Cost allocation tags: a tagging standard that survives the billing export

Goal

Answer "what does service X cost per month, per environment, per team" from the provider's billing export without manual spreadsheets.

Prerequisites

Infrastructure defined in code for the large majority of resources; agreement on who owns cost reporting; access to the billing console of the paying account.

Steps

1. Choose a small mandatory key set, typically service, environment, owner (team, not person) and cost-center, plus an optional component. Write allowed values down; free text defeats grouping.
2. Fix spelling rules. The AWS tagging guide (cited) states that tag keys and values are case sensitive, so Environment=Prod and environment=prod are two buckets; the Azure documentation (cited) treats tag names as case-insensitive for operations but values as case-sensitive. Standardise on lowercase keys and values everywhere.
3. Activate the keys for billing. The AWS billing guide (cited) explains that user-defined and AWS-generated tags must each be activated separately before they appear in Cost Explorer or the cost allocation report, that in an organisation only the management account has access to the cost allocation tags manager, and that tags can take up to 24 hours to appear in the billing console. Backfilling tags for past periods is documented as a separate procedure, so activate the keys early rather than relying on it.
4. Apply tags through the infrastructure code's provider-level default tags so every resource the code creates carries them; add the keys to module interfaces so a module cannot be instantiated without an owner.
5. Enforce at creation with policy: a deny rule for resource creation without the mandatory keys (organisation policy, Azure Policy, admission control in Kubernetes for cloud-provisioned volumes and load balancers).
6. Do not rely on inheritance: the Azure documentation (cited) states that resources do not inherit tags applied to a resource group or subscription, so tag every resource explicitly rather than assuming children carry a parent's tags; shared resources (NAT gateways, data transfer, support plans) never map cleanly to one service.
7. Each month, export costs grouped by the mandatory keys, list the untagged remainder by service, and either tag the resources, allocate the shared cost by a written rule, or accept it explicitly.

Expected result

A billing export in which the untagged share is small and explained, and a per-service cost that the owning team recognises as theirs.

Limits and test basis

Tags do not capture resources created outside code or by managed services on the customer's behalf, and charges that are not attached to a taggable resource stay in the untagged remainder; the cited Azure page notes that not all resource types support tags. Provider behaviour follows the cited documentation; no cost figures are claimed.