All cheat sheets
Cost Governancecheat sheet

Cost Allocation Tags

The single biggest unlock for knowing who spends what on AWS — and the prerequisite nearly every other cost tool assumes. It's two switches: tag the resource, then activate the tag key in Billing. Teams forget the second one.

Last reviewed: July 14, 2026

Prefer step by step? Take the guided Cost Allocation Tags walkthrough — free, anonymous, interactive.Have an AI assistant? Jump to the copy-paste audit prompt at the bottom of this sheet.

TL;DR: You can't measure AWS spend by team, project, or environment until resources are tagged and those tag keys are activated for cost allocation. It's two separate switches — apply the tag, then flip it to Active in Billing — and the second is the one teams forget. That single activation is the difference between "we spend $80k/month" and "Data spends $32k, Platform $24k, and $24k is untagged." It's the dimension layer nearly every other cost tool quietly assumes you've done.

The numbers

  • Two switches: tag the resource (a label AWS's billing ignores) → activate the key in Billing → Cost allocation tags (now it flows into Cost Explorer, Budgets, CUR). New data appears ~24h after activation, forward-only — historical breakdowns before activation aren't reliable.
  • Untagged is real and persistent — even a well-tagged account leaves 5–15% in the untagged bucket (data transfer, NAT processing, taxes, credits don't carry tags).
  • Keys are case-sensitive (team ≠ Team ≠ TEAM); limit is 500 active user-defined keys (most accounts use 5–10).
  • Field examples: a $40k/mo account with 45% untagged got to 6% in six weeks (3 keys + Tag Editor bulk-fix + IaC enforcement), turning the cost review from a debate into a 5-minute read; a $9k/mo "shared services" black hole became a transparent per-team allocation once its resources were tagged.

Do this

  1. Pick just three keys with controlled vocabularies — Env (prod/staging/dev/sandbox), Team or CostCenter (not both), Project or Application. Write casing and allowed values in a one-page README day one.
  2. Activate them in Billing → Cost allocation tags, then wait ~24 hours — the cheapest cost-management improvement on AWS.
  3. Bulk-fix the top untagged spenders with Resource Groups → Tag Editor — filter "missing the Team tag," select all, set the value; don't try to backfill everything, just the top spenders.
  4. Auto-tag new resources in IaC (Terraform variables / CDK defaults) so coverage doesn't decay.
  5. Enforce going forward — SCPs to deny untagged creation in prod accounts, Tag Policies (report-only) in dev, plus a weekly dump of newly-untagged resources; add an "Untagged spend > 15%" budget alert.

Gotchas

  • Activation is the forgotten step — tagging 200 instances does nothing in Cost Explorer until the key is flipped Active; the #1 "why isn't this working."
  • Not cleanly retroactive — trust forward-looking data; don't trust breakdowns for periods before activation.
  • Case-sensitivity bites — renaming Team→team after activation creates two reporting columns; decide casing once.
  • In an Org, only the payer account manages activation — member accounts have no knob.

Skip this if

  • Nothing — this is the 30-minute foundation everything else sits on: Budgets can only go account-wide without it, Cost Explorer can only group by AWS-controlled dimensions, and anomaly detection can't say "EC2 spiked for Phoenix." Once tags are solid, AWS Cost Categories re-bundles them into stakeholder views and Cost and Usage Reports carries them as line-item columns.

Run this audit with your AI assistant

Paste this into Claude, ChatGPT, or any agent that can run the AWS CLI with read-only credentials. It audits your account for exactly the waste this sheet describes — and changes nothing.

You are auditing an AWS account/Org's cost-allocation tagging. Use the
AWS CLI with READ-ONLY credentials. Do not create, modify, or delete
anything — report findings and recommended (unapplied) fixes only.

1. Activation state: aws ce list-cost-allocation-tags — which user-defined
   tag keys are Active vs Inactive. Flag keys that are applied to
   resources (resourcegroupstaggingapi get-resources) but NOT activated
   (the #1 "why isn't this working" trap).
2. Coverage: from Cost Explorer grouped by each key, measure the %
   landing in "Untagged"/"No tag" — flag anything over ~15% and list the
   top untagged spenders (resourcegroupstaggingapi with a tag filter).
3. Scheme hygiene: flag case-variant duplicate keys (Team vs team vs
   TEAM), free-text sprawl (14 keys half-filled), and missing controlled
   vocabularies. Recommend collapsing to ~3 keys (Env, Team|CostCenter,
   Project|Application).
4. Enforcement: note whether Tag Policies / SCPs enforce required tags,
   and whether IaC auto-tags new resources.

Report a table: tag key | active? | % untagged | casing issues | top
untagged spenders | recommendation (activate / bulk-fix via Tag Editor /
enforce). Change nothing.
Works with any assistant that can run shell commands.

Want the guided version?

The Cost Allocation Tags walkthrough covers this topic interactively — it asks about your setup, branches to what’s relevant, and quizzes you on the tricky parts. Free and anonymous.

Start the walkthrough

More Cost Governance cheat sheets

AWS Billing Conductor

Billing Conductor restructures how a bill is allocated and presented internally — pro-forma invoices with custom rates, markups, and line items — without changing what AWS actually charges. It's an accounting tool for MSPs and complex chargeback, not a savings tool.

AWS Budget Actions

A regular budget emails you; a Budget Action does the thing for you — attach a deny-IAM policy, apply an SCP, or stop tagged EC2/RDS when a threshold breaks. The difference between an alarm and a circuit breaker, and it costs nothing extra.

AWS Budgets

The one cost-governance feature to set up first: a threshold plus a notification that pings you before the bill lands. Forecasted-80% is the single most effective alert AWS offers; first two budgets are free.

AWS Cost and Usage Reports

Cost Explorer is a dashboard; CUR is the database. Every billing line item — one resource × one hour × one usage type, hundreds of columns — dumped to S3 for Athena/QuickSight when the question doesn't fit Cost Explorer's dropdowns. Use CUR 2.0 via Data Exports.