Ram, 

This was an exercise in understanding events and discovery patterns primarily, but I'd always look to OOB solutions before building anything custom.

However, I've been looking at Tag Governance but that appeared only to update the tag in the cloud rather than responding to events.  The fact that no config is in place to respond to the tag event also implied that it only worked from SN to the cloud rather than the other way.  I'm already responding to cloud events for other resources but if I've missed something with regards to the Tag events then I'd be interested to understand where that is configured.

Thanks