--- a/taskcluster/taskgraph/transforms/task.py
+++ b/taskcluster/taskgraph/transforms/task.py
@@ -1440,16 +1440,31 @@ def build_task(config, tasks):
             'label': task['label'],
             'task': task_def,
             'dependencies': task.get('dependencies', {}),
             'attributes': attributes,
             'optimization': task.get('optimization', None),
         }
 
 
+@transforms.add
+def check_task_identifiers(config, tasks):
+    """Ensures that all tasks have well defined identifiers:
+       ^[a-zA-Z0-9_-]{1,22}$
+    """
+    e = re.compile("^[a-zA-Z0-9_-]{1,22}$")
+    for task in tasks:
+        for attr in ('workerType', 'provisionerId'):
+            if not e.match(task['task'][attr]):
+                raise Exception(
+                    'task {}.{} is not a valid identifier: {}'.format(
+                        task['label'], attr, task['task'][attr]))
+        yield task
+
+
 def check_caches_are_volumes(task):
     """Ensures that all cache paths are defined as volumes.
 
     Caches and volumes are the only filesystem locations whose content
     isn't defined by the Docker image itself. Some caches are optional
     depending on the job environment. We want paths that are potentially
     caches to have as similar behavior regardless of whether a cache is
     used. To help enforce this, we require that all paths used as caches