What if my org has not committed to a tag policy yet?

Start with discovery — Refine shows what tags exist where, ranked by spend. Most teams converge on CostCenter / Owner / Environment / Product. Once you pick keys, the policy preview validates them against current state before any enforcement.

Does Refine apply tags for me?

No — Refine surfaces and validates, you apply. Tag application is a write operation and lives outside the baseline read-only IAM role. Most teams use AWS Tag Editor or IaC (Terraform / CDK / CloudFormation) for application.

Can policies vary by account?

Yes. Per-account overrides let you require different keys in production vs sandbox. Useful when legacy accounts cannot meet the same standard as net-new accounts.

How is this different from AWS Tag Policies?

AWS Tag Policies enforce at the Organizations level after policy is published. Refine adds the pre-publish simulation, the spend-ranked untagged view, and the drift trend — the FinOps observability AWS Tag Policies do not provide.

How does Refine see CloudFormation drift?

Refine ingests CloudTrail events and AWS Tagging API state regularly. When a resource's tags diverge from its create-time state without an IaC update, that is flagged as drift in the dashboard.

Product · AWS Advanced Tier Services Partner

Pin every AWS dollar to an owner

Untagged resource visibility, allocation gap reporting, drift detection, and policy enforcement preview. The FinOps surface that makes showback actually work.

Connect AWS Account See What We Surface

By HabileLabs

tag governance · allocation3 accounts · drift watch on

84%tagged

i-0b42f9 · m5.xlargeteam:checkout
vol-8c11d2 · 500 GB gp3env:prod
nat-77a2 · us-east-1owner:platform

Unallocated spend$6,420/mo $6,420/mo

Why tags matter for FinOps

Tags are the spine of cloud cost accountability

FinOps Foundation lists cost allocation as a foundational capability for a reason. Without it, every other FinOps practice — showback, forecasting, anomaly attribution — limps.

Showback Is Impossible

Without consistent CostCenter / Owner / Environment tags, you cannot tell finance which team or product drove the spike. Allocation slides into "Unallocated" — the line that auditors love to flag.

Resources Go Orphaned

An engineer leaves, the resource keeps running. Without an Owner tag, you cannot tell who owns it, who to ask before turning it off, or whether it is still needed.

Drift Is Invisible

Tags get applied at create-time, then drift. Six months later half your dev resources are untagged, your production tagging is 60% compliant, and nobody knows.

What Refine surfaces

Tag Intelligence, Not Just a Tag List

Refine ingests CUR and AWS Tagging APIs across your accounts, then ranks tag gaps by dollar impact — so you fix the $4k/mo orphan before the $10/mo bucket.

Untagged Resource List

Every resource missing your required tags, sortable by monthly spend. The $10/mo S3 bucket is fine; the $4k/mo EC2 instance without an Owner tag is not.

Allocation Gap Report

What percent of monthly spend is properly tagged. Trend over time so you see whether tagging discipline is improving or eroding.

Drift Detection

Resources that were tagged correctly at creation but lost tags through CloudFormation drift, manual edits, or service updates.

Required-Tag Tracking

Configure your required keys (CostCenter, Owner, Environment, Product) and watch per-key compliance climb. Per-account thresholds supported.

Untagged Resources, Ranked by Spend

The exact shape of the view you get in the dashboard. Fix the top of the list and your allocation gap collapses.

Untagged resources (sample)

4 resources · $581/mo at risk

Resource	Spend / month	Missing tags
EC2 instance · m5.xlarge i-0a4f9b3c2e8d1f6e	$142	OwnerCostCenter
RDS instance · db.r5.large rds-prod-analytics-2	$248	CostCenter
S3 bucket · 8.2 TB arn:aws:s3:::data-lake-archive	$187	OwnerEnvironmentCostCenter
Elastic IP · unattached eipalloc-035fa17c9e2b4a17c	$4	OwnerEnvironment

Export the full list to CSV/XLSX for the FinOps ticket queue. Tag from within AWS, and the next sync confirms compliance.

Validate tag policy before you publish

Define your required keys, allowed values, and account-scoped overrides. Refine simulates the policy against current state and tells you exactly which resources will break before you publish.

Required-key declarations (CostCenter, Owner, Environment, Product)
Per-key allowed-value sets
Per-account overrides for legacy environments
Dry-run impact report (compliant / non-compliant per resource)
Rollout staging — apply enforcement gradually

Policy preview · prod accounts

Dry-run

Total resources scanned12,847

Compliant10,203 (79%)

Non-compliant2,644 (21%)

Top non-compliant

EC2 (us-east-1) — 412 resources missing Owner
S3 (eu-central-1) — 88 buckets missing CostCenter
Lambda (ap-south-1) — 36 functions missing Environment

Apply policy? Compliance climbs to 91% projected after first remediation pass.

Customer outcome

How tag discipline unlocked savings

AnonymizedE-commerce

45% cost reduction

Allocation jumped 41% → 89%

"Before Refine, half our prod EC2 went to 'Unallocated' on the showback report. After two weeks of tag cleanup with the untagged-by-spend list, we had real attribution — and the savings work could finally target the right teams."

Read the story

Frequently Asked Questions

Start with discovery — Refine shows what tags exist where, ranked by spend. Most teams converge on CostCenter / Owner / Environment / Product. Once you pick keys, the policy preview validates them against current state before any enforcement.

Make tags a foundation, not a guilt trip

Connect AWS. See untagged spend in 60 seconds. Free forever.

Connect AWS Account See Cost Optimization

Refine is built and supported by HabileLabs, an AWS Advanced Tier Services Partner.