Outcome
By the end of this lesson, you will be able to read the Tag Coverage card, track it over time yourself, and execute a coverage-improvement plan that moves untagged resources from 30%+ down to under 5%.
| Prerequisites | M4.5.L1-L3 (showback dimensions, team + tag attribution) |
| Time | 9 minutes |
1. Concept
Coverage is the share of your spending that carries the tags needed to attribute it.
It is the one number that decides whether showback works at all. Below about 70%, engineers find a gap, stop believing the report, and their trust is slow to win back. Above about 95%, the report becomes what people quote at each other in meetings.
TAG COVERAGE CARD (Cost Reports → Tags)───────────────────────────────────────────────────── Tag Coverage 87% ████████████████████░░░ $23.4K untagged · 212 resources
(the card shows today's figure only; the goal and the trend are yours to track) GOAL: < 5% untaggedWhy coverage matters
TAGGED resources: Attribution works for every report dimension Team accountability is meaningful Per-environment views are complete Compliance evidence is auditable Cross-team chargeback is defensible
UNTAGGED resources: Show up in the Unattributed bucket Cost is not attributable to teams / cost-centers / initiatives Hard to investigate or budget Compliance: untagged spend is a finding Report reliability degrades proportionallyThe trust dynamic matters more than people realize. Once a FinOps lead presents a report with 20% Unattributed, engineers point at the gap rather than discussing the 80% that is attributable. Coverage drives whether the conversation moves forward.
Coverage targets by maturity
COVERAGE % FINOPS MATURITY STAGE REPORTS RELIABILITY──────────────────────────────────────────────────────────────────≥ 95% Run / mature Reports trusted as source of truth
90-95% Walk / mature Reports trusted with small caveats
80-90% Walk / mid Reports informative; engineers spot-check
70-80% Crawl / late Reports useful for trends; questionable for absolute attribution
< 70% Crawl / early Reports flag patterns; attribution unreliableThe 95% target is achievable for most orgs that commit to the discipline. The 70% baseline is where many orgs start; the path from 70% to 95% is well-traveled.
Closing the coverage gap
Untagged resources come from a few specific sources, each with a standard fix:
SOURCE OF UNTAGGED FIX──────────────────────────────────────────────────────────────────Pre-policy resources (provisioned Write a tagging policy;before tag policy was set) accept the tags it derives; manual-tag the top spenders
Manual cloud-console provisioning IaC discipline + Smart Tags;(engineer clicked through console block console provisioningwithout tags) for ongoing work
Different naming conventions Standardize tag values via(env vs environment, Prod vs prod) tag taxonomy; Smart Tags handles common variants
Acquired company's resources Bulk tagging using their existing inventory + ongoing discipline
Internal accounts (security, shared Tag everything, even whenservices) where engineers forget obvious; reports need tags to roll up correctly
Auto-deployed resources from third- Configure Smart Tag policiesparty tools (Terraform modules, that derive tags from name,managed services) type, existing tags or a lookupThe mix matters for the remediation plan. An estate where most untagged spend comes from one cause needs a single intervention; an estate with mixed causes needs a multi-front approach.
Smart Tags compounds the coverage
ZopNight’s Smart Tags (T2.M2.8) is the primary lever for closing the gap at scale. It derives tag values from rules you write in tagging policies, using resource attributes such as name, type and region, existing tags, or a lookup table, and each derived tag stays pending until you accept it. Combined with manual cleanup:
COVERAGE ARC for a typical 70%-starting customer:
WEEK 0: 70% tagged (baseline) Cause: pre-policy + manual provisioning
WEEK 1: Run Smart Tags; accept the derived values that identify an owner Coverage: 80% (+10pp)
WEEK 2: Manual cleanup of top-15 spend Unattributed resources Coverage: 85% (+5pp from few high-value tags)
WEEK 4: Turn on IaC tag enforcement in CI/CD New resources land tagged Coverage: 88% (+3pp; bigger effect over time)
WEEK 8: Smart Tags on slow-drift recently-untagged resources Acquired company's resources finished tagging Coverage: 92% (+4pp)
WEEK 12: Weekly coverage check in the review; quarterly deep review Coverage: 94% (stable target)
WEEK 20: Manual close on long-tail edge cases Coverage: 96% (steady state)The arc is reproducible across customers. Week 1-2 sees the biggest jumps; weeks 4+ are about preventing regression.
Tracking the trend
The card shows one current percentage. ZopNight does not chart coverage over time, so keep the trend yourself: note the card’s figure at each weekly review.
YOUR WEEKLY LOG (from the card, one reading per week):
Week 0 70% Week 8 86% Week 2 76% Week 12 90% Week 4 80% Week 16 95% Week 6 83%Three trend shapes to recognize in your log:
UPWARD Active improvement; Smart Tags + manual work is paying off
STABLE (at target) Ongoing maintenance keeping coverage in place; the weekly check catches regressions
DOWNWARD New resources arriving untagged faster than old ones are getting tagged. Source: probably manual provisioning or IaC without enforcement. Fix the source.A downward trend is a signal of process drift, not a tactical problem. Tagging more resources will not fix the underlying source; you have to identify why new resources are arriving untagged.
Coverage for a single key
The card counts a resource as tagged if it carries any tag at all, so it cannot tell you which key is the bottleneck. Work it out per key: filter Cost Reports → Tags to that key and compare its tagged cost with total spend.
KEY COVERAGE (worked out by hand, tagged cost / total spend): team: 94% environment: 89% cost_center: 73% ← lowest project: 62% ← intentionally optional? application: 88%cost_center lagging is common; engineers think in team, but finance asks in cost_center, so tag discipline tends to lag the finance-relevant keys. To enforce a specific key going forward, use a tagging policy.
How ZopNight uses tag coverage
The Tag Coverage card on Cost Reports → Tags divides tagged cost by tagged plus untagged cost, where “untagged” means a resource carrying no tags at all. It does not check a required-key set, so a resource with any tag counts as tagged; use tagging policies to check specific keys. The percentage shown is by spend, not by resource count: this prioritizes the high-impact resources. The card is green at 80% or more, amber at 50% or more, red below.
ZopNight does not alert on coverage drops. Your weekly reading is the drift check: if the figure falls, open the Tags report’s untagged resources and look for a shared cause (often a specific Terraform module or cloud account).
2. Demo
A 12-week coverage improvement journey:
ORG: 60-engineer SaaS company, $180K/month cloud spend
WEEK 0 BASELINE: Tagged: 62% Untagged: 38% ($68K/month untagged) Top causes: pre-policy resources, manual console provisioning, acquired company's tags missing
WEEK 1: Action: Run Smart Tags across the estate Result: 85 derived Smart Tag values accepted Coverage: 76% (+14pp) Untagged: $43K/month
WEEK 2: Action: Manual cleanup of top-15 untagged resources (rep $9K/month spend) Result: 14/15 successfully tagged Coverage: 81% (+5pp)
WEEK 4: Action: Turn on Terraform tag enforcement in pre-merge CI Result: Future-resource compliance ~100% Coverage: 83% (+2pp; effect grows over time)
WEEK 8: Action: Acquired-company tag migration (manual) Result: Acquired estate fully tagged Coverage: 89% (+6pp)
WEEK 12: Action: Weekly coverage reading added to the FinOps review Result: Coverage stable; small drift caught early Coverage: 93% (stable)
WEEK 24 (6 months in): Coverage: 95% (steady state) Untagged: $9K/month (5% of total) Report reliability: high; engineers trust the numbersThe visible benefit at week 24: cross-team cost conversations stop with “but what about the Unattributed bucket?” and start with productive optimization discussions.
3. Hands-on (5 min)
Check your Tag Coverage card:
CURRENT COVERAGE: _____ %LAST WEEK'S READING: _____ % (start a log if you have none)
PER-KEY COVERAGE (lowest 3, from Cost Reports → Tags by key): __________ _____ % __________ _____ % __________ _____ %
PRIMARY CAUSE OF UNTAGGED (best guess): □ Pre-policy resources □ Manual console provisioning □ IaC without tag enforcement □ Acquired company's resources □ Naming-convention variants □ Other: __________
NEXT-90-DAYS PLAN: Action 1 (highest leverage): __________ Action 2: __________ Action 3: __________
TARGET COVERAGE (90 days from now): _____ %If you have not worked out per-key coverage before, do it now for your two most important keys: without it, you’re guessing which key is the bottleneck.
4. Knowledge check
Q1
Tag coverage at 87%:
A. Excellent, so call it done
B. Good but room for improvement
C. Failing against the target
D. Acceptable indefinitely now
Show answer
Correct: B. Walk-stage orgs land here; Run-stage targets 95+. The path is Smart Tags acceptance + manual cleanup of top spenders + IaC enforcement to prevent regression. 87 → 95 is a 8-percentage-point lift, usually 4-8 weeks of focused work. Above 80 is good; 95+ is the target. The lift from 87 to 95 is tractable.
Q2
Coverage trending downward over 30 days. Most likely cause:
A. New resources are being provisioned without tags faster than old ones are being tagged
B. A ZopNight measurement bug somewhere in the coverage calculation itself
C. Cloud provider tag quotas being hit on the newly created resources each week
D. The tagging policy was disabled at some point during the last period
Show answer
Correct: A. Sources: manual cloud-console provisioning, IaC modules that don’t enforce tags, third-party tools auto-deploying without tag inputs. Fix the source: tagging more old resources won’t reverse the trend if new ones keep landing untagged. Downward trend is process drift, not a tactical problem. Identify the source and fix the inflow.
Q3
The Tag Coverage card appears on:
A. The per-resource detail page only, and nowhere else at all in the product
B. The org-level dashboard, as a Tag Coverage widget type of its own
C. The Settings pages only, under the tagging policy section itself
D. Cost Reports → Tags, as a card above the tag breakdown
Show answer
Correct: D. The Tag Coverage card sits on Cost Reports → Tags. There is no separate Tag Coverage dashboard widget; on a dashboard, the Cost reports widget’s Tags tab shows the untagged share. Everyone with report access sees the same number, which drives shared accountability.
5. Apply
The Tag Coverage card lives on Cost Reports → Tags, above the breakdown of tag keys and values.
For sustained improvement, schedule a weekly 30-minute review during the “Operate” cadence: note the card’s percentage in your log, compare it with last week, and act on any drop via Smart Tags or manual cleanup.
Related lessons
- L1: Pick the dimension
- L2: Team attribution
- L3: Tag attribution
- L5: Unit economics (next)
- T2.M2.8: Smart Tags
- T3.M3.1: Tagging discipline