Tags let you group Function Compute resources by purpose, making functions easier to search, filter, and manage at scale. Tags also support attribute-based access control (ABAC)—grant different RAM roles access to different groups of functions based on tag conditions.
Key concepts
Each tag is a key-value pair attached to a function resource.
Tags and functions have a many-to-many relationship: one tag can apply to multiple functions, and one function can carry multiple tags.
Tag inheritance: Versions, aliases, and triggers associated with a function inherit the function's tags. Tag-based authentication applies to any API call that specifies a function, and all versions and aliases of a function share the same tags. Modifying a tag affects authentication for every version and alias of that function.
Tags are region-specific. A tag created in one region is not visible in other regions.
Limits
| Item | Limit |
|---|---|
| Maximum tags per resource | 20 |
| Tag key length | Up to 64 Unicode characters |
| Tag value length | Up to 128 Unicode characters |
| Case sensitivity | Tag keys and values are case-sensitive |
Allowed characters for tag keys and values:
ASCII characters, digits, Chinese characters, and the following special characters: -\.!@#$%?/^&*)(+={}[\\]",'<>~·\`:;|_
Restrictions:
Tag keys and values cannot contain Chinese punctuation marks,
http://, orhttps://.Tag keys cannot start with
aliyunoracs:, and cannot be empty strings.Tag values can be empty strings.
Attach tags to a function
Log on to the Function Compute console. In the left-side navigation pane, click Functions.
In the top menu bar, select a region. On the Function List page, find the target function.
In the Tag column for the target function, hover over the
icon and click Attach in the tooltip. In the Edit Tag dialog box, enter a Tag Key and Tag Value, then click Confirm.
After the tag is added, hover over the 
icon in the Tags column to view the tag. To update or delete tags, follow the on-screen instructions in the console.
If the target function was created in the Function Compute 2.0 console and its name contains a $ symbol, you cannot attach tags to it in the 3.0 console. Follow the on-screen instructions and click the hyperlink to go to the service in the 2.0 console to attach tags.
Use cases
Multi-team function management
An enterprise uses an Alibaba Cloud account to run functions across multiple business units. Tags make it possible to group functions by business unit and assign each group to a dedicated team—so each team can view and manage only their functions. For a step-by-step setup, see Grant different permissions to RAM roles for function groups.