Resource Management:Best practices for tag management

Add compliant tags when you create a resource

1. Create a tag policy to enable pre-event interception of non-compliant tags.

   You can use the pre-event interception feature of tag policies to ensure that compliant tags are added when you create a resource. Otherwise, the resource fails to be created. For more information, see Enable pre-event interception of non-compliant tags.

   For example, you can create a tag policy to define that the CostCenter:Beijing or CostCenter:Shanghai tag must be added when you create Elastic Compute Service (ECS) instances. When you create an ECS instance, if you add a non-compliant tag such as CostCenter:beijing or CostCenter:Shenzhen or add no tags to the instance, the instance fails to be created.

   

   

   

2. Add a tag when you create a resource.

   • Console

     When you create a resource in the console of an Alibaba Cloud service, add tags to the resource. For more information, see the documentation of the Alibaba Cloud service.

     For example, when you create an ECS instance, you can add a tag to it. You can directly select a predefined tag key and a predefined tag value to add a predefined tag to the instance. For information about how to create an ECS instance, see Create an instance by using the wizard.

     

   • API operation

     When you create a resource by calling the related API operation of an Alibaba Cloud service, you can specify tags by using the related parameters to add tags to the resource. For more information, see the documentation of the Alibaba Cloud service.

     For example, when you call the RunInstances operation to create an ECS instance, you can use the Tag request parameters to specify tags to be added to the instance.

   As a tag policy is configured in the previous step, the ECS instance fails to be created if no tags or non-compliant tags are added to the instance. The following figure shows the error message reported for the failure.

   

Enable createdby tags to be automatically added when you create a resource

createdby tags can help you analyze costs and bills and manage the costs of cloud resources in an efficient manner. You can identify the creators of resources based on the createdby tags added to the resources. You can enable createdby tags based on your business requirements. After you enable createdby tags, the system automatically adds createdby tags to newly created resources. The tag key of createdby tags is acs:tag:createdby. The system does not add createdby tags to the resources that are created before you enable createdby tags. For more information, see Overview of createdby tags and Enable createdby tags.

createdby tags are system tags. You cannot manually add them to or remove them from resources. createdby tags are not included in the number of tags that can be added to a resource.

Manually add tags

• Console

  Add tags to an existing resource on the Tag or Resource Search page of the Resource Management console, or in the console of the Alibaba Cloud service to which the resource belongs. You can add tags to multiple resources that belong to different services or reside in different regions at a time on the Tag or Resource Search page of the Resource Management console. The following figure shows how to add tags to existing resources on the Tag page of the Resource Management console. For more information, see Add a predefined tag to existing resources.

  

• API operation

  Call the TagResource operation provided by the Tag service or a tag-related operation provided by an Alibaba Cloud service to add tags to an existing resource. The TagResource operation allows you to add tags to multiple resources that belong to different services at a time.

Enable automatic tagging

• Tag inheritance of associated resources

  Resource Management provides the tag inheritance feature for associated resources. When you manage the tags of a primary resource or establish relationships between the primary resource and other resources, this feature enables the associated resources of the primary resource to automatically inherit the tag changes that are made to the primary resource. This improves O&M efficiency and reduces tag management costs. For example, when you add a tag to or remove a tag from an ECS instance, the tag is automatically added to or removed from the cloud disks, elastic network interface (ENI), and elastic IP address (EIP) of the ECS instance. When you attach a cloud disk to the ECS instance, bind an ENI to the ECS instance, or associate an EIP with the ECS instance, the cloud disk, ENI, or EIP automatically inherits the tags of the ECS instance. For more information, see Tag inheritance of associated resources.

  

• Tag policies

  You can create a tag policy and select the desired scenario in the policy to implement automatic detection of non-compliant tags, automatic remediation of non-compliant tags, or automatic tag inheritance from resource groups.

  

  Policy scenario	Description	References
  Add Tags with Specified Tag Values to Resources	In a tag policy, you can specify tags that must be added to resources. You can also enable features such as automatic detection and remediation for non-compliant tags based on the execution modes you specify for the tag policy. This improves tag management.	Perform automatic tag detection Enable automatic tag remediation
  Match Tag Values with Specified Regular Expression	You can specify a regular expression in a tag policy to limit the format of tag values. Tag values that do not match the regular expression can be automatically remediated.	Use a regular expression to check the compliance of tag values Enable automatic tag remediation
  Automatically Inherit Tags for Resources from Resource Groups	After you add tags to a resource group, you can configure a tag policy to use the automatic tag inheritance feature. This feature allows resources that are added to or created in a resource group to automatically inherit the tags that are added to the resource group. This way, tags can be quickly added to resources in the resource group at a time.	Enable automatic tag inheritance from a resource group

• CloudOps Orchestration Service (OOS)

  You can use a public template provided by OOS to create an execution to add multiple tags to multiple resources at a time. For more information, see Use OOS to add multiple tags to resources at a time and Use OOS to add tags to multiple ECS instances at a time.