Attribute cloud costs to teams

WHAT THIS TESTS This checks whether you know the bedrock FinOps mechanism, resource tagging for cost allocation, and how to operationalize it reliably.

A GOOD ANSWER COVERS The fundamental mechanism is tagging: attaching key-value metadata to every resource, such as team, project, cost-center, and environment. To attribute costs you activate these as cost-allocation tags in the billing system so the provider breaks down spend by tag. Then in the cost-management tool you filter and group the bill by the team tag, immediately revealing which team owns the object-storage spike. Implementation steps: define a small, consistent tagging taxonomy; activate the chosen tags for cost allocation; backfill tags on existing resources; and, critically, enforce tagging going forward so the data stays reliable, by requiring tags in IaC, blocking or flagging untagged resources with policy, and auditing coverage. A complementary boundary is structural separation: putting each team in its own account or project so spend is naturally segregated even without tags, which also strengthens security isolation. Tags are more granular and flexible, while account separation is coarser but harder to circumvent; mature setups use both.

COMMON WRONG ANSWERS Trying to attribute costs with no tagging or account structure, leaving only guesswork. Inconsistent tag keys such as Team versus team versus owner, which fragment reports. Forgetting to activate the tags for cost allocation, so they never appear in the bill. No enforcement, so coverage decays over time. Confusing a resource's name with a billable allocation tag.

LIKELY FOLLOW-UPS How do you enforce mandatory tags? Tags versus per-team accounts, when do you use each? How do you handle shared resources used by many teams? How do you backfill untagged legacy resources?

ONE CONCRETE EXAMPLE Every bucket carries a team tag. Finance opens the cost report, groups object-storage spend by the team tag, and sees the data-science team accounts for the spike. A tagging policy in the IaC pipeline blocks any future untagged bucket, so attribution stays accurate as the estate grows and finance can self-serve the answer next time.