Best practices for tag policies in a resource directory - Resource Management

This topic describes the best practices for using tag policies to standardize tagging for members in your resource directory.

Background

If your organization has complex services on the cloud and uses a resource directory (RD) for multi-account management, you can use the management account of the RD to enable tag policies. These policies standardize tagging for all members in your resource directory.

Important

When you first use tag policies, apply a policy to a member with few resources. After testing, you can attach the policy to more members, specific folders, or the Root folder.

First-time use of a tag policy

Basic task	Actions	Result	References
Step 1: Enable the tag policy feature.	Log on to the Tag console with the management account or a delegated administrator account of your resource directory to enable the tag policy feature.	The tag policy feature is enabled.	Enable the tag policy feature by using the management account of a resource directory
Step 2: Create a tag policy.	On the Policy Library page, create a tag policy. Specify the tag keys, tag values, and resource types to check. Do not enable Automatic Remediation. The policy editor supports Quick Mode and JSON mode. If this is your first time, we recommend using Quick Mode.	The tag policy (for example, p-xxxx) is created.	Create a tag policy
Step 3: Attach the tag policy to a single member.	On the Policy Library page, attach the tag policy to a single member to check its tag compliance. You can attach a tag policy to the Root folder, a specific folder, or a member in your resource directory. For your first time, we recommend attaching it only to a single member.	The tag policy is attached to the member.	Attach a tag policy
Step 4: View the effective policy.	On the Effective Policies page, view the final effective policy for the member. You can click a tag key to view details.	The expected effective policy is applied to the member in the resource directory.	View an effective policy
Step 5: View the detection results.	On the effective policy details page, view the number, percentage, and list of non-compliant resources for the member. You can also generate and download a report of non-compliant resources.	Confirm that the detection results are as expected.	View and download the detection results for non-compliant resources
Step 6: Manually remediate non-compliant tags.	Log on to the console of the service that owns the non-compliant resource, manually correct the resource's non-compliant tags, and then view the detection results again.	All resources are now compliant.	None
Step 7: Attach the tag policy to multiple members or folders.	After the test is successful, you can expand the scope of the tag policy by attaching it to multiple members, specific folders, or the Root folder to enforce tag compliance across your entire resource directory.	View the tag compliance detection results for the entire resource directory.	Attach a tag policy

Use the advanced features of a tag policy

Beyond automatic detection, tag policies also support automatic remediation, pre-event interception of non-compliant tags, and automatic tag inheritance from resource groups. For supported services and resource types, see Services that support tag policies.

The following table describes the available advanced features.

Advanced feature	Operation	Result	References
Automatic tag remediation	When you create or modify a tag policy, select Automatic Remediation.	The system remediates non-compliant tags.	Enable automatic tag remediation
Pre-event interception	When you create or modify a tag policy, select the Pre-event Interception method. Pre-event interception is a pre-event method that is used to ensure tag compliance. You can use this feature in one of the following scenarios: Intercept non-compliant tags when you create a resource. Default feature: When you create a resource and add a tag whose key is defined in a tag policy but whose value is not, the system blocks the resource creation. Strong verification feature: When you create a resource without adding the tags defined in a tag policy, the system blocks the resource creation. Intercept non-compliant tags when you add tags to a resource.	When you create a resource or add tags to an existing resource, the system checks tag compliance. If the required tags are missing, the operation fails.	Enable pre-event interception of non-compliant tags
Automatic tag inheritance from a resource group	When you create or modify a tag policy, select the Automatically Inherit Tags for Resources from Resource Groups policy scenario.	After you create a resource in a specified resource group or add a resource to the group, the resource automatically inherits the tags of the resource group.	Enable automatic tag inheritance from a resource group