Forty percent of your cloud spend is untagged. What do you do?

What is being tested

Whether you fix the inflow before the backlog, and whether you understand why allocation ranks above optimisation.

Stop the bleeding first

Enforce tagging at creation. A resource without an owner tag should fail to deploy — via policy in the cloud provider, and via a check in the infrastructure-as-code pipeline. Otherwise you tag the existing 40% and next quarter there is a new 30%.

This is the single most important step and it is preventive, which is why it comes first. Retrofitting attribution onto thousands of untagged resources is a project nobody funds twice.

Then attribute the backlog

Not by hand across every resource. In order of effectiveness:

1. Infer from account or subscription where that boundary already maps to a team. This frequently resolves a large share immediately, and it is why account-level separation is a stronger allocation mechanism than tags in the first place.
2. Infer from naming conventions, resource groups and network placement.
3. Infer from activity logs — who created it, and when.
4. Ask, with a deadline. Publish the unattributed list, ask teams to claim what is theirs, and state that unclaimed resources will be reviewed for deletion.
5. The remainder is a finding in itself. Resources nobody claims are strong candidates for deletion, and the process of asking often removes a meaningful amount of spend.

Allocate the genuinely shared costs

Networking, observability, shared clusters, platform teams and licences are not untagged by mistake — they are genuinely shared. They need an allocation rule, published: by usage where measurable, by an agreed key otherwise. Publishing the rule matters more than its precision, because an unallocated pool is where the largest inefficiencies hide and where every cost conversation stalls.

Why this ranks above optimisation

Allocation is not itself valuable — it is what makes everything after it possible:

• Nobody deletes a resource whose owner is unknown, so waste accumulates.
• Optimisation done centrally by people without context is correctly resisted.
• Budgets cannot be set, so nobody has an incentive.
• Anomalies cannot be assigned to anyone.

This is why, in any remediation of an ungoverned estate, identity comes first and tagging comes second — before any optimisation work at all.

What to build alongside

• Cost visible to engineers, not just to finance — and next to their unit cost, so a team that grew efficiently is not criticised alongside one that did not.
• Anomaly alerting within a day, because month-end discovery is far too late.
• Cost per tenant, where the business needs it for pricing decisions.