Tag inheritance for associated resources - Resource Management

You can use the tag inheritance feature to automatically propagate tags from a primary resource to its associated resources. This process occurs when you modify the tags of the primary resource or create an association, improving O&M efficiency. For example, when you add a tag to an ECS instance, its associated resources, such as disks, elastic network interfaces, and elastic IP addresses, automatically inherit the tag. Newly associated resources also inherit the tag.

Background information

You can manage tag inheritance by using your Alibaba Cloud account or a RAM user that has the AliyunTagAdministratorAccess permissions. For more information, see Create a RAM user and Manage RAM user permissions.

Limits

For a list of resource types that support this feature, see Resources that support tag inheritance.
When configuring a rule to inherit only specific tags, you can specify up to 50 tag keys.
After you enable and configure a tag inheritance rule, if an inherited tag has the same key as an existing tag on an associated resource, the system overwrites the existing tag. For example, an associated resource has the tag cost:hangzhou and the primary resource has the tag cost:shanghai. If you configure a rule that allows the associated resource to inherit the tag with the cost key, the tag cost:hangzhou on the associated resource is overwritten with cost:shanghai.
For some resource types, you can apply tag inheritance to existing associated resources by turning on the Apply to Existing Resources switch. For information about the supported resource types, see the Supports applying to existing resources column in Resources that support tag inheritance.

Operations

Enable tag inheritance

Go to the Tag inheritance page.
Read the instructions, select the checkbox to create a service-linked role, and then click Enable and Configure Rules.

After you enable this feature, a service-linked role named AliyunServiceRoleForTag is created. This role is used to manage tags on associated resources. For more information, see Service-linked role for Tag.

Enable a rule

On the Tag inheritance page, find the target resource type and click Enable Rule in the Actions column.
In the Enable Rule dialog box, configure the rule and click Enable.

Example: After you enable the rule, an elastic network interface automatically inherits the tags of an ECS instance when it is attached to the ECS instance. The tags of the elastic network interface stay in sync with the tags of the ECS instance. When the elastic network interface is detached, the system automatically removes the inherited tags from it.
- Applicable Scope: Specify the tag keys of the tags that you want to inherit. You can inherit all tag keys or only some tag keys.
- Apply to Existing Resources: If you turn on this switch, the rule also applies to existing resources.

Modify a rule

On the Tag inheritance page, find the target resource type and click Modify Rule in the Actions column.
In the Modify Rule dialog box, modify the rule and click Modify.

You can modify the Applicable Scope and enable or disable the Apply to Existing Resources switch.

Disable a rule

Important

After you disable a tag inheritance rule, associated resources no longer automatically inherit tags from their primary resources. This may affect tag-based operations, such as resource management and cost allocation.

On the Tag inheritance page, find the target resource type and click Disable Rule in the Actions column.
In the Disable Rule dialog box, click Disable.

Manage rules in bulk

On the Tag inheritance page, you can select multiple resource types and manage their rules in bulk.

In the lower-left corner of the list, click Enable Rule to enable multiple rules at a time.
In the lower-left corner of the list, click Disable Rule to disable multiple rules at a time.
In the lower-left corner of the list, click Apply to Existing Resources to apply tag inheritance to existing associated resources in bulk.

Disable tag inheritance

Important

After you disable the tag inheritance feature, the system no longer performs tag operations on associated resources. Existing tags on resources are not affected.

In the upper-right corner of the Tag inheritance page, click Disable.
In the confirmation dialog box, click Close.

Resources that support tag inheritance

Primary resource	Associated resource	Triggering condition	Supports existing resources	Rule name (SettingName)
ECS instance	disk (including data disk and system disk)	When attached to an ECS instance, a disk automatically inherits the instance's tags and stays in sync with its tags. When detached from an ECS instance, the system automatically removes the inherited tags from the disk.	Yes	`rule:AttachDisk-DetachDisk-TagInstance:Ecs-Instance:Ecs-Disk`
	elastic network interface (including primary and secondary ENIs)	When attached to an ECS instance, an elastic network interface automatically inherits the instance's tags and stays in sync with its tags. When detached from an ECS instance, the system automatically removes the inherited tags from the elastic network interface.	Yes	`rule:AttachEni-DetachEni-TagInstance:Ecs-Instance:Ecs-Eni`
	elastic IP address	When associated with an ECS instance, an elastic IP address automatically inherits the instance's tags and stays in sync with its tags. When disassociated from an ECS instance, the system automatically removes the inherited tags from the elastic IP address.	Yes	rule:AssociateEip-UnassociateEip-TagInstance:Ecs-Instance:Vpc-Eip
disk	snapshot	When you create a snapshot from a disk, the snapshot automatically inherits the disk's tags. The snapshot's tags stay in sync with the disk's tags.	Yes	`rule:CreateSnapshot-TagDisk:Ecs-Disk:Ecs-Snapshot`
ApsaraMQ for Kafka instance	topic	When you create a topic in an ApsaraMQ for Kafka instance, the topic automatically inherits the instance's tags. The topic's tags stay in sync with the instance's tags.	Yes	`rule:CreateTopic-TagKafka:Kafka-Instance:Kafka-Topic`
ApsaraMQ for Kafka instance	consumer group	When you create a consumer group in an ApsaraMQ for Kafka instance, the consumer group automatically inherits the instance's tags. The consumer group's tags stay in sync with the instance's tags.	Yes	`rule:CreateConsumerGroup-TagKafka:Kafka-Instance:Kafka-ConsumerGroup`
Container Service for Kubernetes (ACK) cluster	security group	The security group's tags stay in sync with the cluster's tags.	No	`rule:TagCluster:Cs-Cluster:Ecs-SecurityGroup`
	ECS instance	When a managed ACK cluster is scaled out, the new ECS instances automatically inherit the cluster's tags. The tags of the ECS instances stay in sync with the cluster's tags.	No	`rule:CreateInstance-TagCluster:Cs-Cluster:Ecs-Instance`
	Classic Load Balancer (CLB) instance	The CLB instance's tags stay in sync with the cluster's tags.	No	`rule:TagCluster:Cs-Cluster:Slb-Instance`
	elastic IP address	The elastic IP address's tags stay in sync with the cluster's tags.	No	`rule:TagCluster:Cs-Cluster:Vpc-Eip`
	NAT gateway	The NAT gateway's tags stay in sync with the cluster's tags.	No	`rule:TagCluster:Cs-Cluster:Vpc-Natgateway`
	scaling group	The scaling group's tags stay in sync with the cluster's tags.	No	`rule:TagCluster:Cs-Cluster:Ess-ScalingGroup`
Classic Load Balancer (CLB) instance	elastic IP address	When associated with a CLB instance, an elastic IP address automatically inherits the instance's tags and stays in sync with its tags. When disassociated from a CLB instance, the system automatically removes the inherited tags from the elastic IP address.	Yes	`rule:AssociateEip-UnassociateEip-TagSlbInstance:Slb-Instance:Vpc-Eip`
Network Load Balancer (NLB) instance	elastic IP address	When associated with an NLB instance during an update, an elastic IP address automatically inherits the instance's tags. The elastic IP address's tags stay in sync with the NLB instance's tags.	No	`rule:UpdateLoadBalancerZones-UpdateLoadBalancerAddressTypeConfig-TagNlb:Nlb-Loadbalancer:Vpc-Eip`
Application Load Balancer (ALB) instance	elastic IP address	When associated with an ALB instance during an update, an elastic IP address automatically inherits the instance's tags. The elastic IP address's tags stay in sync with the ALB instance's tags.	No	`rule:UpdateLoadBalancerZones-UpdateLoadBalancerAddressTypeConfig-TagAlb:Alb-LoadBalancer:Vpc-Eip`
Virtual Private Cloud (VPC) NAT gateway	elastic IP address	When associated with a NAT gateway, an elastic IP address automatically inherits the NAT gateway's tags and stays in sync with its tags. When disassociated from a NAT gateway, the system automatically removes the inherited tags from the elastic IP address.	Yes	`rule:AssociateEipAddress-UnassociateEipAddress-TagVpc:Vpc-Natgateway:Vpc-Eip`
Elastic Container Instance (ECI) container group	elastic IP address	When associated with a container group, an elastic IP address automatically inherits the container group's tags and stays in sync with its tags. When disassociated from a container group, the system automatically removes the inherited tags from the elastic IP address.	No	`rule:AssociateEip-UnassociateEip-TagEci:Eci-ContainerGroup:Vpc-Eip`

Supported regions

China (Beijing), China (Chengdu), China (Fuzhou - Local Region) (Discontinued), China (Guangzhou), China (Hangzhou), China (Heyuan), China (Hohhot), China (Hong Kong), China (Nanjing - Local Region) (Discontinued), China (Qingdao), China (Shanghai), China (Shenzhen), China (Ulanqab), China (Zhangjiakou), Germany (Frankfurt), Indonesia (Jakarta), Japan (Tokyo), Malaysia (Kuala Lumpur), Philippines (Manila), Singapore, Thailand (Bangkok), UK (London), US (Silicon Valley), and US (Virginia).