Home / AWS

AWSChecklistBeginner

AWS tagging and cost governance foundation: tag policies, budgets and anomaly detection

Enforce a tag schema with tag policies, activate cost allocation tags, set budgets and Cost Anomaly Detection per account, and run a short monthly savings review.

Deepak Bhardwaj2 min read

Applies toAWS Organizations tag policies, AWS Budgets, Cost Explorer, Cost Anomaly Detection

1. Tag schema

Key Example values
Owner payments-team
CostCenter CC-4512
Environment prod, dr, test, dev
Application payments
DataClassification public, internal, confidential
DRTier tier1, tier2, none
Backup daily, weekly, none (drives AWS Backup selection)

2. Enforce it

  • Tag policy in Organizations for allowed keys/values and case (Environment not environment), with enforcement for selected resource types.
  • SCP or CloudFormation hooks to deny creation without required tags, for resource types that support tag-on-create.
  • AWS Config rule required-tags for detection.

3. Activate cost allocation tags

Billing console → Cost allocation tags → activate Owner, CostCenter, Environment, Application. Tags only show in Cost Explorer from activation onward.

4. Budgets per account

aws budgets create-budget --account-id 111122223333 --budget '{
  "BudgetName": "payments-prod-monthly",
  "BudgetLimit": {"Amount": "5000", "Unit": "USD"},
  "TimeUnit": "MONTHLY", "BudgetType": "COST"
}' --notifications-with-subscribers '[{
  "Notification": {"NotificationType": "FORECASTED", "ComparisonOperator": "GREATER_THAN", "Threshold": 80},
  "Subscribers": [{"SubscriptionType": "EMAIL", "Address": "payments-team@contoso.com"}]
}]'

5. Cost Anomaly Detection

Monitor per linked account and per service, alert with a daily summary. It catches the "someone left a GPU instance running" case days before the budget alert.

6. Monthly review

  • Unattached EBS volumes and old snapshots
  • Idle load balancers and unused Elastic IPs (charged per public IPv4 address)
  • Compute Optimizer rightsizing recommendations
  • Savings Plans / Reserved Instance coverage and utilisation
  • NAT gateway data processing (often reduced with VPC endpoints)
  • S3 storage classes and lifecycle rules; Intelligent-Tiering for unknown access patterns
aws ec2 describe-volumes --filters Name=status,Values=available --query "Volumes[].{id:VolumeId,size:Size,created:CreateTime}" --output table

DR costs

Filter Cost Explorer by Environment = dr to show the cost of standby capacity. It turns DR tier decisions (pilot light vs warm standby) into a clear cost conversation with the customer.

Related fixes