Read-only audit of normalized multi-provider resource inventory exports against required cost-center, owner, and environment tags. Offline; no provider credentials, API calls, tagging writes, or auto-exceptions. Node.js 22+, zero dependencies. src/index.mjs exports checkCostTags(inventory, policy, {now, deadline}) and TOOLID.
This walkthrough uses the tool's public README and checked-in example files. Run the command from a repository checkout with Node.js 22+.
Run the checked-in example
node bin/cloud-cost-tag-checker.mjs --root examples --policy policy.json --inventory passing-inventory.json
node bin/cloud-cost-tag-checker.mjs --root examples --policy policy.json --inventory failing-inventory.jsonRead the result
An inventory resource may declare excluded:true only with an exact matching policy exception {provider,resourceId,reason,expiresAt}. Reason must be nonblank, expiry must be a valid UTC instant strictly after asOf, and each exception targets one provider/resource identity. Missing or expired approval fails; malformed exception policy is invalid configuration. A policy exception does not itself exclude an unmarked resource. Reasons, identifiers, and tag values are never echoed.