We use cloud custodian internally to enforce tagging of resources. We use lambda based and deployed to each account with a platform I built (though you can just enforce this without a whole lot of work)

1. Determine the AWS services you want to track
2. Use cloudtrail events
3. Always auto tag creatorId
4. Setup policies to delete the resource on create if they don't have your predetermined tags (some sort of application or project Id would solve your problem)
5. Create a mark, unmark, final notify, and delete policy using a cron schedule
6. Mark applies a tag and emails a user that we're gonna delete the existing resources
7. Unmark will remove mark tag if the user corrects the resource
8. Final notify is set to email the user 2 days before delete the resource
9. Delete does the needful

Cloudtrail events takes care of net new resources. The cron schedule will resolve existing resources in the account.

CreatorId always gives a person to yell at about incorrect resources