Cloud Tagging Best Practices for Cost Allocation
Tags are key-value metadata on resources. Each cloud calls them something slightly different and enforces different rules.
Cloud tagging is attaching key-value metadata to resources so that cost, ownership, and policy can be tracked by something other than the account a resource happens to live in. AWS and Azure call these tags; Google Cloud calls the equivalent labels and uses the word tags for a separate, policy-oriented feature. A tagging strategy is the documented set of keys, allowed values, owners, and enforcement rules that keeps that metadata consistent.
Start with a small required set
Require only the keys that answer questions you actually report on. Three cover allocation and operations for most purposes:
environment, with a fixed value list such asdev,staging,prodteamorowner, naming who answers for the resourceapplicationorservice, naming what it is part of
Add cost-center only if finance needs it on the resource; mapping it from team or application in a rule means a reorganization does not force retagging. Publish allowed values, not just keys. dev, Dev, and development are three different values to a billing report.
Know each provider’s rules
| AWS tags | Google Cloud labels | Azure tags | |
|---|---|---|---|
| Per-resource limit | 50 user-created tags | 64 labels | 50 name-value pairs |
| Key length | 1 to 128 characters | 1 to 63 characters | up to 512 (128 on storage accounts) |
| Value length | 0 to 256 characters | up to 63 characters | up to 256 |
| Case | keys and values are case sensitive | lowercase letters, digits, underscores, dashes; key starts with a letter | names case-insensitive for operations, values case sensitive |
| Inheritance | none by default | none by default | resources do not inherit resource group or subscription tags |
Two consequences follow. A convention that works on AWS, such as CostCenter, is invalid as a Google Cloud label key, so pick lowercase, hyphenated keys everywhere. And a value longer than 63 characters will not survive on Google Cloud.
Make tags reach the bill
On AWS, user-defined tags do nothing for billing until they are activated as cost allocation tags in the Billing and Cost Management console, which only the management account can do. Allow up to 24 hours for a new key to appear and another 24 to activate. A backfill request can apply activation to up to twelve prior months, for resources that already carried the tag. On Azure, Cost Management’s tag inheritance setting can apply resource group and subscription tags to usage records without retagging resources. On Google Cloud, labels flow to billing reports and the BigQuery export directly.
Enforce at creation, repair afterwards
- AWS: tag policies in AWS Organizations standardize keys, case, and allowed values and can block noncompliant tagging operations, but untagged resources are not evaluated by a tag policy. To require a tag at creation, use an IAM or service control policy condition on
aws:RequestTag. - Azure: Azure Policy has built-in definitions to require a tag, add a tag, and inherit a tag from the resource group or subscription. The modify-effect policies can remediate existing resources through a remediation task.
- Google Cloud: labels cannot be used as conditions in policies; Google Cloud tags can. Plan label enforcement in your provisioning pipeline, for example in infrastructure-as-code review.
Enforcement never reaches everything: resources that predate the standard, resources that do not support tags, and resources created by services on your behalf. Measure coverage by cost, not by resource count, since one untagged database can matter more than a hundred untagged snapshots.
Filling gaps with ZopNight
ZopNight reads cloud tags, GCP labels, and Azure tags for cost attribution and shows tag coverage as tagged versus untagged. Its smart tags derive values from tagging policies for resources missing a key; accepted values count toward attribution in ZopNight and can be written back to the provider on demand. Writing back is a change to the resource, so it needs an account connected with read and write access.
Related: cloud cost allocation and cost centers.
Questions we get a lot.
If yours isn't here, email us and we'll answer directly.
Why do my AWS tags not show in Cost Explorer?
User-defined tags must be activated as cost allocation tags by the management account. After tags are applied it can take up to 24 hours for the key to appear for activation and up to 24 hours more to activate.
Do Azure resources inherit resource group tags?
No. Use Azure Policy's inherit-a-tag definitions to copy tags onto resources, or Cost Management's tag inheritance setting, which applies them to usage records rather than to the resources.
Can I use the same keys on AWS and Google Cloud?
Yes, if they are lowercase and short. Google Cloud label keys allow only lowercase letters, digits, underscores, and dashes, up to 63 characters, and must start with a letter.