diff --git a/az/main.tf b/az/main.tf
index 08f2406..1e1ceaa 100644
--- a/az/main.tf
+++ b/az/main.tf
@@ -42,12 +42,10 @@ locals {
   nat_gateways_not_enabled_check = "${var.nat_gateways_enabled != "true" ? 1 : 0}"
 
   # default subnet tags
-  default_subnet_tags = [
-    {
-      application = "${var.stack_item_fullname}"
-      managed_by  = "terraform"
-    },
-  ]
+  default_subnet_tags = {
+    application = "${var.stack_item_fullname}"
+    managed_by  = "terraform"
+  }
 }
 
 ## Provisions DMZ resources
@@ -69,7 +67,7 @@ resource "aws_subnet" "dmz" {
   map_public_ip_on_launch = "${var.enable_dmz_public_ips}"
   vpc_id                  = "${var.vpc_id}"
 
-  tags = "${concat(local.default_subnet_tags, var.additional_subnet_tags, list(map("Name", "${var.stack_item_label}-dmz-${count.index}")))}"
+  tags = "${merge(local.default_subnet_tags, var.additional_subnet_tags, map("Name", "${var.stack_item_label}-dmz-${count.index}"))}"
 }
 
 ### Associates subnet with routing table
@@ -193,7 +191,7 @@ resource "aws_subnet" "lan" {
   cidr_block = "${local.lan_cidrs_override_enabled == "true" ? element(var.lan_cidrs_override,count.index) : cidrsubnet(data.aws_vpc.base.cidr_block,lookup(var.az_cidrsubnet_newbits, local.azs_provisioned_count * local.lans_multiplier),count.index + lookup(var.az_cidrsubnet_offset, local.azs_provisioned_count))}"
   vpc_id     = "${var.vpc_id}"
 
-  tags = "${concat(local.default_subnet_tags, var.additional_subnet_tags, list(map("Name", "${var.stack_item_label}-lan-${count.index}")))}"
+  tags = "${merge(local.default_subnet_tags, var.additional_subnet_tags, map("Name", "${var.stack_item_label}-lan-${count.index}"))}"
 }
 
 ### Provisions routing table
diff --git a/az/variables.tf b/az/variables.tf
index 8576cdc..967a4ad 100644
--- a/az/variables.tf
+++ b/az/variables.tf
@@ -14,9 +14,9 @@ variable "stack_item_label" {
 }
 
 variable "additional_subnet_tags" {
-  type        = "list"
-  description = "Additional subnet to apply at the subnet level, if any"
-  default     = []
+  type        = "map"
+  description = "Additional tags to apply at the subnet level, if any"
+  default     = {}
 }
 
 ## VPC parameters
diff --git a/base/main.tf b/base/main.tf
index c63f0e0..839bae8 100644
--- a/base/main.tf
+++ b/base/main.tf
@@ -9,13 +9,11 @@ terraform {
 locals {
   default_instance_tenancy = "${length(var.instance_tenancy) >= 1 ? "${var.instance_tenancy}" : "default"}"
 
-  default_vpc_tags = [
-    {
-      application = "${var.stack_item_fullname}"
-      managed_by  = "terraform"
-      Name        = "${var.stack_item_label}-vpc"
-    },
-  ]
+  default_vpc_tags = {
+    application = "${var.stack_item_fullname}"
+    managed_by  = "terraform"
+    Name        = "${var.stack_item_label}-vpc"
+  }
 }
 
 ## Provisions Virtual Private Cloud (VPC)
@@ -28,7 +26,7 @@ resource "aws_vpc" "vpc" {
   enable_classiclink_dns_support   = "${var.enable_classiclink_dns_support}"
   assign_generated_ipv6_cidr_block = "${var.assign_generated_ipv6_cidr_block}"
 
-  tags = "${concat(local.default_vpc_tags, var.additional_vpc_tags)}"
+  tags = "${merge(local.default_vpc_tags, var.additional_vpc_tags)}"
 }
 
 ## Provisions Internet gateways
diff --git a/base/variables.tf b/base/variables.tf
index 231d990..0301dc7 100644
--- a/base/variables.tf
+++ b/base/variables.tf
@@ -14,9 +14,9 @@ variable "stack_item_label" {
 }
 
 variable "additional_vpc_tags" {
-  type        = "list"
+  type        = "map"
   description = "Additional tags to apply at the VPC level, if any"
-  default     = []
+  default     = {}
 }
 
 ## VPC parameters