Cost Allocation Tags
Price exercises in this note use hypothetical us-east-1 (US East, N. Virginia) rates for study on 2026-10-12, unless explicitly identified as a dated published fee. They are assumptions, not current tariffs; exclusions remain material.
Cost allocation tags connect supported resource charges to owners and business dimensions. A resource tag is not automatically an active billing dimension.
Define and activate
Use a small, stable vocabulary such as CostCenter, Application, Environment and Owner. Avoid personal data, secrets and unbounded request IDs. Activate supported user-defined tags in Billing after they appear. AWS-generated allocation tags such as aws:createdBy have separate availability and activation rules; the management account must activate the applicable generated tag.
There is no universal AWS-generated aws:region resource tag or guaranteed request-ID allocation tag. Billing has Region and service dimensions independently of tags. Not every charge or resource supports resource-level allocation.
Backfill can cover up to 12 months when the resource historically had the tag. It cannot reconstruct tags that did not exist. Allow billing/reporting propagation time; activation and exports are not instantaneous.
Governance limits
Tag policies standardize supported tag keys/values and can enforce compliant values on supported operations. They do not automatically tag every resource or universally require a missing tag. Resource Groups organize resources but do not propagate tags.
CloudFormation propagation varies by resource type; specify tags explicitly where supported and verify deployment results. There is no generic Lambda dead-letter configuration tag: true.
An SCP can deny selected tag-on-create operations using supported request-tag conditions. Do not deny Action: "*" whenever aws:RequestTag is absent: read operations and services without tag-on-create could be blocked. Scope actions/resource types and test in a sandbox account. SCPs do not evaluate a live dollar budget.
Allocation workflow
- Inventory supported resources and missing ownership tags.
- Obtain owner confirmation before changing shared-resource allocation.
- Activate billing tags and validate them in Cost Explorer/export data.
- Allocate shared costs with documented rules or Cost Categories.
- Report unallocated spend separately instead of silently attributing it.
- Request historical backfill only after checking historical tag presence.
Tag vocabulary and coverage matrix
| Tag | Example | Governance question |
|---|---|---|
| CostCenter | CC-410 | Which finance owner approves allocation? |
| Application | order-service | Is the value stable across deployments? |
| Environment | production | Which vocabulary does policy permit? |
| Owner | platform-team | Is it a maintained team identity rather than personal data? |
Specify case and spelling: CostCenter and costcenter are different keys. Tag a resource for operational ownership even when its charges cannot be allocated by that tag. Account tags, resource tags, Cost Categories and AWS-generated tags are distinct objects.
Enforcement choices
| Control | Useful role | Limit |
|---|---|---|
| IaC/CI validation | Reject a template missing required supported tags | Does not govern every manual/API path |
| Tag policy | Standardize/enforce supported values | Does not universally require missing tags |
| SCP | Deny scoped supported create actions without tags | Action/resource/tag-on-create support must be tested |
| Config rule | Detect supported untagged resources | Detective and resource-type-limited |
| Owner inventory | Catch shared or unallocatable charges | Requires human allocation decisions |
Focused policy exercise
For EC2 instance creation, a scoped conceptual SCP statement is:
{
"Effect": "Deny",
"Action": "ec2:RunInstances",
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"Null": {
"aws:RequestTag/CostCenter": "true"
}
}
}This is one statement, not a complete deployable governance policy. RunInstances authorizes several resource types and tag-on-create needs additional permissions. Test the instance scope, launch templates, Auto Scaling, approved service roles and tag-changing paths in a sandbox. Never replace it with an all-actions deny on missing request tags.
Backfill and shared-cost example
A resource carried CostCenter=CC-410 from January, but billing activation happened in June. Eligible backfill can restore that historical dimension; it cannot allocate January to a tag first added in June. For a shared $1,000 monthly platform cost, an internally agreed 60/40 rule allocates $600/$400. Keep the rule version and unallocated remainder visible; tagging itself does not invent that rule.