Tagging isn't a cost optimization by itself — it doesn't reduce anyone's bill directly. What it does is make every other optimization possible, because you can't right-size, decommission, or hold a team accountable for spend you can't attribute to them in the first place.
The "shared" bucket that keeps growing
Every account accumulates a set of resources that never got a cost-allocation tag — created before a tagging policy existed, spun up by a one-off script, or provisioned by a team that didn't know the convention. Individually these look small. Collectively, they become an "unallocated" or "shared" cost bucket that grows every time a new untagged resource is added and never shrinks unless someone goes back and tags retroactively.
The untagged sliver doesn't stay a sliver — every account or resource added without a tag lands in the same growing bucket.
The problem compounds because an unallocated bucket is politically inert — nobody owns it, so nobody's incentivized to shrink it. It's usually the single largest opportunity in an account that's otherwise been reasonably well optimized service-by-service, precisely because nobody's been assigned to look at it.
A minimum viable tagging convention
- Owner — team or individual accountable for the resource.
- Environment — prod/staging/dev, so non-prod spend can be isolated and scrutinized separately from production.
- Cost center or product — whatever unit the business actually reports spend against internally.
Three tags, enforced consistently, cover the large majority of cost-allocation questions. More elaborate taxonomies tend to collapse under their own weight — a tagging scheme people can't remember to apply correctly is worse than a minimal one they can.
Making it stick instead of decaying again
- AWS Cost Categories and Cost Allocation Tags (activated in Billing preferences) turn tags into actual Cost Explorer breakdowns — tags that exist but were never activated for billing don't show up in cost reports at all.
- Service Control Policies or an AWS Config rule can require specific tags at resource creation, which is the only way tagging convention survives past the person who wrote the wiki page about it.
- A recurring (not one-time) sweep for untagged resources — the bucket regrows continuously, so the check has to run continuously too.