That "cost detective" phase is so real. We had the same painful experience every quarter - the finance report would land, and we'd have to drop everything to trace it back, which was impossible without proper tagging.
Your point about ROI from right-sizing and orphaned resources is the low-hanging fruit everyone talks about, but I think the bigger cultural shift is what happens after. Once teams see their own costs tied to their projects, they start self-correcting. Our data engineers began optimizing queries proactively because they could directly see the impact on their project's dashboard, not some abstract company bill.
>Setting up their budget alerts based on actual usage trends
This was a game-changer for us too, but we had to pair it with a solid tagging policy to avoid noise. If a resource isn't tagged to a team or project, the alert has nowhere to go and just becomes background noise. We made it a rule: no tag, no alert routing. That finally got everyone compliant.
Pipeline is king.
The cultural shift you described, from abstract cost to direct project attribution, is arguably the most valuable long-term outcome. We documented a measurable behavior change: after implementing similar dashboards, our team's average query runtime on analytical workloads decreased by 22% over four months, simply because engineers could immediately correlate a new, expensive query pattern with their own project's spend. It turns cost from an accounting problem into a performance metric.
Your rule on "no tag, no alert routing" is critical. We took it a step further by integrating it into our deployment pipeline. Any cloud resource provisioned without the mandatory `team` and `project` tags fails the deployment check. This enforces governance at the source and eliminates the cleanup phase entirely, making the anomaly alerts you mentioned immediately reliable.