This guide describes how to create and manage tags for Service Account resources.
About tags
A tag is a key-value pair that can attach to a resource within Google Cloud. You can use tags to conditionally allow or deny policies based on whether a resource has a specific tag. For example, you can conditionally grant Identity and Access Management (IAM) roles based on whether a resource has a specific tag. For more information about tags, see Tags overview.
Tags are attached to resources by creating a tag binding resource that links the value to the Google Cloud resource.
Required permissions
To get the permissions that you need to manage tags, ask your administrator to grant you the following IAM roles on the service account:
-
Tag Viewer (
roles/resourcemanager.tagViewer
) - the resources the tags are attached to -
View and manage tags at the organization level:
Organization Viewer (
roles/resourcemanager.organizationViewer
) - the organization -
Create, update, and delete tag definitions:
Tag Administrator (
roles/resourcemanager.tagAdmin
) - the resource you're creating, updating, or deleting tags for -
Attach and remove tags from resources:
Tag User (
roles/resourcemanager.tagUser
) - the tag value and the resources that you are attaching or removing the tag value to
For more information about granting roles, see Manage access to projects, folders, and organizations.
You might also be able to get the required permissions through custom roles or other predefined roles.
To get the permissions that
you need to attach tags to service accounts,
ask your administrator to grant you the
Service Account Admin (roles/iam.ServiceAccountAdmin
)
IAM role on the service account.
For more information about granting roles, see Manage access to projects, folders, and organizations.
You might also be able to get the required permissions through custom roles or other predefined roles.
Create tag keys and values
Before you can attach a tag, you need to create a tag and configure its value. To create tag keys and tag values, see Creating a tag and Adding a tag value.
Add tags to existing resources
To add a tag to existing service accounts, follow these steps:
gcloud
To attach a tag to a service account, you must create a
tag binding resource by using the
gcloud resource-manager tags bindings create
command:
gcloud resource-manager tags bindings create \ --tag-value=TAGVALUE_NAME \ --parent=RESOURCE_ID
Replace the following:
TAGVALUE_NAME
: the permanent ID or namespaced name of the tag value that is attached—for example,tagValues/567890123456
.-
RESOURCE_ID
: the unique id or email of the service account including the API domain name (//iam.googleapis.com/
). For example, the full ID of a service account with unique id1029384756
in projecttest-project
is//iam.googleapis.com/projects/test-project/serviceAccounts/1029384756
.
List tags attached to resources
You can view a list of tag bindings directly attached to or inherited by the service account.
gcloud
To get a list of tag bindings attached to a resource, use the
gcloud resource-manager tags bindings list
command:
gcloud resource-manager tags bindings list \ --parent=RESOURCE_ID
Replace the following:
-
RESOURCE_ID
: the unique id or email of the service account including the API domain name (//iam.googleapis.com/
). For example, the full ID of a service account with unique id1029384756
in projecttest-project
is//iam.googleapis.com/projects/test-project/serviceAccounts/1029384756
.
You should get a response similar to the following:
name: tagBindings/%2F%2Fcloudresourcemanager.googleapis.com%2Fprojects%2F7890123456/tagValues/567890123456 tagValue: tagValues/567890123456 resource: //iam.googleapis.com/projects/test-project/serviceAccounts/1029384756
Detach tags from resources
You can detach tags that have been directly attached to a service account. Inherited tags can be overridden by attaching a tag with the same key and a different value, but they can't be detached.
gcloud
To delete a tag binding, use the
gcloud resource-manager tags bindings delete
command:
gcloud resource-manager tags bindings delete \ --tag-value=TAGVALUE_NAME \ --parent=RESOURCE_ID
Replace the following:
TAGVALUE_NAME
: the permanent ID or namespaced name of the tag value that is attached—for example,tagValues/567890123456
.-
RESOURCE_ID
: the unique id or email of the service account including the API domain name (//iam.googleapis.com/
). For example, the full ID of a service account with unique id1029384756
in projecttest-project
is//iam.googleapis.com/projects/test-project/serviceAccounts/1029384756
.
Delete tag keys and values
When removing a tag key or value definition, ensure that the tag is detached from the service account. You must delete existing tag attachments, called tag bindings, before deleting the tag definition itself. To delete tag keys and tag values, see Deleting tags.
Identity and Access Management conditions and tags
You can use tags and IAM conditions to conditionally grant role bindings to users in your hierarchy. Changing or deleting the tag attached to a resource can remove user access to that resource if an IAM policy with conditional role bindings has been applied. For more information, see Identity and Access Management conditions and tags.
What's next
- See the other services that support tags.
- See Tags and access control to learn how to use tags with IAM.