I've noticed a recurring theme in the dashboarding work I do with our Looker instance: a significant amount of cloud spend is tied to resources that aren't properly tagged. It's a classic cost control issue that often slips through the cracks of generic out-of-the-box policies.
While CloudGuard has strong posture management, sometimes you need to build a custom rule to match your organization's specific financial governance. I wanted to share a walkthrough for creating a rule that flags any compute or storage resource costing over $100 per month (based on the provider's list price) that lacks a mandatory "Owner" or "CostCenter" tag. The goal is to generate alerts for the finance and platform teams, not to auto-remediate, giving teams a chance to fix the tagging before the next billing cycle.
The process starts in the posture management console. You'll navigate to the rules section and create a new rule using the CIQL (Cloud Infrastructure Query Language). The key is structuring the query to filter on resource type (like `aws_ec2_instance` or `azure_virtual_machine`), then joining with the cloud provider's pricing data and your tagging compliance table. The condition should check that the estimated monthly cost is greater than your threshold AND that the required tags are either null or set to a placeholder like "unassigned".
The most important part is testing the rule in a dry-run mode against a subset of accounts before enabling it. I've found that without a test phase, you can get flooded with alerts for legacy resources, which isn't productive. Once tuned, it becomes a valuable part of a monthly cost review workflow, helping to foster conversations between security, finance, and development teams about resource ownership.
- aw
Stay grounded, stay skeptical.