Tags let you annotate resources and, in some cases, conditionally enforce policies based on whether a resource has a specific tag. This document lists the Google Cloud services, policy engine services, and resource types that support tags. For more information, see the Tags overview.
Policy engines, such as Identity and Access Management (IAM), evaluate tags to govern access and configurations. When a service resource supports tag attachment and a policy engine supports that resource type, you can conditionally enforce policies on it. For resources that policy engines can't target directly, tag the parent project, folder, or organization to manage policies through inheritance. Each policy engine lists supported resources in the Policy engine services section. To attach tags, see Creating and managing tags.
Policy engine services
The following services include policies that can include tags. Referencing tags in these policies allows you to finely tune the way they operate on supported resources in your Google Cloud resource hierarchy.
| Google Cloud service | Resource types |
|---|---|
| Cloud Billing | |
| Identity and Access Management (IAM) | |
| Organization Policy Service | |
| Cloud Next Generation Firewall |
The following sections describe how you can use tags with policy engine services.
Identity and Access Management
You can conditionally grant IAM roles or conditionally deny IAM permissions based on whether a resource has a specific tag.
Resources inherit tag values from their parent organization, folders, and project. As a result, you can use tags to manage access to any Google Cloud resource.
For more information about using tags with IAM to help control access to your Google Cloud resources, see Tags and access control.
Organization Policy Service
You can use organization policies with tags to control how your organization policy constraints are applied on certain resources. Organization policies using managed and custom constraints can be conditionally enforced by referencing tags attached to supported resources.
Most legacy managed constraints can't include conditions that involve tags attached to service resources. For a list of legacy managed constraints that support conditions on tags attached to service resources, see Scope organization policies with tags.
Cloud Next Generation Firewall
You can use tags to define sources and targets in network firewall policies and regional firewall policies. For more information, see Manage VM traffic by using secure tags.
Cloud Billing
Cloud Billing export to BigQuery includes tags inherited by resources from their parent project, folders, and organization. In addition to inherited tags, resource-level tags are reported for Compute Engine instances, Spanner instances, and Artifact Registry repositories only.
Supported service resources
You can attach tags to the following types of Google Cloud resources: