This rule identifies taggable AWS resources with no user-created tags, helping close the gap between what your cost allocation reports can attribute and what's actually running in the account.
| Rule ID | Scan Type | Severity | Name |
|---|---|---|---|
| CLDBRN-AWS-TAGGING-1 | Discovery | Low | AWS Resource Untagged |
This rule is account-wide by nature — it reports on every taggable resource Resource Explorer can see, not a specific service — so it is excluded from the default aws-core preset and only runs when explicitly enabled. See Enabling and Disabling Rules for how to opt in.
CLDBRN-AWS-TAGGING-1
AWS Resource Untagged
Scan type: Discovery
Severity: Low
What it checks
Flags taggable AWS resources that Resource Explorer reports without any user-created tags.
Why it matters
Untagged resources are invisible to cost allocation tags, Cost Explorer's tag-based filters, and most FinOps chargeback workflows. A resource with no tags can't be attributed to a team, environment, or project, which means its cost either gets absorbed into a shared bucket or goes unnoticed entirely. Tagging coverage is also the input every other cost-allocation rule and dashboard depends on — an untagged resource undermines the accuracy of all of them.
What triggers a finding
The resource appears in Resource Explorer's inventory with no user-created tags.
How to remediate
Add at least one tag to the resource, ideally following a consistent taxonomy (Environment, Team, CostCenter, Project):
aws resourcegroupstaggingapi tag-resources \
--resource-arn-list arn:aws:ec2:us-east-1:123456789012:volume/vol-0abc1234def56789 \
--tags Environment=production,Team=platform
For ongoing coverage, enforce tagging at creation time with an SCP or IaC policy check rather than relying on periodic cleanup scans.
See Also
- CLI discover command — scan live AWS resources
- Understanding Rules — Enabling and Disabling Rules — opt in to account-wide rules excluded from the default preset
- SDK Reference — run discovery programmatically