Build the tag policy that makes chargeback possible

applied · 60 min · Objective 1.8

Task

Chargeback and showback both rest entirely on tagging, and voluntary tagging decays. Build the enforcement, then prove it by attempting to create something without the required tags.

Steps

  1. Define the required tag keys and their allowed values in lab/tag-policy.md, including who owns each key and what an invalid value looks like.
  2. Express the requirement as policy: either a provider tag policy, a deny rule for resource creation without the keys, or a policy-as-code rule your IaC pipeline enforces. Save the rule to lab/policy.rego or the equivalent for your tool.
  3. Write a template that creates one resource WITHOUT the required tags. Run it through the policy check and capture the refusal in lab/refused.txt.
  4. Fix the template, re-run, and capture the pass in lab/passed.txt.
  5. Write the showback report definition: the grouping, the period, and what the report does with resources that are still untagged -- because that bucket is also your waste report.

Verify

test -s lab/refused.txt && grep -Eci 'deny|refus|fail|violat' lab/refused.txt
test -s lab/passed.txt && grep -Eci 'pass|allow|success' lab/passed.txt
grep -Eci 'untagged' lab/tag-policy.md

Both files must exist with the expected outcomes. A policy that has only ever been run against compliant input has not been shown to detect anything.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.