This page describes how to attach, detach, and list tags on Cloud SQL
instances. For an overview of tags on Cloud SQL, see
[Access control with Google Cloud tags](https://docs.cloud.google.com/sql/docs/postgres/tags.md.txt).

## Before you begin

Tags are managed through Resource Manager. To create and define tags before
attaching them to Cloud SQL instances, see
[Creating and managing tags](https://docs.cloud.google.com/resource-manager/docs/tags/tags-creating-and-managing.md.txt).

### Required roles


To get the permissions that
you need to view and manage tags on Cloud SQL instances,

ask your administrator to grant you the
following IAM roles:

- Manage Cloud SQL instances and tag bindings: [Cloud SQL Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/cloudsql.md.txt#cloudsql.admin) (`roles/cloudsql.admin`) on the project
- Attach and detach tags on Cloud SQL instances: [Tag User](https://docs.cloud.google.com/iam/docs/roles-permissions/resourcemanager.md.txt#resourcemanager.tagUser) (`roles/resourcemanager.tagUser`) on the tag value and the project
- View and list tags on Cloud SQL instances: [Tag Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/resourcemanager.md.txt#resourcemanager.tagViewer) (`roles/resourcemanager.tagViewer`) on the project


For more information about granting roles, see [Manage access to projects, folders, and organizations](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access.md.txt).


These predefined roles contain

the permissions required to view and manage tags on Cloud SQL instances. To see the exact permissions that are
required, expand the **Required permissions** section:


#### Required permissions

The following permissions are required to view and manage tags on Cloud SQL instances:

- Create an instance with a tag attached:
  - `cloudsql.instances.create`
  - `cloudsql.instances.createTagBinding`
  - `resourcemanager.tagValueBindings.create`
- Attach a tag to an instance:
  - `cloudsql.instances.createTagBinding`
  - `resourcemanager.tagValueBindings.create`
- Detach a tag from an instance:
  - `cloudsql.instances.deleteTagBinding`
  - `resourcemanager.tagValueBindings.delete`
- List tags on an instance:
  - `cloudsql.instances.listTagBindings`
  - `cloudsql.instances.listEffectiveTags`
  - `resourcemanager.tagKeys.get`
  - `resourcemanager.tagKeys.list`
  - `resourcemanager.tagValues.get`
  - `resourcemanager.tagValues.list`


You might also be able to get
these permissions
with [custom roles](https://docs.cloud.google.com/iam/docs/creating-custom-roles.md.txt) or
other [predefined roles](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#predefined).

## Create a Cloud SQL instance with a tag

To create an instance with a tag attached, use the `--tags` flag when creating the instance.
This combines the tags with organization policies, custom organization policies, and IAM conditions to
give more customization to instance creation policies.

For example, the following command creates an instance in the [gcloud CLI](https://docs.cloud.google.com/sdk/gcloud.md.txt) with the 1234 tag with a value of 5678
\[`gcloud sql instances create tags-instance --tags=tagKeys/1234=tagValues/5678`\]

## Attach tags to Cloud SQL instances

Once you've [created and defined](https://docs.cloud.google.com/resource-manager/docs/tags/tags-creating-and-managing.md.txt#creating)
a tag using Resource Manager, you can attach the tag to a Cloud SQL
instance. To attach a tag to a Cloud SQL instance, create a tag binding
by running the [`gcloud resource-manager tags bindings create`](https://docs.cloud.google.com/sdk/gcloud/reference/resource-manager/tags/bindings/create)
command:

```sql
gcloud resource-manager tags bindings create \
--tag-value=TAG_VALUE_ID \
--parent=PARENT \
--location=LOCATION
```

In the previous command, make the following replacements:

- <var class="readonly" translate="no">TAG_VALUE_ID</var>: the permanent ID or the
  namespaced name of the tag value. For example, `tagValues/4567890123` or
  `12345678/environment/production`.
  For more information about tag
  identifiers, see [Tag definitions and identifiers](https://docs.cloud.google.com/iam/docs/tags-access-control.md.txt#definitions).

- <var class="readonly" translate="no">PARENT</var>: the full resource name of the
  Cloud SQL instance to attach the tag to. For example,
  `//sqladmin.googleapis.com/projects/my-project/instances/my-instance`.

- <var class="readonly" translate="no">LOCATION</var>: the regional location of the
  Cloud SQL resource. For example, `us-central1`.

## Detach tags from Cloud SQL instances

The [`gcloud resource-manager tags bindings delete`](https://docs.cloud.google.com/sdk/gcloud/reference/resource-manager/tags/bindings/delete) command detaches the tag from `my-instance`:

```bash
gcloud resource-manager tags bindings delete \
--tag-value=815471563813/environment/development \
--parent=//sqladmin.googleapis.com/projects/my-project/instances/my-instance \
--location=us-central1
```

## List tags on Cloud SQL instances

The [`gcloud resource-manager tags bindings list`](https://docs.cloud.google.com/sdk/gcloud/reference/resource-manager/tags/bindings/list) command lists all tags directly attached to `my-instance`,
except tags that `my-instance` has inherited:

```bash
gcloud resource-manager tags bindings list \
    --parent=//sqladmin.googleapis.com/projects/my-project/instances/my-instance \
    --location=us-central1
```

## What's next

- For an overview of tags on Cloud SQL, see [Access control with Google Cloud tags](https://docs.cloud.google.com/sql/docs/postgres/tags.md.txt)
- For more detailed instructions, see [Attach tags to resources](https://docs.cloud.google.com/resource-manager/docs/tags/tags-creating-and-managing.md.txt#attaching).
- Learn about [IAM conditionals](https://docs.cloud.google.com/sql/docs/postgres/iam-overview#iam-conditions).
- Learn how to [use IAM conditionals with Cloud SQL](https://docs.cloud.google.com/sql/docs/postgres/iam-conditions.md.txt).