Outcome
By the end of this lesson, you will be able to attribute cost across any tag dimension (cost-center, environment, project, campaign), distinguish cloud-native tags from ZopNight’s auto-tags, and know where tag attribution stops and team attribution starts.
| Prerequisites | M4.5.L1 (pick the dimension) · M4.5.L2 (team attribution) |
| Time | 9 minutes |
1. Concept
Team attribution maps cost onto teams, which are a real thing in the product with members and owners.
Tag attribution maps cost onto whatever you like. Cost centre, environment, project, campaign, business unit, application: any tag key your company already uses.
The flexibility is the point. Team attribution answers “who owns this.” Tag attribution answers “what category does this fall into.” Both can be true of the same resource at once, but each report answers one of them.
TAG ATTRIBUTION EXAMPLE QUERIES──────────────────────────────────────────────────────────────────By cost-center "Which cost-centers burn the most?"By environment "How does prod compare to staging?"By project / initiative "What did the replatforming cost?"By campaign "Was the Q2 launch profitable?"By compliance scope "PCI-scoped vs non- PCI spend?"Costs → Reports → Tags
SURFACE: Costs → Reports → Tags
FILTER: key=cost_center GROUP BY: value RESULT: cost_center=engineering-platform $24,000 cost_center=engineering-product $18,000 cost_center=marketing $5,800 cost_center=customer-success $3,200 cost_center=(not tagged) $4,000 ← coverage gap
TIME: monthly trend EXPORT: CSV / JSON / APIThe Tags report mirrors the Teams report’s structure but uses arbitrary tag keys instead of the team dimension.
Cloud-native tags vs auto-tags
Tags come from two sources, and ZopNight tracks both (plus how they combine):
SOURCE DESCRIPTION DIMENSION_SOURCE──────────────────────────────────────────────────────────────────Cloud-native Applied at provision time by "cloud" Terraform / CloudFormation / console / API
Auto-tag Derived by a tagging policy you "auto" write (Smart Tags, T2.M2.8); pending until you accept it, revocable later
Inherited Carried down from the resource's "inherited" parent resource
Mixed A row whose spend combines more "mixed" than one of the sources aboveBoth contribute to attribution. The dimension_source column on cost_allocation_daily lets reports filter to only-cloud-native (stricter) or all-tagged (more coverage). Most reports show the union.
Smart Tags is what makes tag coverage tractable at scale. Manual tagging discipline always slips; a derived tag closes a meaningful part of the gap automatically.
Filtering by tag value
QUERY: "Cost where tag environment=prod across all teams"
FILTER: dimension_type = tag dimension_key = environment dimension_value = prod
RESULT: Total prod-tagged spend for that key:value pair, narrowed further by provider or resource typeThe query is one or two filters away from any cost question that involves an environment, cost-center, or project attribute.
One tag pair per row, no team filter
QUESTION: "Cost where environment=prod AND team=platform"
TAGS REPORT FILTERS: tag key, tag value, provider, resource type, tag source, searchEACH ROW: one key:value pair (environment:prod)NOT AVAILABLE: a team filter, or an AND across two tags on the same resourceThe Tags report shows one key:value pair per row, and the Teams report takes no tag filter, so “X’s slice of Y” is not a single query. Answer it from the platform team’s resources (Teams page) by reading their environment tag, or, if the question recurs, give platform’s prod resources their own resource group.
Tag coverage matters
Tag attribution is only as good as the coverage:
SCENARIO: 81% of resources have `cost_center` tag
Cost Reports → Tags → key=cost_center cost_center=engineering-platform $24,000 (matched) cost_center=engineering-product $18,000 (matched) cost_center=marketing $5,800 (matched) cost_center=(not tagged) $4,200 (gap)
Coverage: 92% by spend, 81% by resource count Report reliability: high but incomplete
Worst case: a $4,200 chunk of spend cannot be attributed. An auditor or finance partner will ask about it.The Tag Coverage card on Cost Reports → Tags (L4) surfaces the coverage gap explicitly so it can be tracked and closed.
When tag attribution wins over team
USE CASE TAG IS RIGHT──────────────────────────────────────────────────────────────────Cost-center reporting (finance-driven) Yes: finance thinks in cost-centers; teams are an engineering concept
Environment breakdown Yes: environment crosses teams; tag is the right dimension
Project / initiative cost Yes: projects span teams and time; tag fits
Compliance scope Yes: PCI/HIPAA scope is attribute-driven
Marketing campaign cost Yes: campaigns are tagged events
Per-team accountability No: Teams dimension is first-class for thisA common pattern: finance views in cost_center tags, engineering views in team (the first-class dimension). Reports for each audience use the appropriate dimension.
Auto-tag governance
Auto-tags can be wrong. A tagging policy you write derives them, and each one stays pending until you accept it.
AUTO-TAG LIFECYCLE: Policy derives: "team=platform" for this resource, from a rule in your tagging policy Status: Pending (not used for attribution yet) Customer reviews: the Smart Tags page, pending tags Decision: Accept (the tag counts for attribution) or leave it pending Once accepted: Tag flows into attribution Revoke: returns it to pending; to stop a wrong tag for good, fix the tagging policyThe pending queue is the governance point. Accepting in bulk without review can introduce wrong tags; accepting nothing leaves coverage low. A weekly review of the pending queue is the typical cadence.
Tag taxonomy
Before deploying tag attribution at scale, the customer benefits from a tag taxonomy: a documented list of allowed keys and value patterns:
ALLOWED TAG KEYS (taxonomy): team Must be one of: platform, product, data, ml, ... environment Must be one of: prod, staging, dev, sandbox cost_center Must be one of: eng-platform, eng-product, ... project Free-form; recommended pattern: kebab-case campaign Free-form; recommended: YYYY-Q?-name format application Free-form; required for prod resources
DEPRECATED: cost-center (use cost_center) env (use environment)A taxonomy prevents tag-value drift (variants like prod / production / Prod) that fragments attribution. Tagging policies on the Policies page enforce the taxonomy.
How ZopNight uses tag attribution
Tag attribution is implemented through the same cost_allocation_daily table as team attribution, with dimension_type='tag'. The Costs → Reports → Tags surface queries this table with filters. Smart Tags writes auto-source tags into the same tag store, distinguished by dimension_source='auto'.
For customers transitioning to mature attribution, the recommended sequence is: stand up the taxonomy → enforce in IaC → run Smart Tags to close historical gap → manual cleanup of high-spend stragglers → quarterly review cadence.
2. Demo
A marketing campaign cost analysis:
SCENARIO: Q2 product launch campaign
SETUP: All campaign-related resources tagged: campaign=2026-Q2-launch
Includes: Lambda functions for the launch microsite CloudFront distribution for static assets S3 buckets for media RDS for landing-page leads Datadog monitoring scoped to campaign
QUERY in ZopNight: Costs → Reports → Tags → key=campaign, value=2026-Q2-launch Time: campaign window (April 1 → July 31)
RESULT: Total cost: $14,200 Per-service breakdown: Lambda $4,800 CloudFront $3,400 S3 $2,800 RDS $2,200 Datadog $1,000 Per-day trend: spike at launch (April 15), declining to zero by July 28
INTERPRETATION (presented to marketing + finance): Campaign generated $X revenue (tracked separately) Direct campaign cost (cloud): $14,200 Campaign ROI: revenue/cost ratio Efficiency: $/lead = $14,200 / lead_count
DECISION: Q3 campaign will use same tagging approach; we can compare ROI across campaigns over time.Tag attribution made this analysis possible. Without the campaign tag, the cost would have been spread across multiple teams’ accounts with no way to isolate the launch-specific spend.
3. Hands-on (5 min)
For your team, identify two tag dimensions worth tracking:
TAG DIMENSION 1: Key: __________ Why it matters: __________________________________________ Current coverage: _____ %
TAG DIMENSION 2: Key: __________ Why it matters: __________________________________________ Current coverage: _____ %
QUESTIONS this attribution would answer: 1. __________________________________________________________ 2. __________________________________________________________
If coverage is low (<70%): Run Smart Tags on the missing resources Manual-tag the top-spend missing resources Add the key to your tag taxonomy + IaC enforcement4. Knowledge check
Q1
A team wants to track “marketing campaign Q2” cost. Best dimension:
A. The team dimension itself
B. Isolating a cloud account
C. Tag with custom key=campaign
D. The environment tag value
Show answer
Correct: C. Flexible attribution by business event The campaign spans teams (engineering, marketing, ops); team attribution would split rather than aggregate. Tag attribution aggregates the entire campaign correctly. Campaigns cross teams; tags are the right dimension. The Q2 campaign tag aggregates regardless of which team provisioned the resource.
Q2
Cloud-native tag vs ZopNight Smart Tag attribution:
A. Same surface; both contribute to the same cost_allocation_daily table; the dimension_source column distinguishes provenance
B. Different surfaces entirely, with one surface for each of the two different kinds of tag involved in it
C. Cloud-native tags only, since Smart Tags do not count towards attribution at all anywhere in the entire product
D. Auto-tags are read-only previews and so never count towards anything at all in the reports
Show answer
Correct: A. Reports can filter to only cloud-native (stricter) or include auto-tags (more coverage). Auto-tags require customer acceptance before they take effect. Both contribute equally once accepted. Provenance is tracked for audit.
Q3
Tag coverage at 65%. The impact on attribution:
A. Nothing at all, since 65% is perfectly fine
B. Reports show 35% Unattributed for that tag key
C. Only the untagged third of it is affected
D. The reports remain completely 100% accurate
Show answer
Correct: B. Tag-driven attribution misses 35% of spend. Worth investing to lift coverage via Smart Tags, manual cleanup, and IaC enforcement. The remaining 35% becomes an Unattributed bucket in any Tags report filtered to that key. Coverage limits report reliability for that dimension. The unattributed portion is real spend that cannot be sliced by the chosen tag.
5. Apply
Query tag attribution at Cost Reports → Tags; pick a key, optionally a value, and narrow by provider or resource type. Smart Tags surfaces its derived values at Smart Tags for you to accept or revoke.
Define and enforce your tag taxonomy with tagging policies on the Policies page: this prevents value-drift over time.
Related lessons
- L1: Pick the dimension
- L2: Team attribution
- L4: Tag coverage (next)
- L5: Unit economics
- T2.M2.8: Smart Tags module