TL;DR: Stop running tagging as a cleanup campaign and treat the schema as a contract enforced at creation time: defaults baked into infrastructure modules, creation denied without mandatory keys, drift swept by automation, and one KPI, the unallocated percentage, owned by a named person and reviewed weekly.
How to approach it
Agree on the diagnosis first: voluntary tagging conventions always fail at scale, so the interview is really testing whether you reach for enforcement or for another email campaign. Then give the schema, the enforcement layers, and the migration order for the existing estate.
A strong answer
Schema first, and keep it small. Four mandatory keys cover nearly every allocation conversation: owner (a team identifier validated against the org directory, never free text), service, environment and cost-centre. Fifteen-key aspirational schemas die of their own weight because every added key lowers compliance across all the others.
Enforcement lives at creation time, in layers:
- Modules bake defaults in. Tags defined once at module level and merged automatically, so doing nothing is compliant. This layer wins, because engineers inherit correctness instead of remembering it.
- Policy denies untagged creation. Cloud policy conditions (an SCP or equivalent) reject resource creation missing mandatory tags, after a detection-only phase using inventory or configuration checks. SCPs do not have a generic audit-only mode. Validate service/action support for request-tag conditions and provide exceptions for resources that cannot be tagged at creation.
- Runtime sweeps catch strays. Console-created resources happen regardless; a scheduled function tags or quarantines them within a day using whatever ownership signals exist (creator identity, network location, naming).
- Exceptions are registered with expiry. A dated allowlist beats shadow non-compliance, and expired exceptions resurface loudly.
Activate the required allocation tags in the billing system and verify coverage in exports. AWS supports requesting up to twelve months of cost-allocation-tag backfill, subject to the tags having existed on the resources in those periods and the documented account rules. It cannot invent historical ownership. AWS tag backfill. Track unallocated spend against an agreed target and publish the largest unresolved owners.
Migration order for the existing untagged half: freeze new untagged creation first, detection immediately and staged enforcement after compatibility checks, then burn down the backlog by spend mass, largest orphaned line items first, with bulk tag operations. Freeze before clean-up, otherwise the backlog refills behind the crew as fast as they sweep.
Reversal condition: an estate under twenty engineers may run on module defaults plus a weekly audit alone; enforcement machinery has operating cost and should scale with the organisation.
What interviewers probe next
"Teams say the policy blocks urgent work." An emergency bypass role whose grants expire automatically and log exceptions audited weekly; a valve prevents the policy being routed around.
"Owner values rot when teams reorganise." Validate against the HR-fed directory so renamed teams fail visibly, plus an annual reconciliation pass.
"Multi-cloud?" One schema everywhere, per-cloud enforcement primitives, and a single aggregation layer in the cost tool so the KPI stays singular.
Common mistakes
Announcing a fifteen-key taxonomy and a deadline instead of shipping module defaults.
Treating tagging as an annual project, so coverage decays the moment attention moves elsewhere.
Forgetting the cost-tool activation step, so perfect hygiene never appears in any report.
Free-text owner fields that decay the first time two people spell the same team differently.