Implement Cost Allocation Tagging Strategy

Define and enforce a mandatory tagging strategy across all Landing Zone accounts to enable accurate cost attribution, financial accountability, asset ownership tracking, and environment-aware governance. Tags are enforced at resource creation via SCPs and monitored for drift via AWS Config.

A well-defined tagging strategy is the foundation of cloud financial management and operational governance. This control defines the mandatory tag key set, acceptable values, and enforcement mechanisms for all taggable AWS resources across the Landing Zone. The mandatory tag schema covers four governance dimensions:

Financial Attribution

• CostCenter - Maps the resource to an internal cost center code (e.g., CC-1042). Used for chargeback and showback reporting in Cost Explorer.
• Project - Associates the resource with a specific project or product initiative (e.g., proj-payments-api). Enables per-project spend visibility.
• BudgetCode - Links the resource to an approved budget line item for finance reconciliation (e.g., FY26-INFRA-003).

Ownership & Accountability

• Owner - Email address or team alias of the resource owner responsible for cost and operational decisions (e.g., platform-team@company.com).
• SupportTeam - Email address or team alias of the support team responsible for handling incidents and requests (e.g., support-team@company.com).
• ManagedBy - Indicates whether the resource is managed by Terraform, CDK, manual provisioning, or another IaC tool (e.g., terraform, cdk, manual). Supports drift detection and audit workflows.

Environment & Classification

• Environment - Deployment tier with a controlled value set: production, staging, development, sandbox. Used by SCPs to apply differentiated guardrails per tier.
• AssetSeverity - Business criticality classification of the resource: critical, high, medium, low. Critical and high assets trigger stricter backup, monitoring, and change management policies. This tag is the primary signal for automated runbook routing and incident prioritization.
• DataClassification - Sensitivity level of data processed or stored: confidential, internal, public. Feeds DSPM tooling and S3 bucket policy enforcement.

Lifecycle Management

• ExpiryDate - ISO 8601 date (YYYY-MM-DD) after which the resource is eligible for automated decommission review (e.g., 2026-12-31). Mandatory for sandbox and development environments.

SCPs enforce the presence of mandatory tags (CostCenter, Owner, Environment, AssetSeverity) at resource creation for covered services. AWS Config rules provide continuous drift detection for resources that were created before the SCP was applied or where tags were subsequently removed.