Outcome
By the end of this lesson, you will be able to read the Tag Coverage widget, interpret the trend, and execute a coverage-improvement plan that moves untagged resources from 30%+ down to under 5%.
| Tier | Architect |
| JTBD | ”Drive tag coverage to a level where reports are reliable enough to act on.” |
| Personas | FinOps Lead · Platform Engineer · Engineering Leader |
| Prerequisites | M3.5.L1-L3 (showback dimensions, team + tag attribution) |
| Time | 9 minutes |
| Bloom verb | Read (Remember), Interpret (Analyze), Execute (Apply) |
1. Concept
Tag coverage is the percentage of cost-bearing resources that have the tags required for attribution. It is the single highest-leverage number for showback quality. Below ~70%, attribution reports are unreliable enough that engineers stop trusting them; above ~95%, the reports become the source of truth for cross-team cost conversations.
TAG COVERAGE WIDGET (dashboard, default view)───────────────────────────────────────────────────── TAGGED 87% ████████████████████░░░ UNTAGGED 13% ░░░░░░░░░░░░░░░░░░░░░░░
TRENDING ↑ (up 4 percentage points from 90 days ago)
GOAL: < 5% untagged STATUS: above target; ongoing work to close gapWhy coverage matters
TAGGED resources: Attribution works for every report dimension Team accountability is meaningful Per-environment views are complete Compliance evidence is auditable Cross-team chargeback is defensible
UNTAGGED resources: Show up in the Unattributed bucket Cost is not attributable to teams / cost-centers / initiatives Hard to investigate or budget Compliance: untagged spend is a finding Report reliability degrades proportionallyThe trust dynamic matters more than people realize. Once a FinOps lead presents a report with 20% Unattributed, engineers point at the gap rather than discussing the 80% that is attributable. Coverage drives whether the conversation moves forward.
Coverage targets by maturity
COVERAGE % FINOPS MATURITY STAGE REPORTS RELIABILITY──────────────────────────────────────────────────────────────────≥ 95% Run / mature Reports trusted as source of truth
90-95% Walk / mature Reports trusted with small caveats
80-90% Walk / mid Reports informative; engineers spot-check
70-80% Crawl / late Reports useful for trends; questionable for absolute attribution
< 70% Crawl / early Reports flag patterns; attribution unreliableThe 95% target is achievable for most orgs that commit to the discipline. The 70% baseline is where many orgs start; the path from 70% to 95% is well-traveled.
Closing the coverage gap
Untagged resources come from a few specific sources, each with a standard fix:
SOURCE OF UNTAGGED FIX──────────────────────────────────────────────────────────────────Pre-policy resources (provisioned Run auto-tagger; acceptbefore tag policy was set) high-confidence predictions; manual-tag the top spenders
Manual cloud-console provisioning IaC discipline + auto-tagger;(engineer clicked through console block console provisioningwithout tags) for ongoing work
Different naming conventions Standardize tag values via(env vs environment, Prod vs prod) tag taxonomy; auto-tagger handles common variants
Acquired company's resources Bulk tagging using their existing inventory + ongoing discipline
Internal accounts (security, shared Tag everything, even whenservices) where engineers forget obvious; reports need tags to roll up correctly
Auto-deployed resources from third- Configure auto-tag policiesparty tools (Terraform modules, that tag based on creator,managed services) path, or other signalsThe mix matters for the remediation plan. An estate where most untagged spend comes from one cause needs a single intervention; an estate with mixed causes needs a multi-front approach.
The auto-tagger compounds
ZopNight’s auto-tagger (T2.M2.8) is the primary lever for closing the gap at scale. It predicts likely tag values based on resource attributes, naming patterns, and customer-accepted training data. Combined with manual cleanup:
COVERAGE ARC for a typical 70%-starting customer:
WEEK 0: 70% tagged (baseline) Cause: pre-policy + manual provisioning
WEEK 1: Run auto-tagger; accept high-confidence predictions Coverage: 80% (+10pp)
WEEK 2: Manual cleanup of top-15 spend Unattributed resources Coverage: 85% (+5pp from few high-value tags)
WEEK 4: Turn on IaC tag enforcement in CI/CD New resources land tagged Coverage: 88% (+3pp; bigger effect over time)
WEEK 8: Auto-tagger on slow-drift recently-untagged resources Acquired company's resources finished tagging Coverage: 92% (+4pp)
WEEK 12: Drift detection enabled; quarterly review cadence Coverage: 94% (stable target)
WEEK 20: Manual close on long-tail edge cases Coverage: 96% (steady state)The arc is reproducible across customers. Week 1-2 sees the biggest jumps; weeks 4+ are about preventing regression.
Tracking the trend
TAG COVERAGE TREND CHART (90 days, weekly):
100% ┐ 95% ┤ ●● 90% ┤ ●● 85% ┤ ●●●●● 80% ┤ ●●●●● 75% ┤ ●●●● 70% ┤●●● └───────────────────────────────────────────── Week 0 Week 4 Week 8 Week 12 Week 16Three trend shapes to recognize:
UPWARD Active improvement; auto-tagger + manual work is paying off
STABLE (at target) Ongoing maintenance keeping coverage in place; drift detection catching regressions
DOWNWARD New resources arriving untagged faster than old ones are getting tagged. Source: probably manual provisioning or IaC without enforcement. Fix the source.A downward trend is a signal of process drift, not a tactical problem. Tagging more resources will not fix the underlying source; you have to identify why new resources are arriving untagged.
Per-key coverage
Tag coverage can be reported per-key:
KEY COVERAGE: team: 94% ✓ environment: 89% cost_center: 73% ← lowest project: 62% ← intentionally optional? application: 88%The overall “Tag Coverage” widget shows the union; per-key views surface which specific tag is the bottleneck. cost_center lagging is common; engineers think in team, but finance asks in cost_center, so tag discipline tends to lag the finance-relevant keys.
How ZopNight uses tag coverage
The Tag Coverage widget queries the resource inventory against the org’s required-tag set (configured in Settings → Tag policies). A resource is “tagged” if it has all required keys; “untagged” if any required key is missing. The percentage shown is by spend, not by resource count: this prioritizes the high-impact resources.
For drift detection, ZopNight monitors week-over-week coverage and surfaces alerts when coverage drops more than 2 percentage points in a week. The alert links directly to the resources that became untagged, with the suspected cause (often a specific Terraform module or cloud account).
2. Demo
A 12-week coverage improvement journey:
ORG: 60-engineer SaaS company, $180K/month cloud spend
WEEK 0 BASELINE: Tagged: 62% Untagged: 38% ($68K/month untagged) Top causes: pre-policy resources, manual console provisioning, acquired company's tags missing
WEEK 1: Action: Run auto-tagger across the estate Result: 85 high-confidence tag predictions accepted Coverage: 76% (+14pp) Untagged: $43K/month
WEEK 2: Action: Manual cleanup of top-15 Unattributed resources (rep $35K/month spend) Result: 14/15 successfully tagged Coverage: 81% (+5pp)
WEEK 4: Action: Turn on Terraform tag enforcement in pre-merge CI Result: Future-resource compliance ~100% Coverage: 83% (+2pp; effect grows over time)
WEEK 8: Action: Acquired-company tag migration (manual) Result: Acquired estate fully tagged Coverage: 89% (+6pp)
WEEK 12: Action: Drift detection enabled; weekly review cadence Result: Coverage stable; small drift caught early Coverage: 93% (stable)
WEEK 24 (6 months in): Coverage: 95% (steady state) Untagged: $9K/month (5% of total) Report reliability: high; engineers trust the numbersThe visible benefit at week 24: cross-team cost conversations stop with “but what about the Unattributed bucket?” and start with productive optimization discussions.
3. Hands-on (5 min)
Check your Tag Coverage widget:
CURRENT COVERAGE: _____ %TREND (90 days): ↑ stable / ↓ (which?)
PER-KEY COVERAGE (lowest 3): __________ _____ % __________ _____ % __________ _____ %
PRIMARY CAUSE OF UNTAGGED (best guess): □ Pre-policy resources □ Manual console provisioning □ IaC without tag enforcement □ Acquired company's resources □ Naming-convention variants □ Other: __________
NEXT-90-DAYS PLAN: Action 1 (highest leverage): __________ Action 2: __________ Action 3: __________
TARGET COVERAGE (90 days from now): _____ %If you don’t have visibility into per-key coverage, that’s the first thing to fix: without it, you’re guessing which key is the bottleneck.
4. Knowledge check
Q1
Tag coverage at 87%:
A. Excellent: call it done
B. Good but room for improvement. Walk-stage orgs land here; Run-stage targets 95+. The path is auto-tagger acceptance + manual cleanup of top spenders + IaC enforcement to prevent regression. 87 → 95 is a 8-percentage-point lift, usually 4-8 weeks of focused work.
C. Failing
D. Acceptable forever
Show answer
Correct: B. Above 80 is good; 95+ is the target. The lift from 87 to 95 is tractable.
Q2
Coverage trending downward over 30 days. Most likely cause:
A. ZopNight measurement bug
B. New resources are being provisioned without tags faster than old ones are being tagged. Sources: manual cloud-console provisioning, IaC modules that don’t enforce tags, third-party tools auto-deploying without tag inputs. Fix the source: tagging more old resources won’t reverse the trend if new ones keep landing untagged.
C. Random
D. Cloud quotas
Show answer
Correct: B. Downward trend is process drift, not a tactical problem. Identify the source and fix the inflow.
Q3
The Tag Coverage widget appears on:
A. Per-resource detail only
B. The org-level dashboard, visible to anyone reviewing the org’s tagging health. It is a public KPI inside ZopNight; everyone sees the same number, which drives shared accountability. The widget links to the Unattributed resource list for direct action.
C. Settings only
D. Random
Show answer
Correct: B. Visibility drives action. Hiding the number would let it drift.
5. Apply
The Tag Coverage widget lives on the org-level dashboard. Click through to the Unattributed resource list for direct action (app.zopnight.com/dashboard → Tag Coverage widget).
For sustained improvement, schedule a weekly 30-minute review during the “Operate” cadence: glance at trend, click into any drops, action via auto-tagger or manual cleanup.
Related lessons
- L1: Pick the dimension
- L2: Team attribution
- L3: Tag attribution
- L5: Unit economics (next)
- T2.M2.8: Auto-tagger
- T5.M5.1: Tagging discipline
Glossary terms touched
Tag coverage · Coverage trend · Per-key coverage · Drift detection