Untagged cloud resources make cost attribution guesswork and orphaned resources invisible. Tagging only works if it is enforced at creation. Retrofitting tags across thousands of resources is a project nobody finishes.
Keep mandatory tags to five or fewer. Owner, environment, cost centre, application, and data classification cover most needs. Long mandatory lists get bypassed through exception requests until the policy is meaningless.
Constrain values to a fixed list. Free-text tags produce prod, production, Prod, and PROD as four distinct values, which breaks every cost report. Enforce allowed values in policy.
Enforce at creation. Tag at provisioning through infrastructure as code or a deny-on-create policy. Tags applied retrospectively by a script are wrong within a month because new resources keep arriving untagged.
Here's a preview. Unlock the free download to get all 3 sections (2 more below).
| Tag key | Purpose | Allowed values | Example | Enforcement |
|---|---|---|---|---|
| owner | Who to contact about this resource | Valid team alias from the directory | team-platform | Deny on create if missing |
| environment | Lifecycle stage | prod | staging | dev | sandbox | prod | Deny on create if missing or invalid |
More free templates IT teams use alongside this one.
Cloud cost allocation stalls on shared services: the network, logging, and identity that nobody owns and everybody uses. Deciding the split rule in advance is what makes showback credible rather than a monthly argument.
Landing zone decisions are cheap before any workload exists and painful afterwards. Account structure in particular is close to irreversible once production is running, so it is worth deciding deliberately rather than discovering.
Cost optimisation reports identify savings that are never realised, because nobody owns the change and nobody verifies it landed. This tracker follows each opportunity to a confirmed reduction on the bill.
Owner, environment, cost centre, application, and data classification cover most needs. Keep the mandatory set to five or fewer with values constrained to fixed lists. Long lists and free text are what cause tagging policies to collapse.
At creation, using native policy such as deny-on-create, plus tags set in your infrastructure as code. Retrospective tagging scripts never catch up, because untagged resources keep being created faster than they are remediated.
Either an orphaned resource nobody owns, or something created outside the normal provisioning process. Both are worth investigating: untagged resources are a reliable leading indicator of waste and of shadow infrastructure.
