diff --git a/bootstrap/main.tf b/bootstrap/main.tf
index 3a15d5d..4b2b718 100644
--- a/bootstrap/main.tf
+++ b/bootstrap/main.tf
@@ -1,17 +1,3 @@
-terraform {
-  required_version = ">= 1.6.0"
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = "~> 5.0"
-    }
-  }
-}
-
-provider "aws" {
-  region = var.aws_region
-}
-
 resource "aws_s3_bucket" "tf_state" {
   bucket = var.state_bucket_name
 }
@@ -21,8 +7,22 @@ resource "aws_s3_bucket_versioning" "tf_state" {
   versioning_configuration { status = "Enabled" }
 }
 
+resource "aws_s3_bucket_lifecycle_configuration" "lifecycle" {
+  bucket = aws_s3_bucket.tf_state.id
+
+  rule {
+    id     = "cleanup-old-versions"
+    status = "Enabled"
+
+    noncurrent_version_expiration {
+      noncurrent_days = 90
+    }
+  }
+}
+
 resource "aws_s3_bucket_server_side_encryption_configuration" "tf_state" {
   bucket = aws_s3_bucket.tf_state.id
+
   rule {
     apply_server_side_encryption_by_default {
       sse_algorithm = "AES256"
diff --git a/bootstrap/providers.tf b/bootstrap/providers.tf
new file mode 100644
index 0000000..f942f42
--- /dev/null
+++ b/bootstrap/providers.tf
@@ -0,0 +1,19 @@
+terraform {
+  required_version = ">= 1.6.0"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
+
+provider "aws" {
+  region = var.aws_region
+  default_tags {
+    tags = {
+      Project   = "flagging-infra"
+      ManagedBy = "Terraform"
+    }
+  }
+}