Tag Governance: Define Required Tags and Track Compliance

Tag Governance

Tag governance is where you decide which tags your resources must carry, and then find out how well reality matches that.

It answers a different question from Cost Allocation. Cost allocation asks “how much spend is untagged?”. Tag governance asks “which resources break the rules I set?”. The two are related but not the same, and they use different vocabulary.

Defining a policy

A policy names one tag key and the rules around it. Open Tag Governance and click New policy. Admins only.

Field	Meaning
Tag key	The tag to check. Matched exactly, including case.
Required	When on, a resource missing this tag is a violation. When off, only invalid values count.
Allowed values	Comma separated, exact match. Leave empty to accept any value.
Applies to	Which resources the policy covers
Resource types	Narrows the policy further to specific types from your inventory
Description	Free text for your own reference

Applies to offers:

All resources
Compute (VMs, instances, app services, functions)
Storage (disks, volumes, buckets, storage accounts)
AWS EC2 instances
Databases (RDS, SQL, Cloud SQL)
Object storage buckets

One policy per tag key. Limits: up to 200 allowed values and up to 50 resource types per policy.

The two kinds of violation

Only two exist, and the distinction matters when you read the numbers:

Violation	When it is raised
Missing	The policy is required and the resource has no value for that tag
Invalid value	The policy has allowed values and the resource’s value is not one of them

A tag whose value is empty or only whitespace counts as missing, not invalid. That is usually what you want: a tag set to an empty string is not meaningfully tagged.

How the score is calculated

compliant = resources checked - missing - invalid
score     = compliant / resources checked

The important subtlety: a resource is checked once per policy that applies to it. A server covered by three policies contributes three checks, not one. So the score measures policy checks passing, not resources passing.

Score colours on the page: 90 percent and above is green, 70 to 90 is amber, below 70 is red.

Tags used for the check are your inventory tags merged with any tag overrides set in Xplorr, and the override wins when both set the same key. That means correcting a tag inside Xplorr improves compliance on the next run without touching the cloud resource.

When it runs

A job recomputes compliance daily at 04:15 UTC and stores a snapshot, which is what builds the score trend over time.

Before the first snapshot exists, the page computes the numbers live on request and tells you so with a Daily snapshot pending notice. The score is correct; only the trend is missing until a few daily snapshots accumulate.

Admins can click Recompute now to refresh immediately.

Reading the page

Pick a range of 7, 30 or 90 days.

Compliance score, Checks, Missing required tags and Invalid values as stat cards
Score trend, which needs at least two daily snapshots before it can draw anything
By account, with checks and score per cloud account
Policies, with each policy’s rule, allowed values, scope, compliance and violation count. Click a violation count to filter the table below to that policy.
Violations, with provider, account, resource, type, tag key and the violation. Filter by policy and by missing against invalid.

Each violation row links into Resource Inventory for that resource, so you can see what it is before deciding how to fix it.

Fixing violations

Xplorr does not write tags back to your cloud provider. There is no bulk tagging button here, and that is deliberate: Xplorr keeps read only access to your infrastructure.

Two paths forward:

Fix at the source. Tag the resource in your cloud provider, or better, in the infrastructure code that created it. The next inventory sync and compliance run pick it up.
Override inside Xplorr. Set a tag override from Cost Allocation when you cannot change the resource, for example on something managed by another team. Overrides count towards compliance on the next run.

Fixing at the source is the only option that also fixes your provider’s own cost reports, so prefer it where you can.

Troubleshooting

“No tagging policies”

Nothing is defined yet. A policy names a tag every resource should carry, such as CostCenter or Environment, and optionally the values it may take.

The score dropped suddenly

Either new untagged resources appeared, or a new policy started checking resources that never carried that tag. Check the policy list for a recently added rule.

A resource I fixed still shows as a violation

Compliance recomputes once a day. Use Recompute now, and confirm the inventory sync has picked up the new tag.

A tag looks correct but is flagged invalid

Values are matched exactly. Leading or trailing spaces, and differences in case, both count as a different value.

The trend is empty

It needs at least two daily snapshots. A newly configured organization has none yet.

FAQ

Does this change anything in my cloud account? No. Xplorr reads inventory and reports on it.

Can one resource count as several violations? Yes, once per policy that applies to it and fails.

What is the difference between this and untagged cost? This counts resources breaking policies. Untagged cost, on the Cost Allocation page, measures spend that cannot be attributed to a tag value. A small number of untagged resources can carry a large share of spend, and the reverse is also true.

Who can create or delete policies? Admins. Everyone else can read the page and the violations for accounts they have access to.

Cost Allocation and Tags for allocating spend and setting tag overrides
Resource Inventory to inspect a flagged resource