diff --git a/builtin/providers/aws/resource_aws_network_acl.go b/builtin/providers/aws/resource_aws_network_acl.go
index 11c448da8..4753f1344 100644
--- a/builtin/providers/aws/resource_aws_network_acl.go
+++ b/builtin/providers/aws/resource_aws_network_acl.go
@@ -101,6 +101,7 @@ func resourceAwsNetworkAcl() *schema.Resource {
 				},
 				Set: resourceAwsNetworkAclEntryHash,
 			},
+			"tags": tagsSchema(),
 		},
 	}
 }
@@ -157,6 +158,7 @@ func resourceAwsNetworkAclRead(d *schema.ResourceData, meta interface{}) error {
 	d.Set("vpc_id", networkAcl.VpcId)
 	d.Set("ingress", ingressEntries)
 	d.Set("egress", egressEntries)
+	d.Set("tags", tagsToMap(networkAcl.Tags))
 
 	return nil
 }
@@ -194,6 +196,12 @@ func resourceAwsNetworkAclUpdate(d *schema.ResourceData, meta interface{}) error
 		}
 	}
 
+	if err := setTags(ec2conn, d); err != nil {
+		return err
+	} else {
+		d.SetPartial("tags")
+	}
+
 	d.Partial(false)
 	return resourceAwsNetworkAclRead(d, meta)
 }
diff --git a/builtin/providers/aws/resource_aws_network_acl_test.go b/builtin/providers/aws/resource_aws_network_acl_test.go
index 2186aa74e..4ead1e8d4 100644
--- a/builtin/providers/aws/resource_aws_network_acl_test.go
+++ b/builtin/providers/aws/resource_aws_network_acl_test.go
@@ -203,6 +203,7 @@ func TestAccAWSNetworkAclsOnlyEgressRules(t *testing.T) {
 				Config: testAccAWSNetworkAclEgressConfig,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSNetworkAclExists("aws_network_acl.bond", &networkAcl),
+					testAccCheckTags(&networkAcl.Tags, "foo", "bar"),
 				),
 			},
 		},
@@ -392,6 +393,10 @@ resource "aws_network_acl" "bond" {
 		from_port = 22
 		to_port = 22
 	}
+
+	tags {
+		foo = "bar"
+	}
 }
 `