Finding untagged resources: closing the allocation gap

When cost allocation stalls at 70 or 80 percent, the missing piece is almost always untagged resources: line items on the bill with no owner, no cost-center, no environment. That unallocated slice is invisible to showback, immune to accountability, and usually where quiet waste hides. Finding it systematically, rather than stumbling on it, is a core FinOps task. The good news is the data to find it is already in your billing export.

Start from the billing data

The authoritative source is the detailed billing export: the AWS Cost and Usage Report (CUR), Azure cost exports, or the GCP BigQuery billing export. Each row carries the resource, its cost, and its tag columns. Query for rows where a required tag is null and sum the cost. That total is your unallocated spend, and it is the number to drive down. Grouping it by service and account immediately shows where to start, because the unallocated dollars are rarely spread evenly.

Follow the money, not the resource count

A common mistake is sorting by count of untagged resources. You end up chasing hundreds of tiny objects while a single untagged RDS cluster or NAT gateway holds most of the money. Sort by unallocated cost instead. In practice a handful of services, often compute, managed databases, and data transfer, hold 80 percent of the untagged dollars. Fixing those few moves your coverage number the most for the least effort, the same Pareto logic that governs any waste cleanup.

Catch the cheap-but-orphaned resources

Billing data misses resources that cost almost nothing yet still matter for governance: an untagged security group, an empty S3 bucket, an idle IP. For those, cross-check with a resource inventory API: the AWS Resource Groups Tagging API, Azure Resource Graph, or GCP Cloud Asset Inventory. These list every resource and its tags regardless of cost, so you catch the orphans that are cheap today but might grow, and the ones that signal a broader gap in a team's tagging discipline. Many of these overlap with the orphaned resources worth deleting entirely.

Assign owners and backfill

Once you have the list ranked by cost, the work is attribution. Use account, resource naming, creation timestamps, and CloudTrail or activity logs to infer the likely owner, then confirm and apply the tag. For resources you genuinely cannot attribute, apply an explicit unallocated tag so they show up as a known bucket rather than a silent gap, and split them by a rule as covered in the shared-cost splitting guide. The goal is that every dollar lands somewhere on purpose.

Make the finding continuous

A one-time hunt drifts back within weeks unless you close the loop. Turn the query into a weekly report, publish coverage per team, and enforce required tags at deploy time so the backlog stops growing. This combination, a deploy-time gate plus a recurring find-and-fix sweep, is what holds allocation coverage above 95 percent instead of letting it decay. Coverage is a real cost KPI, so trend it over time. Price new infrastructure against the resource catalog so the owner and the cost are both known before the resource ever appears untagged on a bill.

FAQ

What to do next

Know the cost and the owner before a resource lands on the bill. C3X reads your Terraform and prices your resources against a live catalog. Start with the quickstart.