Enforcing Tagging Policies Across Clouds

How do you actually enforce that every resource in AWS, GCP, and Azure gets the required tags? Walk me through what you would put in place.

Mid-Level questions

FinOpsintermediate

// interview question

How do you actually enforce that every resource in AWS, GCP, and Azure gets the required tags? Walk me through what you would put in place.

Sample answer

I think about enforcement in two layers: prevention (block creation without tags) and detection (find violations after the fact). You need both, because 100 percent prevention is impossible and detection alone is too slow. On AWS I use Organizations Tag Policies to standardize keys and values, plus Service Control Policies to deny resource creation without certain tags, plus AWS Config rule required-tags for drift detection. On Azure I use Azure Policy with the deny effect for missing tags, and the modify effect to auto-append tags inherited from the resource group. Azure inheritance is a trap, resources do not auto-inherit resource group tags so you have to add a policy for that. On GCP the native story is weaker. Organization Policy does not enforce labels as cleanly, so I lean on Terraform default labels plus policy-as-code (OPA or Sentinel) in the CI pipeline, and BigQuery billing export queries to catch anything that slipped through. The practical order I follow: first, get 90 percent coverage through Terraform default tags in the provider blocks. Second, add policy engines to block the console cowboys. Third, run nightly scans that flag untagged resources back to the owning team in Slack. If you start with policy engines before fixing Terraform, you will just break deploys.

Why this matters

Enforcement is where tagging programs live or die. Junior candidates will describe what a tag is. Mid candidates mention one native tool per cloud. Strong candidates lay out the prevention plus detection model, mention the Azure inheritance gotcha, acknowledge GCP has weaker native enforcement, and say that IaC default tags should carry most of the weight. Watch for candidates who say 'just use Azure Policy' without acknowledging it does not solve GCP or block changes from the console unless configured carefully.

Code examples

AWS Organizations Tag Policy

json

{
  "tags": {
    "team": {
      "tag_key": { "@@assign": "team" },
      "tag_value": {
        "@@assign": ["payments", "identity", "growth", "platform", "data"]
      },
      "enforced_for": {
        "@@assign": [
          "ec2:instance",
          "rds:db",
          "s3:bucket",
          "lambda:function"
        ]
      }
    },
    "environment": {
      "tag_key": { "@@assign": "environment" },
      "tag_value": {
        "@@assign": ["prod", "staging", "dev", "sandbox"]
      }
    },
    "cost-center": {
      "tag_key": { "@@assign": "cost-center" }
    }
  }
}

Azure Policy that denies resources missing the team tag

json

{
  "mode": "Indexed",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "tags['team']",
          "exists": "false"
        },
        {
          "field": "type",
          "notIn": [
            "Microsoft.Resources/deployments",
            "Microsoft.Resources/deploymentScripts"
          ]
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  },
  "parameters": {}
}

OPA policy for GCP Terraform plans in CI

rego

# Reject plans that create GCP resources without required labels
package terraform.gcp.tagging

required_labels := {"team", "environment", "cost-center"}

deny[msg] {
  resource := input.resource_changes[_]
  startswith(resource.type, "google_")
  resource.change.actions[_] == "create"

  labels := object.get(resource.change.after, "labels", {})
  missing := required_labels - {k | labels[k]}
  count(missing) > 0

  msg := sprintf(
    "%s '%s' is missing required labels: %v",
    [resource.type, resource.address, missing]
  )
}

Common mistakes to avoid

Rolling out deny policies org-wide on day one and breaking every pipeline
Forgetting that Azure resources do not inherit resource group tags automatically
Relying only on IaC and ignoring the console and ClickOps resources that bypass CI

Likely follow-ups

What breaks if you enforce a deny policy in a brownfield environment with thousands of existing untagged resources?
How would you onboard a team that has never tagged anything without blocking all their deploys on day one?
Why does the Azure policy exclude Microsoft.Resources/deployments and similar types?

Answer out loud first, then check yourself against the model answer.

Practice all Mid-Level questions More FinOps questions

#finops#cloud-costs#tagging#multi-cloud#policy-as-code#governance

Also worth your time on this topic

Interview

Essential Tags for Multi-Cloud Cost Allocation

If you were designing a tagging standard for a company running on AWS, GCP, and Azure, which tags would you require on every resource and why?

mid

Checklist

How to Set Up Cloud Cost Allocation Tags Across AWS, GCP, and Azure

A practical guide to implementing consistent cost allocation tagging strategies across multi-cloud environments for accurate chargeback and showback.

60-120 minutes

Article

How to Set Up Cloud Cost Allocation Tags Across AWS, GCP, and Azure

A working playbook for tagging resources across AWS, GCP, and Azure so finance can finally answer which team spent what, and engineers can prove their workload is not the expensive one.

Enforcing Tagging Policies Across Clouds

More FinOps interview questions

Also worth your time on this topic

Essential Tags for Multi-Cloud Cost Allocation

How to Set Up Cloud Cost Allocation Tags Across AWS, GCP, and Azure

How to Set Up Cloud Cost Allocation Tags Across AWS, GCP, and Azure