A tagging policy template is filled in by the cloud owner together with finance before the second account exists, or as soon as allocation starts failing on missing tags; it records which keys are mandatory, which values are allowed, who maintains them and what happens to a resource without a tag. Why tags carry allocation and where they stop working is explained on tagging policy; this page is the document itself, to copy and fill in. The decision it records is the value list: from the effective date, a resource without a valid value counts as unallocated.
The template
Tagging policy <organisation>, version <1.0>, effective <date>, owner <role>
1. Scope. This policy applies to every resource in <AWS, Azure, Google Cloud> that produces a billing line, and to the accounts, subscriptions and projects themselves. It applies to newly created resources from <date> and to the existing estate from <backfill date>.
2. Mandatory keys. Every resource carries these keys with a value from the named source.
| Key | Allowed values | Example | Source of the value list | Maintained by |
|---|---|---|---|---|
cost-center | cost centres from <ERP system> | <4711> | <finance, export of date> | <finance> |
owner | team name from <directory> | <platform> | <directory> | <platform team> |
environment | prod, staging, dev, test | prod | this policy | <platform team> |
application | application from <service catalogue> | <checkout> | <service catalogue> | <architecture> |
<further key> | <values> | <example> | <source> | <role> |
3. Optional keys. Allowed, with fixed values; an optional key without a valid value is treated as missing.
| Key | Allowed values | Purpose |
|---|---|---|
project | project id from <project list> | report time-boxed cost separately |
schedule | office-hours, always-on | the basis for shutdown schedules |
expires-on | date YYYY-MM-DD | deletion deadline for temporary resources |
data-classification | public, internal, confidential | storage and region requirements |
4. Spelling. Keys and values in lower case, words separated by hyphens, no spaces, no accented characters, at most <63> characters. The same spelling holds on every provider; where a provider distinguishes upper and lower case, only the form fixed here counts.
5. Enforcement.
| Provider | Mechanism | Effect | Responsible |
|---|---|---|---|
| AWS | Tag policy in AWS Organizations for the keys in section 2, enforced_for on <services>; Config rule required-tags | Wrong values are rejected, missing keys reported | <platform team> |
| Azure | Azure Policy: require a tag on resources (deny) for <keys>, inherit a tag from the resource group (modify) | Creation without the tag is rejected, group values inherited | <platform team> |
| Google Cloud | Label requirement in the <Terraform pipeline>; custom organisation policy constraints for <Compute Engine> | Pipeline rejects, constraint rejects | <platform team> |
6. Exceptions. A resource that cannot or must not carry a mandatory key is listed here with its reason and deadline; everything else is a violation.
| Resource or service | Reason | Approved by | Valid until |
|---|---|---|---|
<service without tag support> | <provider does not support tags> | <role> | <date> |
<resource> | <reason> | <role> | <date> |
7. Untagged resources. A resource without a valid mandatory key is reported to the account owner <7> days after creation, charged to that owner's cost centre after <30> days and listed in the monthly review. Cost that cannot be assigned to an account owner goes to <holding cost centre>.
8. Changes and review. <role> changes the value list through <process, such as a pull request on the policy repository>; <role> reviews the policy <quarterly>. Coverage per mandatory key is reported monthly, target <95> percent of cost.
| Version | Date | Change | Approved by |
|---|---|---|---|
<1.0> | <date> | first version | <finance and platform team> |
How to fill it in
Scope: name the providers one by one, because enforcement has a different name on each, and give the existing estate a second date; AWS backfills cost allocation tags for up to twelve months, the others do not.
Mandatory keys: four are enough for showback and chargeback, a fifth only when a report needs it. The value list comes from a system somebody already maintains, never from the policy itself: cost-center from the ERP, owner from the directory. Who charges the cost later is fixed in the chargeback policy.
Spelling: Google Cloud labels allow only lower-case letters, digits, underscores and hyphens, so that form holds on all three providers; the providers' differences are on tags and labels.
Enforcement: write down what runs today, not what is planned; the tools and their limits are on tagging enforcement and policy as code. A policy with deny starts in a test account.
Exceptions: every row has a deadline; an exception without a date is a second standard. Untagged resources: the deadline in days and the holding cost centre are the numbers finance sets; how to measure the unallocated cost is on tag coverage and untagged cost.
Review: the role in section 8 is the one the cost ownership RACI makes accountable for allocation.
How to adapt it
One team: owner goes, environment and application stay, because the next report asks by environment; enforcement is a check in the pipeline, not an organisation policy. Several teams: owner becomes mandatory, and inheritance from the resource group or the account replaces tagging single resources wherever the provider offers it.
One provider: section 5 shrinks to one row and section 4 adopts that provider's rules. Three providers: the spelling follows the strictest one, and the value list is maintained in one place and distributed to all three.
Startup: two mandatory keys, environment and owner, with cost-center only once finance runs cost centres; the deadline in section 7 is short because the estate is small. Finance-led: cost-center is the first key, its value list is exported from the ERP and reconciled monthly, and coverage per cost centre belongs in the showback statement (template).
Sources
Read on 2026-10-21. FinOps Foundation, Allocation (CC BY 4.0), defining and publishing a tagging schema, tag policies in AWS Organizations, Config rule required-tags, backfill cost allocation tags, define your tagging strategy, policy definitions for tagging resources, tag inheritance in Cost Management, best practices for labels, custom constraints for Compute Engine.