One tag policy for AWS tags and GCP labels

The default policy requires three tags: Owner, Environment (production, staging, dev or test) and CostCenter (CC- followed by four digits). You can replace it with your own required keys. Each key can carry a list of allowed values or a pattern the value must match, and whole resource types can be exempted.

GCP labels are usually lowercase, so the policy includes a label mapping. By default Owner maps to owner, Environment to env and CostCenter to cost_center, and a key without a mapping is checked in lowercase. The policy is set through the API, and the Tag Governance page shows the one in force.

Each scan checks every resource in the inventory against the policy. A resource is compliant when every required tag is present and its value passes the allowed-values list or pattern, if one is set.

• AWS: EC2 instances, EBS volumes, EBS snapshots, security groups, RDS instances, EKS clusters and S3 buckets, across the regions enabled in each account.
• GCP: Compute Engine instances, GKE clusters, Cloud SQL instances and Cloud Storage buckets, using their labels.

Tag Governance breaks compliance down by cloud, resource type, tag key and account, with a 30-day trend for the workspace and a CSV export of the resources that fail. Pick an account in the header to see that account’s figures; an account with nothing scanned reads “Not measured”.

Every resource missing a required tag also becomes a finding, so it sits with your other findings and can be triaged the same way.

Cost allocation groups spend by team (the Owner tag), environment (Environment) and cost center (CostCenter). On AWS the grouping comes from Cost Explorer. On GCP it comes from the labels in your billing export, matched through the same label mapping.

Spend on resources without the tag goes in its own Untagged bucket, taken from that grouping rather than guessed. Allocation is stored per account and for the workspace, and follows the account selector. On AWS, the three tags must be activated as cost allocation tags in your payer account first.

On a missing-tags finding, Remediate opens a form with the missing keys already listed. Every checked tag needs a value, and you can add extra tags. The bulk bar does the same for several findings at once, with one set of values. The request then waits in the approval queue.

Once an owner or admin approves, the tags are added in the resource’s own account. This works for EC2 instances, EBS volumes, EBS snapshots, security groups, RDS instances and S3 buckets. S3 tags are merged into the bucket’s existing set, and a new value replaces an old one for the same key.

GetFinOps then checks the reported result against the tags you asked for. If the check fails, the added keys are removed again. Fixes need the optional remediation permissions in the cross-account role template, and a paid plan or the trial.

• It doesn’t change GCP labels or tag EKS clusters. Those findings are shown without a fix.
• It doesn’t restore a tag’s previous value on rollback. It removes the keys the fix added.
• It doesn’t suggest tag values on the fix form. You enter them.
• It doesn’t raise a finding for a value outside the allowed list. That shows in the compliance breakdown only.
• Cost allocation uses the Owner, Environment and CostCenter tags, not every key in your policy.
• There’s no policy editor in the app yet, and the compliance trend covers the whole workspace rather than one account.