Access control with tags

You can organize your Datastream private connectivity configurations, connection profiles, and streams by using Resource Manager tags. Referencing inherited or directly attached tags in Identity and Access Management (IAM) policy bindings lets you grant conditional access across the Google Cloud resource hierarchy.

Tags work independently of labels, which let you filter Datastream resources such as connection profiles and streams. You can apply both to the same resource. To attach, detach, and list tags on your Datastream resources using the Google Cloud CLI, see Manage tags.

What are tags?

Tags are key-value pairs you can apply to your Datastream resources for fine-grained access control.

A tag key could be a property, such as environment, and the tag value could be an attribute, such as development or production. A tag can have only one value for a given key on a particular resource.

Tags are created at the organization level. Tags are attached to resources, such as a project or a Datastream private connectivity configuration, connection profile, or stream, through the Resource Manager, which is used across Google Cloud.

Grant permissions based on conditional tag bindings

After a tag is attached to or inherited by a Datastream resource, you can use the tag with IAM Conditions to grant access to Datastream resources conditionally. IAM Conditions let you impose fine-grained access control on Datastream resources. To use IAM Conditions, you reference the tag in IAM policy bindings.

Restrictions

Tags have the following restrictions:

  • Organization policies can conditionally reference tags inherited from the project level and higher, but don't support tags that are directly attached to Datastream resources.
  • Cloud Audit Logs show the creation and deletion of tags, but entries aren't generated for attaching tags and viewing tag bindings on Datastream resources.

What's next