Cloud resource tagging is the practice of attaching metadata key-value pairs to cloud infrastructure resources across AWS, Azure, and GCP to organize, track, and allocate costs at scale. Effective tagging enables accurate cost attribution to teams, projects, and business units while supporting governance, automation, security access control, and compliance auditing. Tags (or labels in GCP) serve as the foundation for chargeback/showback models, budget tracking, anomaly detection, and resource lifecycle management. In 2026, with 98% of FinOps teams now managing AI spend alongside cloud and Kubernetes, tagging strategy must extend beyond EC2 instances to cover containers, LLM workloads, and shared services — and platforms like FOCUS are standardizing how cross-provider billing data is structured. Understanding tagging taxonomy design, enforcement mechanisms, and automation strategies transforms cloud cost visibility from opaque to transparent.
What This Cheat Sheet Covers
This topic spans 16 focused tables and 173 indexed concepts, 130 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
A jump-to index of every table row in this cheat sheet.
An interactive map of every table and concept in this topic.
Table 1: Tag Taxonomy Fundamentals
The vocabulary and structure of tags determine how well your metadata scales across teams, providers, and tooling. Getting the fundamentals right — what a tag is, how inheritance works, and what system tags mean — prevents costly redesigns as your tagging program matures.
| Concept | Example | Description | |
|---|---|---|---|
Environment=Production | • Basic tag structure where key identifies category and value specifies detail • case-sensitive in most providers | ||
Define 8-12 core tags across org | Documented plan specifying which tags are mandatory, optional, their purposes, allowed values, and governance processes | ||
Environment, CostCenter, Owner, Project | • Categories of tags used for organizing resources • common dimensions include technical, business, security, and automation | ||
CostCenter, Owner, Environment | • Tags required on all or specific resource types • enforced via policies to ensure compliance before resource creation | ||
Backup-Frequency, DataClassification | • Tags recommended but not enforced • provide additional context for specific use cases or resource types | ||
finance:costcenter, ops:owner | • Prefix or grouping that organizes tags into logical categories to avoid key collisions in large organizations • Oracle OCI uses namespaces explicitly | ||
Subscription tag flows to child resources | Tags applied at higher hierarchy levels (org, folder, subscription, resource group) automatically propagate to descendants for cost rollup | ||
Custom keys created by users | • Tags created by account users (vs AWS-generated tags) • must be activated in billing console to appear in AWS Cost Explorer | ||
aws:createdBy, aws:cloudformation:stack-name | • System tags automatically applied by AWS services • reserved aws: prefix cannot be used for custom tags | ||
Labels=metadata; Tags=access control | GCP distinguishes labels (key-value pairs for resource metadata and cost) from tags (org-level key-value attached to hierarchy for IAM conditions and firewall rules) | ||
Do not store PII, passwords, or API keys in tag values | • Tags appear in billing reports, CloudTrail logs, and IAM queries — storing credentials or PII in tags exposes that data far more broadly than intended • use dedicated secrets managers instead |