Resource Management:Tag management best practices

Add compliant tags when you create a resource

1. Create a tag policy to enable pre-event interception of non-compliant tags.

   You can use the pre-event interception feature of tag policies to ensure that compliant tags are added when you create a resource. Otherwise, the resource fails to be created. For more information, see Enable pre-event interception of non-compliant tags.

   For example, you can create a tag policy to define that the CostCenter:Beijing or CostCenter:Shanghai tag must be added when you create Elastic Compute Service (ECS) instances. When you create an ECS instance, if you add a non-compliant tag such as CostCenter:beijing or CostCenter:Shenzhen or add no tags to the instance, the instance fails to be created.

   On the Tag Policy Settings page, set Pre-Event Interception Without Tags to On.

   In the Policy Scenario section, select Add Tags with Specified Tag Values to Resources. Then, enter the tag key and tag values in the Tag Key and Allowed Tag Values fields, respectively.

   In the Policy Enforcement Mode section, select both Post-Event Detection and Pre-Event Interception, and then click Edit Supported Resource Types to add the target resource types.

2. Add a tag when you create a resource.

   • Console

     When you create a resource in the console of an Alibaba Cloud service, add tags to the resource. For more information, see the documentation of the Alibaba Cloud service.

     For example, when you create an ECS instance, you can add a tag to it. You can directly select a predefined tag key and a predefined tag value to add a predefined tag to the instance. For information about how to create an ECS instance, see Create an instance by using the wizard.

     For example, for the tag key CostCenter, you can select Beijing or Shanghai from the drop-down list of tag values.

   • API operation

     When you create a resource by calling the related API operation of an Alibaba Cloud service, you can specify tags by using the related parameters to add tags to the resource. For more information, see the documentation of the Alibaba Cloud service.

     For example, when you call the RunInstances operation to create an ECS instance, you can use the Tag request parameters to specify tags to be added to the instance.

   As a tag policy is configured in the previous step, the ECS instance fails to be created if no tags or non-compliant tags are added to the instance. The following figure shows the error message reported for the failure.

   The console displays an "Order failed" pop-up window with the error message: "The request does not conform to the tag policy."

Enable createdby tags to be automatically added when you create a resource

createdby tags can help you analyze costs and bills and manage the costs of cloud resources in an efficient manner. You can identify the creators of resources based on the createdby tags added to the resources. You can enable createdby tags based on your business requirements. After you enable createdby tags, the system automatically adds createdby tags to newly created resources. The tag key of createdby tags is acs:tag:createdby. The system does not add createdby tags to the resources that are created before you enable createdby tags. For more information, see Overview of createdby tags and Enable createdby tags.

createdby tags are system tags. You cannot manually add them to or remove them from resources. createdby tags are not included in the number of tags that can be added to a resource.

Manually add tags

• Console

  Apply tags to resources in the Tag console, the Resource Center console, or the console of the respective cloud service. The Tag console and Resource Center support applying tags to resources across services and regions in batches. The following steps describe how to use the Tag console. For more information, see Add predefined tags to existing resources.

  On the Tags page of the Tag console, find the target tag key, such as CostCenter, and click Bind Resources next to the corresponding tag value or use the More Actions menu to bind the tag to resources.

• API operation

  Call the TagResource operation provided by the Tag service or a tag-related operation provided by an Alibaba Cloud service to add tags to an existing resource. The TagResource operation allows you to add tags to multiple resources that belong to different services at a time.

Enable automatic tagging

• Tag inheritance of associated resources

  Resource Management provides the tag inheritance feature for associated resources. When you manage the tags of a primary resource or establish relationships between the primary resource and other resources, this feature enables the associated resources of the primary resource to automatically inherit the tag changes that are made to the primary resource. This improves O&M efficiency and reduces tag management costs. For example, when you add a tag to or remove a tag from an ECS instance, the tag is automatically added to or removed from the cloud disks, elastic network interface (ENI), and elastic IP address (EIP) of the ECS instance. When you attach a cloud disk to the ECS instance, bind an ENI to the ECS instance, or associate an EIP with the ECS instance, the cloud disk, ENI, or EIP automatically inherits the tags of the ECS instance. For more information, see Tag inheritance of associated resources.

  On the Tag Inheritance for Associated Resources page, in the Associated Resources Follow Tag Edits section, select the Enable associated resources to follow tag edits. This creates a service-linked role named AliyunServiceRoleForTag. checkbox, and then click Enable and Set Rules.

• Tag policies

  You can create a tag policy and select the desired scenario in the policy to implement automatic detection of non-compliant tags, automatic remediation of non-compliant tags, or automatic tag inheritance from resource groups.

  Policy scenario	Description	References
  Add Tags with Specified Tag Values to Resources	In a tag policy, you can specify tags that must be added to resources. You can also enable features such as automatic detection and remediation for non-compliant tags based on the execution modes you specify for the tag policy. This improves tag management.	Perform automatic tag detection Enable automatic tag remediation
  Match Tag Values with Specified Regular Expression	You can specify a regular expression in a tag policy to limit the format of tag values. Tag values that do not match the regular expression can be automatically remediated.	Use a regular expression to check the compliance of tag values Enable automatic tag remediation
  Automatically Inherit Tags for Resources from Resource Groups	After you add tags to a resource group, you can configure a tag policy to use the automatic tag inheritance feature. This feature allows resources that are added to or created in a resource group to automatically inherit the tags that are added to the resource group. This way, tags can be quickly added to resources in the resource group at a time.	Enable automatic tag inheritance from a resource group

• CloudOps Orchestration Service (OOS)

  You can use a public template provided by OOS to create an execution to add multiple tags to multiple resources at a time. For more information, see Use OOS to add multiple tags to resources at a time and Use OOS to add tags to multiple ECS instances at a time.