To organize your AlloyDB for PostgreSQL clusters and backups, enforce conditional
access control policies, and categorize Cloud Billing cost exports, you can
attach Google Cloud tags to your AlloyDB resources. To add tags
to AlloyDB clusters and backups by using the Google Cloud CLI, see
[Attach and manage tags](https://docs.cloud.google.com/alloydb/docs/manage-tags.md.txt).

## Overview of tags

Google Cloud *tags* are key-value pairs that you can use to organize your AlloyDB resources.

For example, a tag key can be a property, such as `environment`, and the tag value can be
an attribute, such as `development` or `production`. A tag can have only one
value for a given key on a particular resource.

Tags are created at the [organization](https://docs.cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy.md.txt#organizations) or [project](https://docs.cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy.md.txt#projects) level. In AlloyDB, they are attached to the cluster or backup resources through the Resource Manager, which is used across Google Cloud.

You can add a reference to tags in [Identity and Access Management (IAM) policy bindings](https://docs.cloud.google.com/iam/docs/tags-access-control.md.txt)
to grant conditional access to resources. Tags are different from [labels](https://docs.cloud.google.com/resource-manager/docs/creating-managing-labels.md.txt#what-are-labels) which are another way to organize and filter your AlloyDB resources. Tags and labels work independently of each other, and you can use both on the same AlloyDB resource.

## Grant permissions based on conditional tag bindings

After you attach a tag to an AlloyDB resource,
you can use the tag with IAM Conditions to conditionally grant access to AlloyDB
resources. For more information about setting conditions based on tags, see [Resource tags](https://docs.cloud.google.com/iam/docs/conditions-attribute-reference.md.txt#resource-tags). IAM Conditions let you impose
fine-grained access control on AlloyDB resources.

To use
IAM Conditions, you reference the tags in IAM
policy bindings. For more information about how to control access to your Google Cloud resources by using tags with IAM, see [Tags and
conditional access](https://docs.cloud.google.com/iam/docs/tags-access-control).

## Export Cloud Billing data to BigQuery with resource-level tags

After configuring your project to export Cloud Billing data to
BigQuery, your Cloud Billing data such as usage, cost estimates, and
pricing details are automatically and continuously exported to a
BigQuery dataset. You can then query this data using resource-level
tags in BigQuery.

For setup instructions and query examples, see:

- [Set up Cloud Billing data export to
  BigQuery](https://docs.cloud.google.com/billing/docs/how-to/export-data-bigquery-setup)
- [Query
  examples with
  tags](https://docs.cloud.google.com/billing/docs/how-to/export-data-bigquery-tables/standard-usage#query-with-tags)

## Enforcement of mandatory tags using organization policies

> [!WARNING]
>
> **Preview**
>
>
> This product or feature is
>
> subject to the "Pre-GA Offerings Terms" in the General Service Terms section
> of the [Service Specific
> Terms](https://docs.cloud.google.com/terms/service-terms#1).
>
> Pre-GA products and features are available "as is" and might have limited support.
>
> For more information, see the
> [launch stage descriptions](https://cloud.google.com/products/#product-launch-stages).

You can enforce mandatory tags on AlloyDB cluster and backup
resources using an organization policy. To ensure compliance, mandatory tags
enforce your organization's tagging policies, and prevent the creation of AlloyDB
resources if the mandatory tag values are missing.

To learn how to enforce mandatory tags using custom organization policies, see
[enforcing mandatory tags](https://docs.cloud.google.com/resource-manager/docs/tags/tags-overview.md.txt#enforce_tags) in Resource Manager documentation.

## Limitations

Tags have the following restrictions:

- You can't attach tags to the instance resource in AlloyDB.
- Backup resources don't inherit tags from their corresponding clusters.
- Tag-based permissions might fail permission checks performed using the UI since AlloyDB might falsely deny access for resources that have policies applied at the resource level. However, other access methods like Google Cloud CLI, REST API, and Terraform work correctly.
- You can only enforce mandatory tags for on-demand backups. Enforcing mandatory tags on for automated or continuous backups isn't supported.

## What's next

- Learn how to [create and manage tags](https://docs.cloud.google.com/resource-manager/docs/tags/tags-creating-and-managing.md.txt) using Resource Manager.
- See specific `gcloud CLI` commands for AlloyDB in [Manage tags on AlloyDB](https://docs.cloud.google.com/alloydb/docs/manage-tags.md.txt).