How do you enforce tagging and governance across a large cloud estate?

Make the compliant path the easy one. Apply tags automatically in the infrastructure code modules and at the account or organization level so most resources are tagged without anyone thinking about it, then enforce with policies that refuse to create untagged resources in production. Report on coverage per team rather than globally, remediate historical gaps in batches, and keep the required tag set small enough that people can remember it.

Enforcement only works if compliance is the path of least resistance, so I automate first and police second. The required set stays small, realistically owner, environment, cost center and data classification, because every extra tag halves adoption. Then most of them get applied without anyone typing them: shared infrastructure modules set them from variables, and default tags at the provider or account level cover anything created through the pipeline. That alone usually takes coverage from about half to the high nineties. What is left gets a policy that blocks creation of untagged resources, and I roll that out in warn mode first, then enforce in non production, then production, so teams get time rather than a surprise failure. Reporting is per team, since a global compliance number is nobody's problem while a team level one has an owner. For the backlog of existing resources I run a bulk tagging exercise with owners confirming rather than guessing, and anything nobody claims after a couple of reminders becomes a candidate for shutdown, which is remarkably effective at finding owners.