Creating and managing tags

This guide describes how to create and manage tags for Service Account resources.

About tags

A tag is a key-value pair that can attach to a resource within Google Cloud. You can use tags to conditionally allow or deny policies based on whether a resource has a specific tag. For example, you can conditionally grant Identity and Access Management (IAM) roles based on whether a resource has a specific tag. For more information about tags, see Tags overview.

Tags are attached to resources by creating a tag binding resource that links the value to the Google Cloud resource.

Required permissions

The permissions you need depend on the action you need to perform.

To gain these permissions, ask your administrator to grant the suggested role at the appropriate level of the resource hierarchy.

View tags

To view tag definitions and tags that are attached to resources, you need the Tag Viewer role (roles/resourcemanager.tagViewer), or another role that includes the following permissions:

To view tags at the organization level you need the Organization Viewer role (roles/resourcemanager.organizationViewer) on the organization resource.

Administer tags

To create, update, and delete tag definitions, you need the Tag Administrator role (roles/resourcemanager.tagAdmin), or another role that includes the following permissions:

To administer tags at the organization level you need the Organization Viewer role (roles/resourcemanager.organizationViewer) on the organization resource.

Manage tags on resources

To add and remove tags that are attached to resources, you need the Tag User role (roles/resourcemanager.tagUser), or another role with equivalent permissions, on both the tag value and the resources that you are attaching the tag value to. The Tag User role includes the following permissions:

To get the permissions that you need to attach tags to service accounts, ask your administrator to grant you the Service Account Admin (roles/iam.ServiceAccountAdmin) IAM role on the service account. For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Create tag keys and values

Before you can attach a tag, you need to create a tag and configure its value. To create tag keys and tag values, see Creating a tag and Adding a tag value.

Attach a tag to a service account

After the tag has been created, you must attach it to a service account.

      gcloud resource-manager tags bindings create \
          --tag-value=TAGVALUE_NAME \
          --parent=RESOURCE_ID
      

List tags attached to a service account

You can view a list of tag bindings directly attached to or inherited by the service account.

      gcloud resource-manager tags bindings list \
          --parent=RESOURCE_ID
      

name: tagBindings/%2F%2Fcloudresourcemanager.googleapis.com%2Fprojects%2F7890123456/tagValues/567890123456
          tagValue: tagValues/567890123456
          resource: //iam.googleapis.com/projects/test-project/serviceAccounts/1029384756
      

Detach tags from a service account

You can detach tags that have been directly attached to a service account. Inherited tags can be overridden by attaching a tag with the same key and a different value, but they can't be detached. Before you can delete a tag, you must detach its key and values from every resource to which it is attached.

      gcloud resource-manager tags bindings delete \
          --tag-value=TAGVALUE_NAME \
          --parent=RESOURCE_ID
      

Delete tag keys and values

When removing a tag key or value definition, ensure that the tag is detached from the service account. You must delete existing tag attachments, called tag bindings, before deleting the tag definition itself. To delete tag keys and tag values, see Deleting tags.

Identity and Access Management conditions and tags

You can use tags and IAM conditions to conditionally grant role bindings to users in your hierarchy. Changing or deleting the tag attached to a resource can remove user access to that resource if an IAM policy with conditional role bindings has been applied. For more information, see Identity and Access Management conditions and tags.

What's next

• See the other services that support tags.
• See Tags and access control to learn how to use tags with IAM.