[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-21。"],[[["\u003cp\u003eTags are key-value pairs that can be attached to Google Cloud resources, enabling conditional policy enforcement and allowing or denying policies based on specific tags.\u003c/p\u003e\n"],["\u003cp\u003eManaging tags involves creating tag keys and values, attaching them to resources through tag bindings, and requiring specific permissions like Tag Viewer, Tag Administrator, or Tag User roles depending on the desired actions.\u003c/p\u003e\n"],["\u003cp\u003eYou can attach tags to service accounts by creating a tag binding resource using the \u003ccode\u003egcloud resource-manager tags bindings create\u003c/code\u003e command, and list or detach these tags using the \u003ccode\u003elist\u003c/code\u003e and \u003ccode\u003edelete\u003c/code\u003e subcommands, respectively.\u003c/p\u003e\n"],["\u003cp\u003eBefore deleting a tag key or value definition, you must detach it from all resources it is attached to, including service accounts.\u003c/p\u003e\n"],["\u003cp\u003eTags can be used with Identity and Access Management (IAM) conditions to conditionally grant role bindings, and modifying or deleting tags can affect user access based on applied conditional IAM policies.\u003c/p\u003e\n"]]],[],null,["# Creating and managing tags\n\n| **Preview**\n|\n|\n| This feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\nThis guide describes how to create and manage tags for Service Account resources.\n\nAbout tags\n----------\n\nA tag is a key-value pair that can attach to a resource within\nGoogle Cloud. You can use tags to conditionally allow or deny policies based on\nwhether a resource has a specific tag. For example, you can conditionally grant\nIdentity and Access Management (IAM) roles based on whether a resource has a specific tag.\nFor more information about tags, see [Tags overview](/resource-manager/docs/tags/tags-overview).\n\nTags are attached to resources by creating a tag binding resource that links the\nvalue to the Google Cloud resource.\n\nRequired permissions\n--------------------\n\nThe permissions you need depend on the action you need to perform.\n\nTo gain these permissions, ask your administrator to grant the suggested role at\nthe appropriate level of the\n[resource hierarchy](/iam/docs/tags-access-control#resource-hierarchy).\n\n### View tags\n\nTo view tag definitions and tags that are attached to resources, you need the\n**Tag Viewer** role (`roles/resourcemanager.tagViewer`), or another role that\nincludes the following permissions: \n\n#### Required permissions\n\n- `resourcemanager.tagKeys.get`\n- `resourcemanager.tagKeys.list`\n- `resourcemanager.tagValues.list`\n- `resourcemanager.tagValues.get`\n- `listTagBindings` for the appropriate resource type. For example, `compute.instances.listTagBindings` for viewing tags attached to Compute Engine instances.\n- `listEffectiveTags`\nfor the appropriate resource type. For example, `compute.instances.listEffectiveTags` for viewing all tags attached to or inherited by Compute Engine instances.\n\nTo view tags at the organization level you need the **Organization Viewer** role\n(`roles/resourcemanager.organizationViewer`) on the organization resource.\n\n### Administer tags\n\nTo create, update, and delete tag definitions, you need the\n**Tag Administrator** role (`roles/resourcemanager.tagAdmin`), or another role\nthat includes the following permissions: \n\n#### Required permissions\n\n- `resourcemanager.tagKeys.create`\n- `resourcemanager.tagKeys.update`\n- `resourcemanager.tagKeys.delete`\n- `resourcemanager.tagKeys.list`\n- `resourcemanager.tagKeys.get`\n- `resourcemanager.tagKeys.getIamPolicy`\n- `resourcemanager.tagKeys.setIamPolicy`\n- `resourcemanager.tagValues.create`\n- `resourcemanager.tagValues.update`\n- `resourcemanager.tagValues.delete`\n- `resourcemanager.tagValues.list`\n- `resourcemanager.tagValues.get`\n- `resourcemanager.tagValues.getIamPolicy`\n- `resourcemanager.tagValues.setIamPolicy`\n\nTo administer tags at the organization level you need the\n**Organization Viewer** role (`roles/resourcemanager.organizationViewer`) on the\norganization resource.\n\n### Manage tags on resources\n\nTo add and remove tags that are attached to resources, you need the **Tag User**\nrole (`roles/resourcemanager.tagUser`), or another role with equivalent\npermissions, on both the *tag value* and the *resources that you are attaching\nthe tag value to* . The **Tag User** role includes the following permissions: \n\n#### Required permissions\n\n- Permissions required for the resource you're attaching the tag value\n - Resource-specific `createTagBinding` permission, such as `compute.instances.createTagBinding` for Compute Engine instances.\n - Resource-specific `deleteTagBinding` permission, such as `compute.instances.deleteTagBinding` for Compute Engine instances.\n- Permissions required for the tag value:\n - `resourcemanager.tagValueBindings.create`\n - `resourcemanager.tagValueBindings.delete`\n- Permissions that let you view projects and tag definitions:\n - `resourcemanager.tagValues.get`\n - `resourcemanager.tagValues.list`\n - `resourcemanager.tagKeys.get`\n - `resourcemanager.tagKeys.list`\n - `resourcemanager.projects.get`\n\n\nTo get the permissions that\nyou need to attach tags to service accounts,\n\nask your administrator to grant you the\n\n\n[Service Account Admin](/iam/docs/roles-permissions/iam#iam.ServiceAccountAdmin) (`roles/iam.ServiceAccountAdmin`)\nIAM role on the service account.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\n\u003cbr /\u003e\n\nCreate tag keys and values\n--------------------------\n\nBefore you can attach a tag, you need to create a tag and configure its value.\nTo create tag keys and tag values, see [Creating a tag](/resource-manager/docs/tags/tags-creating-and-managing#creating_tag) and\n[Adding a tag value](/resource-manager/docs/tags/tags-creating-and-managing#adding_tag_values).\n\nAdd tags to existing resources\n------------------------------\n\nTo add a tag to existing service accounts, follow these steps: \n\n### gcloud\n\nTo attach a tag to a service account, you must create a\ntag binding resource by using the\n`gcloud resource-manager tags bindings create` command: \n\n```\n gcloud resource-manager tags bindings create \\\n --tag-value=TAGVALUE_NAME \\\n --parent=RESOURCE_ID\n \n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eTAGVALUE_NAME\u003c/var\u003e: the permanent ID or namespaced name of the tag value that is attached---for example, `tagValues/567890123456`.\n- \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e: the unique id or email of the service account including the API domain name (`//iam.googleapis.com/`). For example, the full ID of a service account with unique id `1029384756` in project `test-project` is `//iam.googleapis.com/projects/test-project/serviceAccounts/1029384756`.\n\nList tags attached to resources\n-------------------------------\n\nYou can view a list of tag bindings directly attached to or inherited by the\nservice account. \n\n### gcloud\n\nTo get a list of tag bindings attached to a resource, use the\n`gcloud resource-manager tags bindings list` command: \n\n```\n gcloud resource-manager tags bindings list \\\n --parent=RESOURCE_ID\n \n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e: the unique id or email of the service account including the API domain name (`//iam.googleapis.com/`). For example, the full ID of a service account with unique id `1029384756` in project `test-project` is `//iam.googleapis.com/projects/test-project/serviceAccounts/1029384756`.\n\nYou should get a response similar to the following: \n\n```\nname: tagBindings/%2F%2Fcloudresourcemanager.googleapis.com%2Fprojects%2F7890123456/tagValues/567890123456\n tagValue: tagValues/567890123456\n resource: //iam.googleapis.com/projects/test-project/serviceAccounts/1029384756\n \n```\n\nDetach tags from resources\n--------------------------\n\nYou can detach tags that have been directly attached to\na service account. Inherited tags can be overridden by attaching\na tag with the same key and a different value, but they can't be detached. \n\n### gcloud\n\nTo delete a tag binding, use the\n`gcloud resource-manager tags bindings delete` command: \n\n```\n gcloud resource-manager tags bindings delete \\\n --tag-value=TAGVALUE_NAME \\\n --parent=RESOURCE_ID\n \n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eTAGVALUE_NAME\u003c/var\u003e: the permanent ID or namespaced name of the tag value that is attached---for example, `tagValues/567890123456`.\n- \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e: the unique id or email of the service account including the API domain name (`//iam.googleapis.com/`). For example, the full ID of a service account with unique id `1029384756` in project `test-project` is `//iam.googleapis.com/projects/test-project/serviceAccounts/1029384756`.\n\nDelete tag keys and values\n--------------------------\n\nWhen removing a tag key or value definition, ensure that the tag is detached from the\nservice account. You must delete existing tag attachments, called tag\nbindings, before deleting the tag definition itself. To delete tag keys and tag\nvalues, see [Deleting tags](/resource-manager/docs/tags/tags-creating-and-managing#deleting).\n\nIdentity and Access Management conditions and tags\n--------------------------------------------------\n\nYou can use tags and IAM conditions to conditionally\ngrant role bindings to users in your hierarchy. Changing or deleting the tag\nattached to a resource can remove user access to that resource if an\nIAM policy with conditional role bindings has been applied. For\nmore information, see [Identity and Access Management conditions and tags](/resource-manager/docs/tags/tags-creating-and-managing#iam_conditions_and_tags).\n\nWhat's next\n-----------\n\n- See the other [services that support tags](/resource-manager/docs/tags/tags-supported-services).\n- See [Tags and access control](/iam/docs/tags-access-control) to learn how to use tags with IAM."]]
