AWS CoPACommonwealth of Pennsylvania

← Now We Know archive

Governance

Tagging: a label until you govern it

Week of July 13, 2026Topic: Tagging & tag governance

This issue covers tagging, the small key-value labels you can attach to almost every AWS resource, and the governance around them.

Why this matters

In a shared AWS environment where many teams, business units, and projects all run resources, you cannot answer "how much is each team spending," "which resources belong to a given project," or "which data is regulated" unless the resources carry consistent tags. Cost allocation, access control, automation, and compliance reporting all read from the same tags. When the tags are missing or inconsistent, every one of those jobs breaks at once.

The trap is treating tags as free-form labels each team invents on its own. One team writes CostCenter, another costcenter, a third Cost_Center. Tag keys and values are case sensitive, so to AWS those are three different tags, and your cost report splits into three columns that do not add up. The fix is not more tags, it is governance: a standard, a way to enforce it, and the switch that turns tags into billing data.

Rule of thumb: decide the tag standard first, enforce it at creation, and remember that three different AWS features do the standardizing, the enforcing, and the cost reporting.

Quick context

The four jobs tags do

Tag policies (AWS Organizations): the standard

Service control policies (SCPs): the enforcement

Cost allocation tags (Billing): the bill

How ABAC works with tags

This is the access-control payoff, and it is why tags are worth the discipline. Instead of writing a new IAM policy every time a team spins up a project, you write one policy that compares tags:

Now an engineer on the Blue project can touch Blue resources and nothing else, an engineer on the Green project can touch Green resources, and you never edited the policy to add either of them. The same tags that split the bill also draw the access boundary. The one thing to get right: protect who can set the tags, because in ABAC the tag is the permission.

What changed recently (worth knowing)

When not to use it / tradeoffs

Quick decision guide

  • Want a consistent tag standard and a report of who is off it? Use tag policies in AWS Organizations, starting in reporting mode.
  • Need to require a tag on every new resource, no exceptions? Add a service control policy that denies creation without it, or enforce required keys through tag policies in your IaC pipeline.
  • Want to see spend by team, project, or environment? Activate those tags as cost allocation tags in the Billing console, from the management account.
  • Want access to scale across many teams without new policies each time? Use ABAC: match a principal tag to a resource tag in one IAM policy.
  • Need to find and fix what is already untagged? Use Tag Editor and the AWS Config required-tags rule to locate and remediate.

AWS references