Use regular expressions in a tag policy to ensure tag value compliance - Resource Management

You can define regular expressions in tag policies to enforce tag value formats and automatically remediate non-compliant values.

Prerequisites

The tag policy feature is enabled. For more information, see Enable the tag policy feature.

Background

Regular expressions are available for all Alibaba Cloud services that support automatic tag detection and remediation. For a complete list, see the Support for automatic tag detection and automatic tag remediation column in Alibaba Cloud services that support tag policies.

Procedure

You can use regular expressions with tag policies for both the current account and a resource directory. The following example creates a current-account tag policy that requires all resources to have a tag with the key staffNumber whose value contains only digits.

Log on to the Resource Management console.
Create a tag policy.
1. In the left-side navigation pane, choose Tag Policy > Policy Library.
2. On the Policy Library page, click Create Tag Policy.
3. Enter a policy name.
4. Enter a policy description.
5. Use the Quick Mode tab to configure the policy.
  1. Select Match Tag Values with Specified Regular Expression for the Policy Scenario.
  2. In the Tag Key field, enter staffNumber.
  3. In the Specify Allowed Tag Values field, enter the regular expression.
    
    For this example, enter ^[0-9]+$. This expression requires the tag value to contain only digits.
  4. In the Policy Execution Mode section, Post-event Detection is selected by default. You can also configure other settings, such as the resource type, resource group, region, tag, and a regular expression for resource names. You can also enable Automatic Remediation.
    
    For this example, leave the default settings unchanged.
6. Click Create.
Attach the tag policy.

Attach the tag policy that you created in Step 2 to the current account. Once attached, the policy applies to the account and all its RAM users. For more information, see Attach a tag policy.
View the effective policy.

An effective policy aggregates all tag policies attached to the current account. For more information, see View an effective policy.
After the detection task is complete, view the results.

The system automatically detects resources that are missing the staffNumber tag key or whose tag value does not match the regular expression. For example, a resource with the tag staffNumber:alice is flagged as non-compliant.

You can view or download the detection results for non-compliant resources. For details, see View and download non-compliance detection results.

Next steps

You can remediate non-compliant tags manually or enable automatic remediation in the tag policy. For more information, see Use a tag policy for automatic remediation.