This rule identifies taggable AWS resources with no user-created tags, helping close the gap between what your cost allocation reports can attribute and what's actually running in the account.
| Rule ID | Scan Type | Severity | Name |
|---|---|---|---|
| CLDBRN-AWS-TAGGING-1 | Discovery | Low | AWS Resource Untagged |
This rule is account-wide by nature — it reports on every taggable resource Resource Explorer can see, not a specific service — so it is excluded from the default aws-core preset and only runs when explicitly enabled. See Enabling and Disabling Rules for how to opt in.
CLDBRN-AWS-TAGGING-1
AWS Resource Untagged
Scan type: Discovery
Severity: Low
What it checks
Flags taggable AWS resources that Resource Explorer reports without any user-created tags.
Why it matters
Untagged resources are invisible to cost allocation tags, Cost Explorer's tag-based filters, and most FinOps chargeback workflows. A resource with no tags can't be attributed to a team, environment, or project, which means its cost either gets absorbed into a shared bucket or goes unnoticed entirely. Tagging coverage is also the input every other cost-allocation rule and dashboard depends on — an untagged resource undermines the accuracy of all of them.
What triggers a finding
The resource appears in the normalized untagged-resource inventory and its creationOrigin is not unknown. Collection excludes built-in defaults and service-managed resources.
Coverage
Resources whose creation origin cannot be determined are reported as unknown and do not produce findings. See Live Evaluation Coverage.
How to remediate
Add at least one tag to the resource, ideally following a consistent taxonomy (Environment, Team, CostCenter, Project):
aws resourcegroupstaggingapi tag-resources \
--resource-arn-list arn:aws:ec2:us-east-1:123456789012:volume/vol-0abc1234def56789 \
--tags Environment=production,Team=platform
For ongoing coverage, enforce tagging at creation time with an SCP or IaC policy check rather than relying on periodic cleanup scans.
See Also
- CLI discover command — scan live AWS resources
- Understanding Rules — Enabling and Disabling Rules — opt in to account-wide rules excluded from the default preset
- SDK Reference — run discovery programmatically