Tagging on AWS, Azure and Google Cloud: how to find ownerless spend and fix it with AAA Sentinel

The cloud bill arrives and someone asks which team spent the most. If half your resources carry no tags, the honest answer is "we don't know". Tagging is the foundation of any cost allocation, and also the job everyone leaves for later. In this article we go through the tags worth using on AWS, Azure and Google Cloud, and how AAA Sentinel helps you measure coverage, prioritise what costs the most and tag it without leaving the platform.

Why untagged spend is a problem

An untagged resource costs exactly the same as a tagged one, but it has no owner. It does not show up in any team's report, nobody looks at it when it grows and nobody dares to switch it off when it is no longer needed. And the problem grows by itself: resources get created in a hurry "and we'll tag them later", the tagging policy arrives when hundreds are already untagged, and retro-tagging is manual work that never gets prioritised.

What you gain

With high tag coverage, the conversation about spend changes:

• Each team sees which part of the spend is theirs and owns it.
• You find forgotten resources sooner: whatever has no owner is the first candidate for review.
• Reports by team, project or cost centre stop having a big "other" bucket.
• You can automate more safely: knowing what is production and what is development is the first thing any scheduled shutdown needs.

The five governance tags

You do not need a twenty-key schema. AAA Sentinel works with five governance tags that cover almost everything a FinOps team needs:

• Environment: production, staging, development. Separates what must not be touched from what can be switched off.
• Project: the product or application. Gives you the total cost of each product.
• Owner: the person or team responsible. The one you ask when something goes up.
• CostCenter: the accounting cost centre, so the numbers reconcile with finance.
• Team: the team that runs it, the basis for internal chargeback.

AWS, Azure and Google Cloud: what changes

The idea is the same on all three clouds, but the details are not:

• AWS: tags are case-sensitive. Tag Policies in AWS Organizations help enforce the schema, and to see a tag in Cost Explorer you first have to activate it as a cost allocation tag in Billing.
• Azure: resources do not inherit their resource group's tags by default. You can enforce it with Azure Policy (the policy that inherits a tag from the resource group) or turn on tag inheritance in Cost Management, which only affects cost data.
• Google Cloud: cost uses labels, not tags (Google Cloud tags are for policies and firewalls). Labels only allow lower-case letters, numbers, hyphens and underscores, so use environment, team or costcenter.

Tag at the source with IaC

The most reliable way to make a resource born tagged is to define the tags in infrastructure as code. In Terraform, the default_tags block of the AWS provider and default_labels of the Google provider apply the tags to everything that provider creates. Azure has no provider-level equivalent: the usual approach is a common tag map merged into each resource, plus an Azure Policy that denies or completes anything arriving without them.

provider "aws" {
  region = "eu-west-1"

  default_tags {
    tags = {
      Environment = "production"
      Project     = "shop"
      Owner       = "platform-team"
      CostCenter  = "cc-sales"
      Team        = "platform"
    }
  }
}

How AAA Sentinel solves it

AAA Sentinel tackles tagging from four places, all fed by the same scan of your accounts:

• Three governance rules, included in every plan, that raise a finding for each resource missing the minimum tags. You see them in Active findings and in Analysis rules.
• The Tagging strategy page (Pro plan), which measures coverage per account, estimates unattributed spend and sorts untagged resources by cost.
• The "Tag" button (Business plan), which prepares an automation with the values you type; the agent runs it once someone approves it.
• The By tags (Pro plan) and Chargeback (Business plan) reports, which show how the spend ends up split.

The three rules: what exactly counts

Each cloud has its own rule, and they do not measure exactly the same thing:

• With two governance tags, the finding closes by itself on the next scan. There is no need to mark it as resolved.
• The finding lists the tags the resource has and the ones missing, and estimates no savings: its value is being able to attribute the cost, not reduce it.

Worked example: ACME

ACME, a fictional company, runs its online shop in one AWS account. It has spent two years creating resources by hand and with Terraform, and finance now wants to split the bill by team. After the first scan, Tagging strategy shows this:

Step 1: read Tagging strategy

The page sits in the menu under Tagging strategy and works on the latest completed scan of the account you pick at the top. From top to bottom:

• Four indicators: Taggable resources, Well tagged (those with at least two of the five tags), Unattributed cost and the five Governance tags.
• Tagging health: a diagnosis based on the well-tagged percentage. ACME, at 55%, lands on moderate coverage.
• Coverage by governance tag: what share of resources carries each of the five. It usually exposes the tag nobody sets; for ACME it is CostCenter.
• Coverage by resource type: the table from the worked example, sorted by untagged cost.
• Untagged resources with highest cost: the ten most expensive, with the tags they already have.
• Recommendations: the tag and resource type with the worst coverage, a warning when unattributed spend is high, and a reminder to move the tags into your IaC.

Step 2: tag the most expensive resources without leaving the platform

At ACME, the top of the list is orders-db, the RDS orders database: it only has Project=shop, one governance tag out of five. On the Business plan, the "Tag" button on that row opens the "Automate this finding" window:

• The window explains what will be done, the impact and how to revert it, and under Parameters asks for a value for each missing governance tag. ACME types Environment=production, Owner=payments-team, CostCenter=cc-payments and Team=payments.
• Clicking "Create automation" runs nothing yet: the action waits for approval in AI Agent, and the row's button switches to "Pending".
• When someone with approval rights (owner, admin or approver) approves it, the agent writes the tags on the resource. It is a low-risk action with no grace period.
• The agent adds the keys you entered and leaves the resource's other tags alone. Before writing, it stores the previous value of any key that already existed, so the change can be undone.
• On the next scan, orders-db has five governance tags and its finding disappears.
• Resources outside the top ten are tagged the same way from their finding, in Active findings.

Step 3: track progress in By tags

After the next scan, Reports → By tags shows the Tagging coverage of each of the five keys in the chosen account, alongside findings by region and by resource type and the spend breakdown by service. It is the quick view for tracking progress. ACME sets itself the goal of no key below 80%, which is also the threshold above which the platform stops recommending that tag.

Step 4: Chargeback, knowing how it is calculated

On the Business plan, Reports → Chargeback brings all your accounts together: total spend, Breakdown by account, top services and a Distribution by each governance tag, which splits spend into Tagged and Unassigned. It helps to know what is behind it:

• The split is by coverage, not by value: if 60% of an account's resources carry Team, 60% of its spend shows as Tagged. It does not yet separate Team=payments from Team=shop.
• To split by value, and cover untagged spend with virtual tagging rules, there is cost allocation on the FOCUS bill. We cover it in "From the cloud bill to cost per order: cost-centre allocation and unit cost across AWS, Azure and Google Cloud".
• Even so, the Unassigned share is the number to bring down, and it works well as a monthly indicator for the FinOps committee.

What it does not do yet

So there are no surprises:

• It does not stop resources from being created untagged: that happens in the cloud, with Tag Policies, Azure Policy or checks in your IaC pipeline.
• It does not bulk-tag in one click: each resource is one automation with its own values and approval.
• It does not recognise keys spelled differently: CostCenter or costcenter yes; Cost-Center or cost_center, on AWS and Azure, no. On Google Cloud, where labels are lowercase, cost-center, cost_center and costcenter all count, and env counts as environment.
• Unattributed cost figures are estimates based on each service's cost, not a resource-by-resource allocation.

Checklist to get started

With this in place, the next time someone asks who owns a cost you will have an answer, and the ownerless share will shrink every month.

• Five agreed keys, always spelled the same: Environment, Project, Owner, CostCenter and Team.
• default_tags or default_labels in your IaC, and a cloud policy that blocks anything arriving untagged.
• Accounts connected and scanned, and governance findings reviewed in Active findings.
• Tagging strategy reviewed every week, starting with the most expensive resources.
• The agent's write permission enabled if you will tag from the platform (Business plan).
• A coverage goal per key, for example 80%, and the Unassigned share in Chargeback as a monthly indicator.