The problem with ten-tag policies
Owner, cost center, environment, application, project, criticality, end date, team… On paper, a complete tagging policy tells you everything. In practice:
- tags are incomplete: nobody fills in ten fields every time they create a resource;
- they are inconsistent: "Prod", "prod", "PRD", "production";
- they drift from the CMDB: the owner changes, the tag doesn't follow;
- nobody maintains them over time.
As a result, part of the bill isn't tied to any team. Nobody looks at it, so nobody optimizes it.
The idea: one tag, and the CMDB for the rest
Most large enterprises already have a source of truth for their applications: the CMDB (ServiceNow or other). It knows the owner, cost center, business unit, criticality, often the environment. There is no point copying this information into tags that will eventually drift.
All you need is one mandatory tag, for example an application code, linking each cloud resource to the CMDB. Every other piece of information is retrieved by joining the two, in the dashboard.
How to enforce it
- At creation: on Azure, an Azure Policy denies creating a resource group without the tag, and another one makes resources inherit the tag from their resource group. On AWS, Tag Policies and Service Control Policies play the same role.
- On existing resources: remediation tasks apply the tag to resources already created.
- With controlled values: only codes that exist in the CMDB are accepted.
Check consistency automatically
A regular check compares the cloud and the CMDB: codes that don't exist, decommissioned applications still consuming, owners who have left. Each gap becomes an action, tracked in the dashboard along with tagging compliance.
Costs that can't be tagged (shared network, security, support) are allocated with simple allocation keys known to everyone.
What it changes
- Every cost is tied to an application and its owner.
- Showback, then chargeback, become possible: every team sees and owns its consumption.
- Optimization recommendations go to the right person.
- Budget alerts go to the right owner.
Mistakes to avoid
- Free-text tags with no list of allowed values.
- Tagging resources one by one instead of relying on inheritance from the resource group.
- Forgetting existing resources: a policy that only applies to new resources leaves the past untagged.
- Never measuring: without a compliance KPI, the drift comes back.
Tagging is the foundation of FinOps governance. Without it, no chargeback, no accountability, and savings that don't last.