Tag Compliance | Scamallteoir

Why Tags Matter

Cloud resources have technical names like "vol-0a1b2c3d" or "nic-westeurope-042" that mean nothing to a manager looking at a cost report. Tags are labels your team adds to resources so costs can be attributed to things the business cares about — projects, products, environments, and owners.

Without tags, you know how much you're spending, but not on what or for whom. That makes it hard to set budgets, identify waste, or hold teams accountable.

Recommended Tags

Project / Product

Examples: "Mobile App", "Customer Portal", "Data Pipeline". Maps every dollar to something on your roadmap. This is the single most impactful tag — start here.

Environment

Examples: "production", "staging", "development", "test". Know instantly how much you're spending on non-production. A common finding: dev/test environments costing as much as production.

Owner / Team

Examples: "platform-team", "jane.smith@company.com". When a resource looks wasteful, you know who to ask about it.

Cost Centre (optional)

For internal chargebacks or finance reporting. Maps cloud spend directly to your accounting structure.

What Scamallteoir Does

Once you set required tags in Settings, Scamallteoir does three things:

Resource group tag inheritance — when a resource group is tagged, all child resources (VMs, disks, IPs, etc.) automatically inherit the RG's tags for cost attribution. This means tagging a single resource group covers all the resources inside it. Resource-level tags take precedence if present.
Tag compliance scanning — every sync checks your inventoried resources. Individual resources missing required tags appear on the Cost Bleed page. Resources whose parent RG is tagged are considered compliant.
Cost-by-tag grouping — the Dashboard shows cost breakdown by tag value. Use the "By Tag" view in the expanded chart to see a stacked bar chart, focus on a single project, or compare owners. Instantly answer "how much does Project X cost?"

Tag matching is case-insensitive — a resource tagged "project" satisfies a requirement for "Project".

The Untagged Spend Page

The Untagged Spend page shows you where unattributable costs are coming from. It lists resource groups that are missing required tags, ranked by cost — so you know exactly where to focus your tagging efforts for maximum impact.

You can switch between tag keys (e.g. "project" vs "owner") and export the list as a CSV to share with your team.

How to Fix Untagged Spend

Tag resource groups first — this is the highest-impact action. Scamallteoir inherits RG tags to all child resources automatically, so one tag can cover dozens of resources.
Use the Untagged Spend page to see which RGs need tagging, sorted by cost.
Export the CSV and share it with your team so they know which RGs to tag.
Set up Azure Policy for new resources — see below for the "Inherit a tag from the resource group" policy.

Once you tag a resource group in Azure, resync in Scamallteoir and the costs will immediately be attributed to the correct project/owner.

What Stays Untagged

Even with good tagging, some costs can't be attributed:

Subscription-level charges — support plans, Azure Active Directory, and reservation fees don't belong to any resource group.
Managed environments — Azure Container Apps, AKS node pools, and other platform-managed sub-resources may not carry your tags.
Deleted resources — costs from resources that no longer exist in Azure can't be matched to current tags.

These are typically a small fraction of total spend. Focus on getting resource group tagging right — that covers the bulk of attributable cost.

Azure Policy: Enforce Tags on New Resources

Azure Policy has a built-in definition called "Inherit a tag from the resource group". Assign it once per required tag and every new resource automatically gets the tag from its resource group. For existing resources, create a remediation task to backfill.

Go to Azure Portal → Policy → Definitions
Search for "Inherit a tag from the resource group"
Click Assign, select your subscription scope
Set the Tag Name parameter (e.g. "project")
Repeat for each required tag (e.g. "owner")
For existing resources: go to the assignment → Create Remediation Task

See Azure docs: Govern tags for the full walkthrough.

AWS: Tag Policies

Use Tag Policies in AWS Organizations to enforce that required tags are present on resource creation. For existing resources, use AWS Config's required-tags rule to identify and remediate untagged resources.

Tips for Rolling Out Tagging

Start with just one required tag (Project) — don't overwhelm the team with five tags on day one.
Tag resource groups, not individual resources — Scamallteoir inherits RG tags automatically. One tag on an RG covers all its child resources.
Use the Untagged Spend page to prioritise — tag the highest-cost RGs first for the biggest impact on your attribution percentage.
Set up Azure Policy to prevent new untagged resources from being created.
Accept some untagged cost — subscription-level charges (support, AAD, reservations) will always be untagged. Focus on getting resource-level spending attributed.