Loading page
About this tool
Generate a mandatory cloud tag schema for cost allocation with allowed values, provider-safe keys, examples and enforcement notes.
This generator produces a ready-to-adopt cloud tagging policy: a mandatory tag schema (environment, owner, cost-center, application, project) with allowed values, provider-legal key names and an enforcement recipe, exported as Markdown or JSON. It encodes the documented tag limits of AWS (128-character keys), Azure (512) and Google Cloud (63, lowercase labels only), so platform and FinOps teams get a schema that will not be rejected at resource creation.
Open Cloud Tagging Policy Generator on AltFTool — it loads instantly in your browser.
Paste your code or data sample into the workspace.
Pick the format, conversion, or analysis you need.
Copy the polished result straight back into your project.
Namespaced keys respect AWS, Azure and GCP character limits and GCP's lowercase-only label rules.
Each provider gets a concrete recipe: Tag Policies + SCPs, Azure Policy definitions, or Terraform validation.
Copy the policy as a Markdown doc for humans or JSON for pipelines and linters.
Five tags cover most cost-allocation needs: environment, owner, cost-center, application and project. With those on every billable resource, finance can attribute 100% of spend by cost centre and drill into any line item, which is the baseline FinOps Foundation guidance recommends before adding optional tags like data-classification or managed-by.
AWS allows 50 tags per resource with keys up to 128 characters and values up to 256; Azure allows 50 tags with keys up to 512 characters; Google Cloud allows 64 labels with keys and values up to 63 characters, restricted to lowercase letters, digits, underscores and hyphens. GCP is the strictest, which is why a portable schema should be validated against its rules first.
Combine AWS Organizations Tag Policies (which standardise keys and values) with a Service Control Policy that denies resource creation when required tags are missing, using the aws:RequestTag and aws:TagKeys condition keys. Tag Policies alone only report non-compliance — the SCP is what actually blocks untagged resources.
Google Cloud label values forbid "@" and "." characters, so a raw email address is an invalid label value. The common workaround this tool applies is encoding the owner as local-part plus a separator and the domain with dots replaced (for example jane-doe__acme-com), or storing the full email in an inventory system keyed by the label.