Cloud cost management in most enterprises follows a predictable and exhausting pattern. Resources are deployed — sometimes through IaC, often through ClickOps, sometimes by development teams who have immediate access and long-term amnesia about what they created. Finance asks for cost attribution by business unit. The cloud team begins investigating which resources belong to which team. This takes weeks.
The following quarter, the process repeats.
The root cause
The root cause is that tagging is treated as a post-deployment activity in most organisations. Tags are applied retrospectively, inconsistently and only when someone asks for them. Resources created through direct console access bypass any tagging requirement. Automated deployments sometimes include tags and sometimes do not, depending on which engineer wrote the code.
How ZAP enforces mandatory tagging
ZAP eliminates this through mandatory tagging enforcement at deployment. Every resource deployed through ZAP is tagged at creation — owner, cost centre, project, environment and classification. These are not optional fields. The deployment pipeline will not proceed without them.
The technical mechanism is the pre-flight validation and the 5-gate pipeline. Step two of the ZAP landing zone wizard requires cost centre and project tags before any Terraform is generated. The generated Terraform includes these tags on every resource. Gate four — ZAP Compliant Scan — validates that all generated resources include required tags before the PR is raised. A PR with missing or malformed tags fails the gate and is not presented for Platform Lead approval.
This creates cost attribution from the first minute of resource existence. When ZAP FinOps runs its daily waste scan, every finding is attributed to an owning team immediately. No investigation required.
The compounding effect at enterprise scale
An organisation with £5M annual cloud spend and 2,000 governed resources typically sees 15–25% of spend in resources that either cannot be attributed at all or are owned by teams with no visibility of the cost. Mandatory tagging from deployment changes this permanently.
For organisations planning cloud governance programmes, mandatory tagging enforcement is the most important single investment in FinOps governance. Everything else — right-sizing, waste identification, budget management — is easier when every resource knows who owns it.
See ZAP live
Book a 30-minute session with the Zentej team. We show you ZAP live on our instance — landing zone, compliance scan, evidence generation, ZAP AI. No commitment.