In an embodiment, processing logic receives a request to perform an operation with respect to a resource associated with an account. Processing logic determines a tag policy for the account, wherein the tag policy specifies a required tag for resources associated with the account, wherein the required tag comprises a key value pair comprising a tag key and an associated tag value. Processing logic determines or more tag compliance rules of the tag policy, wherein the one or more tag compliance rules comprise a required syntax for the tag key and a set of permissible values for the tag value. Processing logic determines that the resource fails to comply with the one or more tag compliance rules of the tag policy and performs a remedial action with respect to the resource.