Resource Management:Create a tag policy

Procedure

1. Log on to the Resource Management console.

2. In the left navigation pane, choose Tag Policy > Policy Library.

3. On the Policy Library page, click the Resource Directory or Current Account tab.

   Note

   If Tag Policy in resource directory mode is disabled, skip this step.

4. Click Create Tag Policy.

5. In the Basic Information section, enter a policy name and description.

6. In the Details section, configure the policy using one of the following methods.

   • Quick Mode (Recommended)

     Select a policy scenario and configure rules.

     • Add Tags with Specified Tag Values to Resources

       Specify required tags for resources. Enable automatic detection, automatic remediation, and pre-event interception for non-compliant tags.

       Parameter	Description
       Tag Key	Enter a tag key.
       Specify Allowed Tag Values	Allowed tag values for the tag key. Specify one or more values, or use an asterisk (*) as a wildcard for any value.
       Policy Execution Mode	Post-event Detection Post-event detection is the default execution mode. Enable detection rules as needed and view results on the effective policy details page. Specify Resource Types for Detection: All supported resource types are detected by default. Specify resource types to narrow the scope. Resource Groups: All resource groups are detected by default. Specify resource groups to narrow the scope. Maximum: 20. Note The Resource Groups parameter is not supported for tag policies for a Resource Directory. Regions: All regions are detected by default. Specify regions to narrow the scope. Maximum: 20. Specify Tag Scope: Specify tags to narrow the detection scope. Only resources matching all specified tags (AND logic) are detected. Maximum: 20 tags. Specify Regular Expression of Resource Names: Specify a regular expression to detect only resources with matching names. For example, abc-.* detects resources whose names start with abc-. Automatic Remediation: Automatically remediate tags on non-compliant resources. Specify a unique remediation scope for each tag value. Pre-event Interception When you create a resource or add tags, the system checks compliance with the tag policy. Non-compliant operations are blocked. Enable pre-event interception of non-compliant tags.

     • Match Tag Values with Specified Regular Expression

       Specify a regular expression to enforce tag value formats. Non-matching values can be automatically remediated.

       Parameter	Description
       Tag Key	Enter a tag key.
       Specify Allowed Tag Values	Enter a regular expression to enforce the format of tag values.
       Policy Execution Mode	Post-event Detection is the default execution mode. Enable detection rules and view results on the effective policy details page. Specify Resource Types for Detection: All supported resource types are detected by default. Specify resource types to narrow the scope. Resource Groups: All resource groups are detected by default. Specify resource groups to narrow the scope. Maximum: 20. Note The Resource Groups parameter is not supported for tag policies for a Resource Directory. Regions: All regions are detected by default. Specify regions to narrow the scope. Maximum: 20. Specify Tag Scope: Specify tags to narrow the detection scope. Only resources matching all specified tags (AND logic) are detected. Maximum: 20 tags. Specify Regular Expression of Resource Names: Specify a regular expression to detect only resources with matching names. For example, abc-.* detects resources whose names start with abc-. Automatic Remediation: Automatically remediate tags on non-compliant resources. Specify a unique remediation scope for each tag value.

     • Automatically Inherit Tags for Resources from Resource Groups

       Configure automatic tag inheritance so that resources added to or created in a resource group inherit the resource group's tags.

       Parameter	Description
       Tag Key	Enter a tag key. In single-account mode, click View Resource Groups with the Tag Key to view resource groups that use this tag key.
       Specify Resource Types for Detection	All supported resource types are detected by default. Specify resource types to narrow the detection scope.
       Resource Groups	All resource groups are detected by default. Specify resource groups to narrow the scope. Maximum: 20. Note The Resource Groups parameter is not supported for tag policies for a Resource Directory.
       Specify IDs of Resources to Be Excluded	Specify resource IDs to exclude from tag inheritance. Maximum: 20.
       Regions	All regions are detected by default. Specify regions to narrow the scope. Maximum: 20.
       Specify Tag Scope	Specify tags to narrow the detection scope. Only resources matching all specified tags (AND logic) are detected. Maximum: 20 tags.

     Click Add Policy Scenario and Tag Key to add rules for multiple policy scenarios and tag keys.

   • JSON

     Specify policy details in JSON format for advanced configurations. You must understand the Syntax of a tag policy before using this mode.

7. Click Create.

References

• Perform automatic tag detection

• Enable automatic tag remediation

• Enable pre-event interception of non-compliant tags

• Enable automatic tag inheritance from a resource group

• Use a regular expression to check the compliance of tag values

• Use tag policies to implement automatic tagging based on resource names