Building a Cloud Tagging Taxonomy That Actually Sticks

Keep it to a small, mandatory set: team or cost center, environment, and product or feature. Anything beyond that becomes optional metadata people skip under deadline pressure, and an optional tag is functionally the same as no tag once you're trying to allocate a bill. Three enforced fields beat fifteen suggested ones every time. Add a fourth field only if you have a specific, recurring reporting need the first three genuinely can't answer, a customer-level cost allocation requirement, say, not because more data feels safer.

The taxonomy only survives if a deploy or a Terraform apply without the required tags fails the pipeline, not if it merely triggers a Slack reminder someone can dismiss. Most infrastructure-as-code tools support a policy check step for exactly this; wiring it in once is a smaller project than most teams expect, and it's the single most effective step in this whole process. This works whether your infrastructure is provisioned through Terraform, CloudFormation, or a homegrown script, since the enforcement point is the pipeline step itself, not the provisioning tool.

New resources are the easy part once enforcement exists. Existing untagged resources need a one-time sweep, usually a script matching resource names or owning accounts against a lookup table you build by hand for the resources that predate the policy. Prioritize the backfill by dollar amount, not by how easy a resource is to fix, since a handful of large, expensive, untagged resources matter more to your total unallocated number than a long tail of small ones.

Budget for this taking longer than the enforcement rule itself, since it's manual reconciliation work against old naming conventions and half-remembered ownership, not a rule you write once and let run. Treat it as its own small project with a start and end date, rather than an open-ended cleanup that competes for attention with everyone's actual roadmap work.

• Give shared infrastructure, a load balancer used by five teams, its own explicit shared-cost tag rather than leaving it blank
• Route genuinely unattributable spend into a named overhead bucket that shows up on someone's report, instead of letting it vanish into an unlabeled total
• Review that overhead bucket monthly, since a shrinking unattributable total is the actual sign the taxonomy is working

• Making the mandatory field list too granular, so people start leaving it blank the way they would an optional one anyway
• Enforcing tags on new resources but never backfilling the old ones, so a large share of the historical bill stays unattributable
• Letting the taxonomy be owned by whichever team wrote the original wiki page instead of whoever owns the pipeline where enforcement actually lives
• Treating a passing enforcement check as proof the tags are accurate, when a bot can satisfy the rule with the wrong value just as easily as the right one

Review tag compliance as its own number in your monthly infrastructure review, the percentage of spend correctly tagged, not just whether the policy document was updated recently. Put a specific target on that number too, ninety-five percent tagged spend within two quarters of launching enforcement, for example, so the review has a goal to measure against rather than just a trend to watch. A number that's tracked gets defended; a policy that's merely written down gets forgotten the next time someone's under a deadline.

Rotate ownership of that monthly check rather than leaving it permanently with whoever built the original enforcement rule, so it survives that person changing teams. A process that depends on one specific engineer remembering to run a report is not meaningfully more durable than the wiki page it replaced.