Tag policy best practices for a single account - Resource Management

Use a tag policy in single-account mode to standardize tagging operations across your Alibaba Cloud account.

Background information

As cloud adoption deepens, enterprises face growing resource management complexity, especially when resources are shared across subsidiaries and departments. Tag-based resource management helps you classify resources by purpose, scenario, and ownership, laying the foundation for unified production and sharing. The prerequisite for effective resource classification is standardized tagging. A tag policy lets you define the tags that must be added to resources.

Important

We recommend that you first attach the tag policy to an account with a small number of resources for testing. After the test succeeds, attach the tag policy to a production account.

Use the Tag Policy feature for the first time

Step	Operation	Result	References
Step 1: Enable the Tag Policy feature	Log on to the Resource Management console. In the left-side navigation pane, choose Tag Policy > Policy Library. On the Policy Library page, enable the Tag Policy feature in single-account mode.	The Tag Policy feature in single-account mode is enabled.	Use an Alibaba Cloud account to enable the Tag Policy feature in single-account mode
Step 2: Create a tag policy	On the Policy Library page, create a tag policy. Specify the tag key, tag value, and resource type to check. Do not enable Automatic Remediation. You can edit the policy in Quick Mode or JSON mode. We recommend Quick Mode for first-time users.	The tag policy, such as p-xxxx, is created.	Create a tag policy in single-account mode
Step 3: Attach the tag policy to an account	On the Policy Library page, attach the tag policy to the current Alibaba Cloud account to check for tag compliance.	The tag policy status shows In Use.	Attach a tag policy
Step 4: View the effective policy	On the Effective Policies page, view the effective policy for the current account. Click a tag key to view details.	The tag policy is effective for the account as expected.	View an effective policy
Step 5: View the detection results	On the effective policy details page, view non-compliant resources within the account, including resource count, percentage, and resource list. You can also click Generate Latest Report to generate and download a report of non-compliant resources.	The detection results are available for you to verify against your business requirements.	View and download non-compliance detection results
Step 6: Manually remediate non-compliant tags	Log on to the consoles of the Alibaba Cloud services that own the non-compliant resources, attach the required tags as defined in the tag policy, and then view the detection results again.	All resources within the account have compliant tags.	None

Use the advanced features of a tag policy

Beyond automatic detection, tag policies also support automatic remediation, pre-event interception of non-compliant tags, and automatic tag inheritance from resource groups. For supported services and resource types, see Services that support tag policies.

The following table describes the available advanced features.

Advanced feature	Operation	Result	References
Automatic tag remediation	When you create or modify a tag policy, select Automatic Remediation.	The system remediates non-compliant tags.	Enable automatic tag remediation
Pre-event interception	When you create or modify a tag policy, select the Pre-event Interception method. Pre-event interception is a pre-event method that is used to ensure tag compliance. You can use this feature in one of the following scenarios: Intercept non-compliant tags when you create a resource. Default feature: When you create a resource and add a tag whose key is defined in a tag policy but whose value is not, the system blocks the resource creation. Strong verification feature: When you create a resource without adding the tags defined in a tag policy, the system blocks the resource creation. Intercept non-compliant tags when you add tags to a resource.	When you create a resource or add tags to an existing resource, the system checks tag compliance. If the required tags are missing, the operation fails.	Enable pre-event interception of non-compliant tags
Automatic tag inheritance from a resource group	When you create or modify a tag policy, select the Automatically Inherit Tags for Resources from Resource Groups policy scenario.	After you create a resource in a specified resource group or add a resource to the group, the resource automatically inherits the tags of the resource group.	Enable automatic tag inheritance from a resource group