSecretsSchema = z.object({
   encryptedInput: zodBuffer,
   projectGatewayId: z.string().uuid().nullable().optional(),
   gatewayId: z.string().uuid().nullable().optional(),
-  usernameTemplate: z.string().nullable().optional(),
-  tags: z.unknown().nullable().optional()
+  usernameTemplate: z.string().nullable().optional()
 });
 
 export type TDynamicSecrets = z.infer<typeof DynamicSecretsSchema>;
diff --git a/backend/src/ee/routes/v1/dynamic-secret-router.ts b/backend/src/ee/routes/v1/dynamic-secret-router.ts
index e931d4f82..b916bab67 100644
--- a/backend/src/ee/routes/v1/dynamic-secret-router.ts
+++ b/backend/src/ee/routes/v1/dynamic-secret-router.ts
@@ -80,7 +80,6 @@ export const registerDynamicSecretRouter = async (server: FastifyZodProvider) =>
         environmentSlug: z.string().describe(DYNAMIC_SECRETS.CREATE.environmentSlug).min(1),
         name: slugSchema({ min: 1, max: 64, field: "Name" }).describe(DYNAMIC_SECRETS.CREATE.name),
         metadata: ResourceMetadataSchema.optional(),
-        tags: ResourceMetadataSchema.optional(),
         usernameTemplate: userTemplateSchema.optional()
       }),
       response: {
@@ -147,7 +146,6 @@ export const registerDynamicSecretRouter = async (server: FastifyZodProvider) =>
             .nullable(),
           newName: z.string().describe(DYNAMIC_SECRETS.UPDATE.newName).optional(),
           metadata: ResourceMetadataSchema.optional(),
-          tags: ResourceMetadataSchema.optional(),
           usernameTemplate: userTemplateSchema.nullable().optional()
         })
       }),
diff --git a/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts b/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts
index 90d3c9603..168b16c5f 100644
--- a/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts
+++ b/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts
@@ -166,7 +166,6 @@ export const dynamicSecretLeaseServiceFactory = ({
         usernameTemplate: dynamicSecretCfg.usernameTemplate,
         identity,
         metadata: { projectId },
-        tags: dynamicSecretCfg.tags as Record<string, string>[] | undefined,
         config
       });
     } catch (error: unknown) {
diff --git a/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts b/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts
index a46ef1c9c..0b28f5e0e 100644
--- a/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts
+++ b/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts
@@ -79,7 +79,6 @@ export const dynamicSecretServiceFactory = ({
     defaultTTL,
     actorAuthMethod,
     metadata,
-    tags,
     usernameTemplate
   }: TCreateDynamicSecretDTO) => {
     const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
@@ -166,8 +165,7 @@ export const dynamicSecretServiceFactory = ({
           folderId: folder.id,
           name,
           gatewayId: selectedGatewayId,
-          usernameTemplate,
-          tags: JSON.stringify(tags)
+          usernameTemplate
         },
         tx
       );
@@ -204,9 +202,10 @@ export const dynamicSecretServiceFactory = ({
     actorOrgId,
     actorAuthMethod,
     metadata,
-    tags,
     usernameTemplate
   }: TUpdateDynamicSecretDTO) => {
+    console.log({ inputs });
+
     const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
     if (!project) throw new NotFoundError({ message: `Project with slug '${projectSlug}' not found` });
 
@@ -318,8 +317,7 @@ export const dynamicSecretServiceFactory = ({
           name: newName ?? name,
           status: null,
           gatewayId: selectedGatewayId,
-          usernameTemplate,
-          tags: JSON.stringify(tags)
+          usernameTemplate
         },
         tx
       );
diff --git a/backend/src/ee/services/dynamic-secret/dynamic-secret-types.ts b/backend/src/ee/services/dynamic-secret/dynamic-secret-types.ts
index e8fa010b1..6720cf2c8 100644
--- a/backend/src/ee/services/dynamic-secret/dynamic-secret-types.ts
+++ b/backend/src/ee/services/dynamic-secret/dynamic-secret-types.ts
@@ -23,7 +23,6 @@ export type TCreateDynamicSecretDTO = {
   projectSlug: string;
   metadata?: ResourceMetadataDTO;
   usernameTemplate?: string | null;
-  tags?: ResourceMetadataDTO;
 } & Omit<TProjectPermission, "projectId">;
 
 export type TUpdateDynamicSecretDTO = {
@@ -36,7 +35,6 @@ export type TUpdateDynamicSecretDTO = {
   inputs?: TProvider["inputs"];
   projectSlug: string;
   metadata?: ResourceMetadataDTO;
-  tags?: ResourceMetadataDTO;
   usernameTemplate?: string | null;
 } & Omit<TProjectPermission, "projectId">;
 
diff --git a/backend/src/ee/services/dynamic-secret/providers/aws-iam.ts b/backend/src/ee/services/dynamic-secret/providers/aws-iam.ts
index 12a9558c9..fc65e0aec 100644
--- a/backend/src/ee/services/dynamic-secret/providers/aws-iam.ts
+++ b/backend/src/ee/services/dynamic-secret/providers/aws-iam.ts
@@ -119,20 +119,20 @@ export const AwsIamProvider = (): TDynamicProviderFns => {
     identity?: {
       name: string;
     };
-    tags?: Record<string, string>[];
     metadata: { projectId: string };
   }) => {
-    const { inputs, usernameTemplate, metadata, identity, tags } = data;
+    const { inputs, usernameTemplate, metadata, identity } = data;
 
     const providerInputs = await validateProviderInputs(inputs);
+    console.log({ providerInputs, inputs });
     const client = await $getClient(providerInputs, metadata.projectId);
 
     const username = generateUsername(usernameTemplate, identity);
     const { policyArns, userGroups, policyDocument, awsPath, permissionBoundaryPolicyArn } = providerInputs;
     const awsTags = [{ Key: "createdBy", Value: "infisical-dynamic-secret" }];
 
-    if (tags && Array.isArray(tags)) {
-      const additionalTags = tags.map((tag) => ({
+    if (providerInputs.tags && Array.isArray(providerInputs.tags)) {
+      const additionalTags = providerInputs.tags.map((tag) => ({
         Key: tag.key,
         Value: tag.value
       }));
diff --git a/backend/src/ee/services/dynamic-secret/providers/models.ts b/backend/src/ee/services/dynamic-secret/providers/models.ts
index c86361583..c52630701 100644
--- a/backend/src/ee/services/dynamic-secret/providers/models.ts
+++ b/backend/src/ee/services/dynamic-secret/providers/models.ts
@@ -2,6 +2,7 @@ import RE2 from "re2";
 import { z } from "zod";
 
 import { CharacterType, characterValidator } from "@app/lib/validator/validate-string";
+import { ResourceMetadataSchema } from "@app/services/resource-metadata/resource-metadata-schema";
 
 import { TDynamicSecretLeaseConfig } from "../../dynamic-secret-lease/dynamic-secret-lease-types";
 
@@ -207,7 +208,8 @@ export const DynamicSecretAwsIamSchema = z.preprocess(
       permissionBoundaryPolicyArn: z.string().trim().optional(),
       policyDocument: z.string().trim().optional(),
       userGroups: z.string().trim().optional(),
-      policyArns: z.string().trim().optional()
+      policyArns: z.string().trim().optional(),
+      tags: ResourceMetadataSchema.optional()
     }),
     z.object({
       method: z.literal(AwsIamAuthType.AssumeRole),
@@ -217,7 +219,8 @@ export const DynamicSecretAwsIamSchema = z.preprocess(
       permissionBoundaryPolicyArn: z.string().trim().optional(),
       policyDocument: z.string().trim().optional(),
       userGroups: z.string().trim().optional(),
-      policyArns: z.string().trim().optional()
+      policyArns: z.string().trim().optional(),
+      tags: ResourceMetadataSchema.optional()
     })
   ])
 );
@@ -525,7 +528,6 @@ export type TDynamicProviderFns = {
       name: string;
     };
     metadata: { projectId: string };
-    tags?: Record<string, string>[];
     config?: TDynamicSecretLeaseConfig;
   }) => Promise<{ entityId: string; data: unknown }>;
   validateConnection: (inputs: unknown, metadata: { projectId: string }) => Promise<boolean>;
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/AwsIamInputForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/AwsIamInputForm.tsx
index f0750e07e..48e942d0a 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/AwsIamInputForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/AwsIamInputForm.tsx
@@ -34,7 +34,12 @@ const formSchema = z.object({
       permissionBoundaryPolicyArn: z.string().trim().optional(),
       policyDocument: z.string().trim().optional(),
       userGroups: z.string().trim().optional(),
-      policyArns: z.string().trim().optional()
+      policyArns: z.string().trim().optional(),
+      tags: z
+      .array(
+        z.object({ key: z.string().trim().min(1).max(128), value: z.string().trim().min(1).max(256) })
+      )
+      .optional()
     }),
     z.object({
       method: z.literal(DynamicSecretAwsIamAuth.AssumeRole),
@@ -44,7 +49,12 @@ const formSchema = z.object({
       permissionBoundaryPolicyArn: z.string().trim().optional(),
       policyDocument: z.string().trim().optional(),
       userGroups: z.string().trim().optional(),
-      policyArns: z.string().trim().optional()
+      policyArns: z.string().trim().optional(),
+      tags: z
+      .array(
+        z.object({ key: z.string().trim().min(1).max(128), value: z.string().trim().min(1).max(256) })
+      )
+      .optional()
     })
   ]),
   defaultTTL: z.string().superRefine((val, ctx) => {
@@ -69,12 +79,7 @@ const formSchema = z.object({
     }),
   name: z.string().refine((val) => val.toLowerCase() === val, "Must be lowercase"),
   environment: z.object({ name: z.string(), slug: z.string() }),
-  usernameTemplate: z.string().nullable().optional(),
-  tags: z
-    .array(
-      z.object({ key: z.string().trim().min(1).max(128), value: z.string().trim().min(1).max(256) })
-    )
-    .optional()
+  usernameTemplate: z.string().nullable().optional()
 });
 type TForm = z.infer<typeof formSchema>;
 
@@ -107,8 +112,7 @@ export const AwsIamInputForm = ({
       usernameTemplate: "{{randomUsername}}",
       provider: {
         method: DynamicSecretAwsIamAuth.AssumeRole
-      },
-      tags: []
+      }
     }
   });
 
@@ -121,8 +125,7 @@ export const AwsIamInputForm = ({
     provider,
     defaultTTL,
     environment,
-    usernameTemplate,
-    tags
+    usernameTemplate
   }: TForm) => {
     // wait till previous request is finished
     if (createDynamicSecret.isPending) return;
@@ -138,8 +141,7 @@ export const AwsIamInputForm = ({
         projectSlug,
         environmentSlug: environment.slug,
         usernameTemplate:
-          !usernameTemplate || isDefaultUsernameTemplate ? undefined : usernameTemplate,
-        tags
+          !usernameTemplate || isDefaultUsernameTemplate ? undefined : usernameTemplate
       });
       onCompleted();
     } catch {
@@ -408,7 +410,7 @@ export const AwsIamInputForm = ({
                   </FormControl>
                 )}
               />
-              <MetadataForm control={control} name="tags" isValueRequired />
+              <MetadataForm control={control} name="provider.tags" title="Tags" isValueRequired />
               {!isSingleEnvironmentMode && (
                 <Controller
                   control={control}
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretAwsIamForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretAwsIamForm.tsx
index b65678302..d28f983da 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretAwsIamForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretAwsIamForm.tsx
@@ -23,7 +23,10 @@ const formSchema = z.object({
       permissionBoundaryPolicyArn: z.string().trim().optional(),
       policyDocument: z.string().trim().optional(),
       userGroups: z.string().trim().optional(),
-      policyArns: z.string().trim().optional()
+      policyArns: z.string().trim().optional(),
+      tags: z
+      .array(z.object({ key: z.string().trim().min(1), value: z.string().trim().min(1) }))
+      .optional(),
     }),
     z.object({
       method: z.literal(DynamicSecretAwsIamAuth.AssumeRole),
@@ -33,7 +36,10 @@ const formSchema = z.object({
       permissionBoundaryPolicyArn: z.string().trim().optional(),
       policyDocument: z.string().trim().optional(),
       userGroups: z.string().trim().optional(),
-      policyArns: z.string().trim().optional()
+      policyArns: z.string().trim().optional(),
+      tags: z
+      .array(z.object({ key: z.string().trim().min(1), value: z.string().trim().min(1) }))
+      .optional()
     })
   ]),
   defaultTTL: z.string().superRefine((val, ctx) => {
@@ -58,9 +64,6 @@ const formSchema = z.object({
     })
     .nullable(),
   newName: slugSchema().optional(),
-  tags: z
-    .array(z.object({ key: z.string().trim().min(1), value: z.string().trim().min(1) }))
-    .optional(),
   usernameTemplate: z.string().trim().nullable().optional()
 });
 type TForm = z.infer<typeof formSchema>;
@@ -95,7 +98,6 @@ export const EditDynamicSecretAwsIamForm = ({
       inputs: {
         ...(dynamicSecret.inputs as TForm["inputs"])
       },
-      tags: dynamicSecret.tags
     }
   });
   const isAccessKeyMethod = watch("inputs.method") === DynamicSecretAwsIamAuth.AccessKey;
@@ -107,8 +109,7 @@ export const EditDynamicSecretAwsIamForm = ({
     maxTTL,
     defaultTTL,
     newName,
-    usernameTemplate,
-    tags
+    usernameTemplate
   }: TForm) => {
     // wait till previous request is finished
     if (updateDynamicSecret.isPending) return;
@@ -125,8 +126,7 @@ export const EditDynamicSecretAwsIamForm = ({
           inputs,
           newName: newName === dynamicSecret.name ? undefined : newName,
           usernameTemplate:
-            !usernameTemplate || isDefaultUsernameTemplate ? null : usernameTemplate,
-          tags
+            !usernameTemplate || isDefaultUsernameTemplate ? null : usernameTemplate
         }
       });
       onClose();
@@ -389,7 +389,7 @@ export const EditDynamicSecretAwsIamForm = ({
                 </FormControl>
               )}
             />
-            <MetadataForm control={control} name="tags" isValueRequired />
+            <MetadataForm control={control} name="inputs.tags" title="Tags" isValueRequired />
           </div>
         </div>
         <div className="mt-4 flex items-center space-x-4">
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/MetadataForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/MetadataForm.tsx
index c7ca96b14..510bc2a05 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/MetadataForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/MetadataForm.tsx
@@ -7,10 +7,12 @@ import { FormControl, FormLabel, IconButton, Input } from "@app/components/v2";
 export const MetadataForm = ({
   control,
   name = "metadata",
+  title = "Metadata",
   isValueRequired = false
 }: {
   control: Control<any>;
   name?: string;
+  title?: string;
   isValueRequired?: boolean;
 }) => {
   const metadataFormFields = useFieldArray({
@@ -19,7 +21,7 @@ export const MetadataForm = ({
   });
 
   return (
-    <FormControl label={name.charAt(0).toUpperCase() + name.slice(1)}>
+    <FormControl label={title}>
       <div className="flex flex-col space-y-2">
         {metadataFormFields.fields.map(({ id: metadataFieldId }, i) => (
           <div key={metadataFieldId} className="flex items-end space-x-2">