Tagging & Labels

Tags are key-value pairs you attach to cloud resources. The Campus Cloud uses them for billing attribution, compliance monitoring, and operational automation.

Some tags are required — the Cloud Team enforces them. Others are set by you.

Why Tags Matter

Billing: Tags appear in cost reports so you can break down charges by project, department, or environment.
Compliance: Tags like protection-level drive security policy scoping and audit requirements.

Required Tags — All Providers

The following tags are required across all three providers. AWS and Azure use a ucsb: namespace prefix. GCP does not (tags are already scoped to the UCSB organization).

What It Tracks	AWS Tag	Azure Tag	GCP Tag
Environment type	`ucsb:environment`	`ucsb:environment`	`environment`
Mission area	`ucsb:mission`	`ucsb:mission`	`mission`
Data sensitivity	`ucsb:protection-level`	`ucsb:protection-level`	`protection-level`
Uptime requirement	`ucsb:availability-level`	`ucsb:availability-level`	`availability-level`
Backup requirement	`ucsb:recovery-level`	—	`recovery-level`
Department	`ucsb:dept`	—	`dept`

Allowed Values

Tag	Allowed Values
`environment`	`dev`, `test`, `prod`, `other`
`mission`	`academic`, `research`, `administrative`, `mixed`
`protection-level`	`p1` (public), `p2` (internal), `p3` (sensitive — PII, FERPA), `p4` (regulated — HIPAA, CUI, ITAR). See UC Data Classification.
`availability-level`	`a1` (minimal impact if unavailable) through `a4` (must stay up — essential service). See UC Data Classification.
`recovery-level`	`r1` (deferrable — up to 30 days to recover) through `r4` (critical — recover within hours). See UC IS-12 IT Recovery Policy (PDF).
`dept`	4-character UCSB department code (e.g., `COMS`, `PHYS`, `MCDB`)

What Happens If You Don’t Tag

Provider	Consequence
AWS	Compliance alert in Security Hub; resource may show as non-compliant
Azure	Resource group flagged as non-compliant (Audit policy)
GCP	Audit finding; platform automation skips untagged projects

For Azure, the four required tags are audited by policy on both resource groups and taggable resources: ucsb:environment, ucsb:mission, ucsb:protection-level, and ucsb:availability-level. Items without these tags are flagged as non-compliant but can still be created. (Azure also audits a ucsb:po-number tag, which the Cloud Team sets at provisioning — you don’t manage it.)

Tag Namespace

AWS and Azure tags use the ucsb: namespace to avoid collisions with provider reserved namespaces (aws:, Microsoft:).

Example: ucsb:environment = prod

GCP Resource Manager Tags are already scoped to the UCSB organization, so no namespace prefix is needed.

How to Update Your Tags

Each provider has a different interface for managing tags:

AWS: AWS resource tagging docs — use Tag Editor in the AWS Console or the CLI.
Azure: Azure resource tagging docs — set tags on Resource Groups and resources in the portal or CLI.
GCP: View and update projects (Tags section) — tags are set at the project level (not on individual resources). Update them under IAM & Admin → Settings → Tags (not IAM & Admin → Tags) in the console or via gcloud resource-manager tags bindings. For project labels, see Creating and managing labels.

Cost Allocation Tags & Labels

The same tags and labels you use for compliance and organization can also break your bill down by project, department, service, or environment. How that works differs by provider. For how to slice spending by tag once it’s set up, see Tracking Your Costs.

AWS

Before a tag can appear in AWS billing reports, AWS requires it to be activated as a cost allocation tag. The Cloud Team activates these centrally in the Campus Cloud management account, so activation applies across every Campus Cloud AWS account — you don’t (and can’t) activate them yourself. Your part is simply to apply the tags to your resources; once a resource is tagged, its costs can be grouped and filtered by that tag.

The following ucsb: tags are currently activated as cost allocation tags:

Tag	Purpose	Who Sets It
`ucsb:po-number`	Purchase Order the account bills against	Cloud Team (at provisioning)
`ucsb:mission`	Mission area (`academic`, `research`, `administrative`, `mixed`)	You
`ucsb:environment`	Environment type (`dev`, `test`, `prod`, `other`)	You
`ucsb:environment:name`	Short name for a specific environment (optional)	You
`ucsb:service`	Groups resources that support the same service	You
`ucsb:costing`	Free-form invoice breakdown — e.g., a Full Accounting Unit (FAU) or cost center	You
`ucsb:business-service`	Legacy tag, replaced by `ucsb:service` — use `ucsb:service` for new resources	You

The compliance tags (protection-level, availability-level, recovery-level) are not activated for cost allocation. For more on how activation works, see the AWS cost allocation tags docs.

Azure

Azure has no activation step. Tags you set on resource groups and resources flow into Cost Management + Billing automatically, where you can group and filter costs by tag — see Group and filter options in Cost analysis.

GCP

GCP has two separate metadata systems, and the Campus Cloud uses both. Like Azure — and unlike AWS — GCP has no activation step: both systems flow into billing data automatically.

Resource Manager Tags — the required tags listed above. Set at the project level, and used for governance, compliance, and automation as well as cost attribution. environment, mission, and dept are the most useful keys for breaking down a bill.
Project Labels — flat key-value pairs set on a project by its owner. Labels also appear in billing data, but they don’t drive policies or automation.

Both appear in Cloud Billing reports and the billing export to BigQuery, where you can group and filter costs by either. Because tags are bound to the project rather than to individual resources, they appear on each cost row marked as inherited. To set labels, see Creating and managing labels.