Tagging strategy: getting the most from tags

How to tag cloud resources, enforce tagging, and when to use cloud tags or virtual tags in CostGlass.

Tagging strategy: getting the most from tags

How to label your cloud resources so every pound of spend can be traced to a team, a product or an environment, and how CostGlass uses those labels.

Where in CostGlassCosts → Tag Explorer

PlanConcepts apply to all plans

Who can do thisAnyone can read; changing tags in a cloud needs access in that cloud

Time needed15 minutes to read

In short

A tag (called a label on Google Cloud) is a small key and value pair, such as team = payments, that you attach to a cloud resource.
Tags are how a bill is split by team, product or environment. Untagged resources are spend nobody owns.
Start with a short, agreed set of tags, enforce it in your cloud, and set it by default in your infrastructure-as-code.
Today CostGlass reads tags into cost views for AWS and Oracle Cloud. For other clouds, use Virtual tags to allocate spend without tagging.
Cloud tags and virtual tags work together: tag what you can at the source, use virtual tags to cover the rest and the shared costs.

What a tag is

A tag is a key and a value that you attach to a resource such as a virtual machine, a database or a storage bucket. For example, the key team with the value payments. Your cloud provider copies tags onto the bill (in some cases only after you switch this on), so cost can be grouped by them. Google Cloud calls them labels and Oracle Cloud has defined tags and free-form tags. This guide says "tag" for all of them.

Why it matters: a cloud bill is organised by service (for example "virtual machines"), but your business thinks in teams, products and environments. Tags connect the two. Without them, a finance person looking at a large bill cannot tell who should explain it.

How tags work in each cloud

Cloud	What they are called	What to know
AWS	Tags	You can add tags to most resources. For a tag to appear in your cost data it must be activated as a cost allocation tag in the AWS Billing console (Billing → Cost allocation tags). The Cost and Usage Report (CUR) only includes user-defined tags that you have activated. Activation is not retroactive: a tag shows up from the time you activate it, so activate your standard tags early.
Azure	Tags	Tags are set per resource, resource group or subscription. Azure does not copy a resource group's tags to its resources by default, so a resource can be untagged even when its group is tagged. Azure Policy can add or inherit tags automatically.
Google Cloud	Labels	Labels are attached to resources and projects. They appear in the billing export for the services that support them. Label keys are lowercase letters, numbers, hyphens and underscores.
Oracle Cloud (OCI)	Defined tags and free-form tags	Defined tags live in a namespace you create and can be controlled by policy. Free-form tags are simple key and value pairs. Cost reports carry both.
Alibaba Cloud, DigitalOcean, Linode	Tags	These clouds support tags on resources, but the billing data CostGlass reads from them does not carry per-resource tags today. See the table below.
Cloudflare, OpenAI, Anthropic, Datadog, Snowflake	Not applicable	Their billing has no tags. Group their spend with their own structures (projects, workspaces, zones) or with virtual tags.

Note

The exact console menus change from time to time. If a menu is not where this guide says, search your cloud's documentation for "cost allocation tags" (AWS), "tags" (Azure), "labels" (Google Cloud) or "tagging" (Oracle).

A recommended minimum tag set

Resist the urge to invent many tags. Five or six that everyone follows are worth far more than twenty that nobody does. A good starting point:

Key	Question it answers	Example values
`owner`	Who do we ask about this resource?	a team mailbox such as [email protected]
`team`	Which team pays for it?	payments, search, data
`environment`	Is it production or something else?	prod, staging, dev
`application`	Which product or service is it part of?	checkout, reporting
`cost-centre`	Which budget line does it belong to in finance?	a code your finance team already uses

Tip

Ask finance which breakdown they already report on, and make that your first tag. A tag that matches an existing report gets adopted quickly because someone is waiting for it.

CostGlass's default policy

The default required tags in Tag Compliance are Environment, Owner, Project and CostCenter. You can change them to match your own standard.

Naming conventions and case

Pick one style and write it down. For example all lowercase with hyphens: cost-centre. Do not mix CostCentre, cost_centre and costcentre.
Agree the allowed values for tags with a small set of answers (environment is prod, staging or dev, not also Production and production).
Never put secrets or personal data in tags. Tags are visible to anyone who can see the resource and appear on bills.
Keep values short and stable. A tag value that changes every week splits history into many groups.

Case sensitivity

Tag keys are case sensitive in most clouds: Team and team are two different keys. Billing exports can also change the case. For example, the AWS CUR 2.0 format lowercases tag keys and turns punctuation into underscores, so Name becomes name. The values are kept exactly as written.

CostGlass matches tag keys case-insensitively (in Tag Explorer, Tag Compliance and in virtual tag rules), so a mix of cases still lands in the same group. Even so, one consistent spelling in your cloud avoids confusion elsewhere.

Making sure tags actually get applied

Asking people to tag is not enough. Add a guard so an untagged resource is hard to create. These are general descriptions; follow your cloud's own documentation for the exact steps.

AWS: Tag Policies and SCPs: In AWS Organizations, a tag policy defines allowed keys and values and reports non-compliance. A service control policy (SCP) can deny creating certain resources when a required tag is missing from the request.
Azure: Azure Policy: Built-in policies can require a tag on resources, add a tag automatically, or copy a tag from the resource group. Use "modify" or "inherit" style policies to fix gaps without blocking people.
Google Cloud: organisation policy and labels: Use organisation policies and your deployment pipeline to require labels on projects and resources. Labels are often easiest to enforce at the project level.
Oracle Cloud: tag defaults: Tag defaults in a compartment apply defined tags automatically to new resources, and a tag can be marked required.

Set tags in your infrastructure-as-code

If your resources are created by code, the cleanest fix is to set the tags there once, for everything. With Terraform's AWS provider you can set default tags at the provider level, so every resource it creates inherits them:

Terraform: default tags (illustrative)

Other providers have similar settings or modules. Use them rather than copying tags onto each resource by hand.

Fixing what already exists (retro-tagging)

Find the gaps with Tag Compliance (AWS) or the "(untagged)" row in Tag Explorer.
Start with the biggest spend, not the largest number of resources. Ten untagged databases can cost more than a thousand small items.
Tag in bulk using your cloud's tagging tools, a script or the commands CostGlass generates, then check again.
Fix the source (your code or policy) so the gap does not come back.

Warning

Tagging in a cloud does not change past bills. Most clouds only include a tag in cost data from the time it is applied (and, on AWS, activated). History stays untagged. Use virtual tags when you need history allocated too.

How CostGlass uses your tags

Where	What it does with tags
Tag Explorer	Groups what each cloud billed by the value of one tag key, with coverage and a drill-down to resources.
Tag Compliance	Checks your AWS resources against a list of required tags and helps you fix gaps.
Cost Explorer	Choose Group by then a Tag: … entry to group by an AWS cost allocation tag. This one reads live AWS Cost Explorer data, so it needs an AWS connection that uses a role. A CUR-only connection returns an explanation instead of numbers.
Virtual tagging	Rules can match on a cloud tag, or take their value from one, so your real tags drive the allocation.

Which clouds' tags reach CostGlass today

This is the honest picture at the time of writing. Tag Explorer shows the same information per cloud on screen, under Tag coverage by cloud.

Cloud	Tags in CostGlass cost data?	Notes
AWS	Yes	Tags come from the resources in your Cost and Usage Report. Activate your tags as cost allocation tags in AWS first, then import a fresh report.
Oracle Cloud	Yes	Tags come from the tag columns of the Oracle cost report.
Azure	Not yet	The Azure cost data CostGlass reads carries no resource ids or tags, so tags cannot be tied to billed cost.
Google Cloud	Not yet	Billing export labels are not read yet.
Alibaba Cloud	Not yet	Bill files are not read for tags yet.
DigitalOcean, Linode	No	Invoices carry no resource ids or tags.
Cloudflare, OpenAI, Anthropic, Datadog, Snowflake	No	Their billing has no tags.
Kubernetes	No	Spend is grouped by cluster and namespace in Cost Explorer; workload labels are not part of billed cost.

Important

Tag your Azure and Google Cloud resources anyway: the tags are useful inside those clouds, and CostGlass support for them can grow. For allocation in CostGlass today, use virtual tags on those clouds.

Cloud tags or virtual tags?

Cloud tagsAt the source

Set on the resource itself, so every tool sees them.
Best for ownership, environment and application.
Not retroactive; need discipline and enforcement.
Cannot split a cost that has no resource (support, tax, shared networking).

Virtual tagsIn CostGlass

Rules applied to billed cost; no change to your cloud.
Edits re-allocate all history immediately.
Works on every cloud and on SaaS and AI spend.
Can combine accounts, services, regions and cloud tags in one rule list.

A sensible mix (illustrative)

A company tags team and environment on AWS resources through Terraform default tags. In CostGlass it creates a virtual tag called Team whose first rules take the value from the team cloud tag, then adds rules by account for the Azure subscriptions it has not tagged yet, and a final fallback value of "Shared". One report now shows every team across both clouds.

A short rollout checklist

Agree the minimum tag set and naming style with engineering and finance.
On AWS, activate the tags as cost allocation tags in the Billing console.
Set the tags as defaults in your infrastructure-as-code.
Add a policy (tag policy, Azure Policy, organisation policy) so untagged resources are flagged or blocked.
Enter the required tags in Tag Compliance and run a clean-up campaign.
Use Tag Explorer to watch coverage rise and virtual tags to cover the rest.

Frequently asked questions

I tagged my resources but CostGlass shows them as untagged. Why?

On AWS, the tag must be activated as a cost allocation tag, and the Cost and Usage Report must include it. After activating, import a fresh report. Also check Tag Explorer's "Tag coverage by cloud" panel: some clouds do not send tags to CostGlass yet.

Will tagging change my past bills?

No. Tags apply from when they are set (and, on AWS, activated). Use virtual tags if you need history allocated.

Do tag keys have to match exactly?

In CostGlass, no: matching ignores case. In your cloud, they usually do, so keep one spelling.

How many tags should we require?

Few. Four or five that you will actually enforce.

Can CostGlass add tags for me?

On AWS, owners and admins can apply tags from Tag Compliance when the connection allows writing. CostGlass connects read-only by default, so usually it gives you the AWS command to run. See the Tag Compliance guide.

All Documentation Guides

Welcome to CostGlass — What CostGlass does, who it is for, how your data gets in, the plans and regions, and a plain-English glossary.
Quickstart: your first hour — Sign up, connect a first cloud, invite your team, set a budget and turn on anomaly alerts, with a first-week checklist.
Finding your way around — A tour of the sidebar, top bar and page controls: what every page answers, plan gating, currency, language, links and caching.
Dashboards — The Overview dashboard widget by widget, plus building custom dashboards you can share with your organisation.
Cloud Resources — The multi-cloud inventory: filters, search, categories, estimated cost, terminated resources and CSV or Excel export.
Uptime, incidents & support requests — Monitor public endpoints, route alerts, see incidents and raise requests to CostGlass engineers.
How CostGlass accesses your data — Security and data ingestion architecture: how CostGlass reads multi-cloud billing and telemetry through read-only roles and least-privilege permissions.
Dashboard & Platform Screenshot Tour — Visual walkthrough of the CostGlass interface with screenshots covering multi-cloud spend, Cost Explorer, anomalies, Kubernetes allocation, and savings.
Connecting your clouds: overview — Every cloud and service you can connect, how each one connects, what access it needs, how long data takes and your plan limits.
Connect AWS (CloudFormation) — Deploy the generated CloudFormation template, choose organization or single account and optional features, then verify.
Connect AWS with Terraform instead of CloudFormation — A Terraform equivalent of the generated AWS template, with an Organization variant and a way to compare it to the wizard.
Connect Azure — Admin consent for the CostGlass application, Reader and Cost Management Reader roles, management group or subscription scope, and a Terraform version.
Connect Google Cloud — Enable the FOCUS BigQuery export, run the IAM grants CostGlass prints, verify, and a Terraform version.
Managing connected accounts — The Cloud Accounts page: statuses, syncing, errors, naming, disconnecting, and the FOCUS 1.0 and CUR Export pages.
Connect Oracle Cloud (OCI) — Give CostGlass read-only access to Oracle Cost and Usage Reports with a Resource Manager stack or your own Terraform.
Connect Alibaba Cloud — Connect Alibaba Cloud through Bill Subscription files in OSS and a read-only RAM role created by a ROS template.
Connect DigitalOcean — Connect DigitalOcean accounts with a read-only personal access token and see invoices by month.
Connect Akamai / Linode — Connect Linode (Akamai Connected Cloud) accounts with an account read-only token.
Connect Cloudflare — Connect Cloudflare usage-based charges with a Billing Read account token and see credits and unpaid debt.
Connect OpenAI, Anthropic, Datadog and Snowflake — Connect AI and software vendors with admin keys or a Snowflake key pair so their spend sits beside your cloud costs.
Cost Explorer — Slice, compare and drill into spend across every connected cloud: group by, filters, charts, overlays, details, AI, links and export.
Saved views, saved filters & scheduled emails — Keep, share and email the Cost Explorer views you use often, and reuse include/exclude filters across views and reports.
Reports — Build, compare, export, save and schedule spend reports, with presets, Excel, CSV and PDF exports.
SaaS & AI Spend — Spend and token analytics for OpenAI, Anthropic, DeepSeek, Datadog, Snowflake and cloud AI services.
Unit Economics — Cost per business unit: define metrics, send volumes, set targets and alerts.
Connect a Kubernetes cluster — Install OpenCost and the CostGlass exporter in your cluster so cost data is pushed to CostGlass every 15 minutes.
Kubernetes Costs page — Understand cluster, namespace, workload and pod costs, idle capacity, rightsizing, carbon and health.
Tagging strategy: getting the most from tags — How to tag cloud resources, enforce tagging, and when to use cloud tags or virtual tags in CostGlass.
Tag Explorer — Group billed spend by the value of a tag, see tag coverage per cloud and drill into resources.
Tag Compliance — Define required AWS tags, measure compliance, and fix missing tags with Quick Tag, batch apply or a CLI script.
Virtual tagging — Allocate spend by team, product or environment with rules, no cloud changes, with a rule builder and CostGlass AI.
Forecasting — Forecast month-end spend, the next months and a yearly run-rate, and simulate the cost of changes.
Budgets — Create spending limits for a cloud, account, service or team, and see how CostGlass budgets differ from native AWS, Azure and Google budgets.
Anomaly detection — How CostGlass finds unusual daily cost, how to tune it, explain it and be notified.
Cost alerts — Alert when spend rises versus the previous day, week, month or quarter.
All alert and notification types — A comparison of every alert and notification in CostGlass, with channel setup and testing.
Issues & annotations — Dated notes on spend, and a lightweight issue tracker for cost work with Jira push.
Savings playbook — A prioritised, step-by-step programme for reducing your cloud bill, with a 30/60/90-day plan.
Savings recommendations — How the Savings page finds, prices and tracks savings for every connected cloud and platform.
Rightsizing — Find servers and databases that are too big, or too small, using real CPU and memory measurements.
Commitments: Savings Plans & Reserved Instances — Track coverage, utilisation, expiry and purchase recommendations for Savings Plans, Reservations and committed use discounts.
Instance Scheduler — Start and stop non-production servers on a weekly schedule to stop paying for idle hours.
Giving your team access — Invite people, choose Owner, Admin or Member roles, remove users and limit what they see.
Setting up your organisation hierarchy — Build a tree of nodes, place cloud accounts by hand, rule or CSV, and scope people to a branch.
Designing your hierarchy (with enterprise examples) — Principles and worked patterns for AWS Organizations, single accounts, multi-cloud groups, MSPs and regulated regions.
Single sign-on (SAML & OIDC) — Connect Okta, Entra ID, Google Workspace or another provider, verify your domain, test and require SSO.
API keys & AI assistants (MCP) — Create API keys and connect Claude Desktop, Cursor or Claude Code to your cost data.
Audit log — See who changed what and when, with before and after values, kept for 24 months.
Data residency & retention — Your fixed region, how long cost history is kept, purge now and the data handling summary.
Notification settings, Jira & chat — Weekly spend summary, Slack and Teams webhooks, and connecting Jira Cloud.
Troubleshooting & Common Setup Fixes — Solutions for common cloud connection and ingestion issues across AWS, Azure, Google Cloud, OCI, Alibaba Cloud, Kubernetes, and SSO.

Tagging strategy: getting the most from tags