Create and manage tags

This page describes Google Cloud tags and how to use them with Cloud DNS. Tags can be applied to Cloud DNS policies.

About tags

A tag is a key-value pair that can attach to a resource within Google Cloud. You can use tags to conditionally allow or deny policies based on whether a resource has a specific tag. For example, you can conditionally grant Identity and Access Management (IAM) roles based on whether a resource has a specific tag. For more information about tags, see Tags overview.

Tags are attached to resources by creating a tag binding resource that links the value to the Google Cloud resource.

Required permissions

To get the permissions that you need to manage tags, ask your administrator to grant you the following IAM roles:

• Tag Viewer (roles/resourcemanager.tagViewer) on the resources the tags are attached to
• View and manage tags at the organization level: Organization Viewer (roles/resourcemanager.organizationViewer) on the organization
• Create, update, and delete tag definitions: Tag Administrator (roles/resourcemanager.tagAdmin) on the resource you're creating, updating, or deleting tags for
• Attach and remove tags from resources: Tag User (roles/resourcemanager.tagUser) on the tag value and the resources that you are attaching or removing the tag value to

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

To attach tags to Cloud DNS policies, you need the Cloud DNS Admin role (roles/dns.admin).

Create tag keys and values

Before you can attach a tag, you need to create a tag and configure its value. To create tag keys and tag values, see Creating a tag and Adding a tag value.

Enforce mandatory tags

Preview

This product or feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA products and features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

You can enforce mandatory tags on resources to ensure that specific tags are present when resources are created, such as a Cost Center tag, to maintain compliance with organizational policies. You can do this using organization policies and custom constraints. Enforcement occurs at resource creation, preventing the provisioning of resources without the required tags. For more information, see Enforcement of mandatory tags using organization policies.

Set up a custom constraint to enforce tags

Console

1. In the Google Cloud console, go to the Organization policies page.

   Go to Organization policies

2. Select the project picker at the top of the page.

3. From the project picker, select the organization where you want to enforce the custom constraint.

4. Set up a custom constraint with the following parameters:

   • Enforcement method: Govern tags
   • Resource type: the fully qualified name of the Google Cloud REST resource that you want to enforce mandatory tags on, for example, file.googleapis.com/Instance
   • Condition: a Common Expression Language (CEL) condition specifying the tag keys that you want to enforce on the resource, for example resource.hasDirectTagKey("1234567890/owner") to enforce a tag binding for the tag key 1234567890/owner. The resource.hasDirectTagKey CEL function only matches tags directly applied to a resource and doesn't consider tags inherited from ancestors in the resource hierarchy.
   • Action: Allow or Deny.
     • Allow: If the specified condition is met, the action to create or update the resource is permitted.
     • Deny: If the specified condition is met, the action to create or update the resource is blocked.

5. Click Create constraint.

gcloud

Create a YAML file for the custom constraint:

name: organizations/ORGANIZATION_ID/customConstraints/CONSTRAINT_NAME
resourceTypes:
- RESOURCE_NAME
methodTypes:
- GOVERN_TAGS
condition: "CONDITION"
actionType: ACTION
displayName: DISPLAY_NAME
description: DESCRIPTION

Replace the following:

• ORGANIZATION_ID: your organization ID, such as 1234567890.

• CONSTRAINT_NAME: the name you want for your new custom constraint. A custom constraint must start with custom., and can only include uppercase letters, lowercase letters, or numbers, for example, custom.enforceMandatoryTags.

• RESOURCE_NAME: the fully qualified name of the Google Cloud REST resource that you want to enforce mandatory tags on, for example, file.googleapis.com/Instance.

• CONDITION: a Common Expression Language (CEL) condition specifying the tag keys that you want to enforce on the resource, for example resource.hasDirectTagKey("1234567890/owner") to enforce a tag binding for the tag key 1234567890/owner.

• ACTION: the action to take if the condition is met. This can be either ALLOW or DENY.

  The deny action means that if the specified condition is met, the operation to create or update the resource is blocked.

  The allow action means that if the specified condition is met, the operation to create or update the resource is permitted. This also means that every other case except the one explicitly listed in the condition is blocked.

• DISPLAY_NAME: a human-friendly name for the constraint. This field has a maximum length of 200 characters.

• DESCRIPTION: a human-friendly description of the constraint to display as an error message when the policy is violated. This field has a maximum length of 2000 characters.

Set up the custom constraint to make it available for organization policies in your organization.

After you've defined the custom constraint, you can test and analyze the organization policy changes and enforce the constraint.

Add tags to existing resources

To add a tag to existing policies, follow these steps:

Console

1. Go to the Cloud DNS page in the Google Cloud console.

Go to Cloud DNS

2. Select the page for the resource to which you want to attach a tag. For example, to attach a tag to a policy, go to the Policies page.
3. Click Tags.
4. If your organization doesn't appear in the Tags panel, click Select scope. Select your organization and click Open.
5. Click Add tag.
6. Select the key for the tag you want to attach from the list. You can filter the list by typing keywords.
7. Select the value for the tag you want to attach from the list. You can filter the list by typing keywords.
8. Click Save.
9. In the Confirm dialog, click Confirm to attach the tag.

A notification confirms that your tags updated.

gcloud

To attach a tag to a policy, you must create a tag binding resource by using the gcloud resource-manager tags bindings create command:

      gcloud resource-manager tags bindings create \
          --tag-value=TAGVALUE_NAME \
          --parent=RESOURCE_ID
      

Replace the following:

• TAGVALUE_NAME: the permanent ID or namespaced name of the tag value that is attached—for example, tagValues/567890123456.
• RESOURCE_ID is the full ID of the resource, including the API domain name to identify the type of resource (//dns.googleapis.com/). For example, to attach a tag to /projects/PROJECT_ID/policies/POLICY_ID, the full ID is //dns.googleapis.com/projects/PROJECT_ID/policies/POLICY_ID.

List tags attached to resources

You can view a list of tag bindings directly attached to or inherited by the policy.

Console

1. Go to the Cloud DNS page in the Google Cloud console.

Go to Cloud DNS

2. Select the page for the resource to which you want to view tags. For example, to view tags for policy, go to the Policies page.

   Tags are displayed in the Tags section of the policy page in the console.

gcloud

To get a list of tag bindings attached to a resource, use the gcloud resource-manager tags bindings list command:

      gcloud resource-manager tags bindings list \
          --parent=RESOURCE_ID
      

Replace the following:

• RESOURCE_ID is the full ID of the resource, including the API domain name to identify the type of resource (//dns.googleapis.com/). For example, to attach a tag to /projects/PROJECT_ID/policies/POLICY_ID, the full ID is //dns.googleapis.com/projects/PROJECT_ID/policies/POLICY_ID.

You should get a response similar to the following:

name: tagBindings/%2F%2Fcloudresourcemanager.googleapis.com%2Fprojects%2F7890123456/tagValues/567890123456
          tagValue: tagValues/567890123456
          resource: //dns.googleapis.com/projects/PROJECT_ID/policies/POLICY_ID
      

Detach tags from resources

You can detach tags that have been directly attached to a policy. Inherited tags can be overridden by attaching a tag with the same key and a different value, but they can't be detached.

Console

1. Go to the Cloud DNS page in the Google Cloud console.

Go to Cloud DNS

2. Select the page for the resource to which you want to remove a tag. For example, to remove a tag from a policy, go to the Policies page.
3. Click Tags.
4. In the Tags panel, next to the tag you want to detach, click Delete item.
5. Click Save.
6. In the Confirm dialog, click Confirm to detach the tag.

A notification confirms that your tags updated.

gcloud

To delete a tag binding, use the gcloud resource-manager tags bindings delete command:

      gcloud resource-manager tags bindings delete \
          --tag-value=TAGVALUE_NAME \
          --parent=RESOURCE_ID
      

Replace the following:

• TAGVALUE_NAME: the permanent ID or namespaced name of the tag value that is attached—for example, tagValues/567890123456.
• RESOURCE_ID is the full ID of the resource, including the API domain name to identify the type of resource (//dns.googleapis.com/). For example, to attach a tag to /projects/PROJECT_ID/policies/POLICY_ID, the full ID is //dns.googleapis.com/projects/PROJECT_ID/policies/POLICY_ID.

Delete tag keys and values

When removing a tag key or value definition, ensure that the tag is detached from the policy. You must delete existing tag attachments, called tag bindings, before deleting the tag definition itself. To delete tag keys and tag values, see Deleting tags.

Identity and Access Management conditions and tags

You can use tags and IAM conditions to conditionally grant role bindings to users in your hierarchy. Changing or deleting the tag attached to a resource can remove user access to that resource if an IAM policy with conditional role bindings has been applied. For more information, see Identity and Access Management conditions and tags.

What's next

• See the other services that support tags.
• See Tags and access control to learn how to use tags with IAM.