Enable Tag Policy | Resource Management - Resource Management

Enable Tag Policy to enforce consistent tagging rules across your Alibaba Cloud account or resource directory.

Background information

Tag Policy modes

Tag Policy supports single-account mode and resource directory mode. Choose a mode based on your scenario and account type.

Scenario	Type of the logon account	Mode of the Tag Policy feature	References
You manage cloud resources with a single Alibaba Cloud account and its RAM users. Enable Tag Policy in single-account mode to govern tag operations for the account and its RAM users.	Alibaba Cloud account that is not the management account or a member of a resource directory	Single-account mode: Governs tag operations for one Alibaba Cloud account and its RAM users.	Enable single-account mode with an Alibaba Cloud account
You use a resource directory to manage all your accounts. Use the management account to enable Tag Policy in resource directory mode and govern tag operations across all members.	Management account of a resource directory	You can enable one or both modes based on your requirements. Resource directory mode: Governs tag operations for all members in the resource directory. Important If any member has enabled Tag Policy in single-account mode, the management account cannot enable resource directory mode. Disable single-account mode on that member first. Single-account mode: Governs tag operations for the management account only.	Enable resource directory mode with the management account
	Member of a resource directory	The behavior depends on whether Tag Policy is enabled for the resource directory: If Tag Policy is not enabled for the resource directory, the member can enable single-account mode to govern its own tag operations. If Tag Policy is enabled for the resource directory, the member cannot enable single-account mode. Tag policies are managed centrally by the management account. The member can only view its effective policy.	Enable single-account mode with a directory member

RAM permissions

We recommend using a RAM user to enable Tag Policy.

Single-account mode: Attach the following custom policy to a RAM user in your Alibaba Cloud account.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
              "tag:GetConfigRuleReport",
              "tag:GenerateConfigRuleReport",
              "tag:GetEffectivePolicy",
              "tag:ListConfigRulesForTarget",
              "tag:ListPoliciesForTarget",
              "tag:ListTargetsForPolicy",
              "tag:ListPolicies",
              "tag:GetPolicy",
              "tag:GetPolicyEnableStatus",
              "tag:DetachPolicy",
              "tag:DeletePolicy",
              "tag:ModifyPolicy",
              "tag:AttachPolicy",
              "tag:CreatePolicy",
              "tag:DisablePolicyType",
              "tag:EnablePolicyType",
              "tag:ListSupportResourceTypes"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "rd:ListAccountsForParent",
                "rd:ListFoldersForParent",
                "rd:GetResourceDirectory",
                "config:GetAggregateResourceComplianceByConfigRule",
                "config:ListAggregateConfigRuleEvaluationResults",
                "config:GetAggregateConfigRulesReport",
                "config:GetResourceComplianceGroupByRegion",
                "config:ListConfigRuleEvaluationResults",
                "config:GetConfigRulesReport",
                "config:ListRemediations",
                "oos:ListExecutions"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "ram:CreateServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
              "StringEquals": {
                "ram:ServiceName": "tag.aliyuncs.com"
               }
            }
        }
    ]
}

Resource directory mode: Attach the AliyunResourceDirectoryFullAccess policy and the preceding custom policy to a RAM user in the management account of your resource directory.

Create a custom policy and Grant permissions to the RAM user.

Enable single-account mode with an Alibaba Cloud account

Use an Alibaba Cloud account that is not the management account or a member of a resource directory.

Log on to the Resource Management console.
In the left-side navigation pane, choose Tag Policy > Settings.
On the Settings for Current Account tab, set Tag Policy to Enable.
In the Enable Tag Policy dialog box, click Enable.

Enabling Tag Policy creates the service-linked role AliyunServiceRoleForTag for cross-service access.

Enable resource directory mode with the management account

Use the management account of a resource directory. This mode takes effect on all members but not on the management account itself.

Log on to the Resource Management console.
In the left-side navigation pane, choose Tag Policy > Settings.
On the Settings for Resource Directory tab, set Tag Policy to Enable.

Note
The management account can also enable a tag policy for itself on the Settings for Current Account tab.
In the Enable Tag Policy dialog box, click Enable.

Enabling Tag Policy creates the service-linked role AliyunServiceRoleForTag for cross-service access.

Enable single-account mode with a directory member

If Tag Policy is not enabled for the resource directory, a member can enable single-account mode. This mode takes effect only on that member.

Use a member of a resource directory to log on to the Alibaba Cloud Management Console.

Use a member to log on to the Alibaba Cloud Management Console.
Log on to the Resource Management console.
In the left-side navigation pane, choose Tag Policy > Settings.
On the Settings for Current Account tab, set Tag Policy to Enable.
In the Enable Tag Policy dialog box, click Enable.

Enabling Tag Policy creates the service-linked role AliyunServiceRoleForTag for cross-service access.