Creating and managing tags

Console

To create a tag key, do the following:

1. Open the Tags page in the Google Cloud console.

   Open Tags page

2. From the Scope picker at the top of the page, select the organization or project under which you want to create a tag key.

3. Click add Create.

4. In the Tag key box, enter the display name of your tag key. This becomes part of the namespaced name of your tag.

5. In the Tag key description box, enter a description of your tag key.

6. If you want to add tag values to this key, click add Add value for each tag value you want to create.

7. In the Tag value box, enter the display name of your tag value. This becomes part of the namespaced name of your tag.

8. In the Tag value description box, enter a description of your tag value.

9. When you have finished adding tag values, click Create tag key.

gcloud

To create a tag key, use the gcloud resource-manager tags keys create command:

gcloud resource-manager tags keys create SHORT_NAME \
    --parent=RESOURCE_ID

Where:

• SHORT_NAME is the display name for your tag key; for example: environment.

• RESOURCE_ID is the ID of the parent organization or project resource for this tag key; for example: organizations/123456789012, projects/test-project123, or projects/234567890123. To learn how to get your organization ID, see Creating and managing organizations. To learn how to get your project ID, see Creating and managing projects.

You should get a response similar to the following:

Creating tag key environment in organization 1234567890...
<blocking wait until creation completes>
name: tagKeys/123456789012
short_name: environment
namespaced_name: 123456789012/environment
parent: organizations/123456789012

Terraform

Use the google_tags_tag_key resource.

Before you create tag keys using Terraform, enable the Cloud Resource Manager API.

The following example creates tag keys named env and department:

data "google_project" "default" {}

resource "google_tags_tag_key" "env_tag_key" {
  parent     = "projects/${data.google_project.default.project_id}"
  short_name = "env"
}

resource "google_tags_tag_key" "department_tag_key" {
  parent     = "projects/${data.google_project.default.project_id}"
  short_name = "department"
}

To apply your Terraform configuration in a Google Cloud project, complete the steps in the following sections.

Prepare Cloud Shell

1. Launch Cloud Shell.

2. Set the default Google Cloud project where you want to apply your Terraform configurations.

   You only need to run this command once per project, and you can run it in any directory.

   export GOOGLE_CLOUD_PROJECT=PROJECT_ID

   Environment variables are overridden if you set explicit values in the Terraform configuration file.

Prepare the directory

Each Terraform configuration file must have its own directory (also called a root module).

1. In Cloud Shell, create a directory and a new file within that directory. The filename must have the .tf extension—for example main.tf. In this tutorial, the file is referred to as main.tf.

   mkdir DIRECTORY && cd DIRECTORY && touch main.tf

2. If you are following a tutorial, you can copy the sample code in each section or step.

   Copy the sample code into the newly created main.tf.

   Optionally, copy the code from GitHub. This is recommended when the Terraform snippet is part of an end-to-end solution.

3. Review and modify the sample parameters to apply to your environment.
4. Save your changes.
5. Initialize Terraform. You only need to do this once per directory.

   terraform init

   Optionally, to use the latest Google provider version, include the -upgrade option:

   terraform init -upgrade

Apply the changes

1. Review the configuration and verify that the resources that Terraform is going to create or update match your expectations:

   terraform plan

   Make corrections to the configuration as necessary.

2. Apply the Terraform configuration by running the following command and entering yes at the prompt:

   terraform apply

   Wait until Terraform displays the "Apply complete!" message.

3. Open your Google Cloud project to view the results. In the Google Cloud console, navigate to your resources in the UI to make sure that Terraform has created or updated them.

API

To create a tag key, create a JSON representation of the key. For more information about the format of a tag key, see the TagKey reference.

Then, use the tagKeys.create method:

POST https://cloudresourcemanager.googleapis.com/v3/tagKeys/ -d

Request JSON body:

{
    "parent": RESOURCE_ID,
    "shortName": SHORT_NAME,
    "description": DESCRIPTION,
}

Where:

• SHORT_NAME is the display name for your tag key; for example: environment.

• RESOURCE_ID is the ID of the parent organization or project resource for this tag key; for example: organizations/123456789012, projects/test-project123, or projects/234567890123. To learn how to get your organization ID, see Creating and managing organizations. To learn how to get your project ID, see Creating and managing projects.

• DESCRIPTION is a description of the key, and no longer than 256 characters.

Console

To view a created tag, do the following:

1. Open the Tags page in the Google Cloud console.

   Open Tags page

2. From the Scope picker at the top of the page, select the organization or project that contains your tag.

3. All tags in the selected organization or project appear in the list. Click the tag for which you want to see the tag key.

gcloud

To display the information related to a given tag key, use the gcloud resource-manager tags keys describe command:

gcloud resource-manager tags keys describe TAGKEY_NAME

TAGKEY_NAME is the permanent ID or namespaced name of the tag key for which you want to display information; for example: tagKeys/123456789012 or project-id/environment.

You should get a response similar to the following:

name: tagKeys/123456789012
short_name: environment
namespaced_name: 123456789012/environment
parent: organizations/123456789012

API

To display the information related to a given tag key, use the tagKeys.get method:

GET https://cloudresourcemanager.googleapis.com/v3/{name=TAGKEY_NAME}

TAGKEY_NAME is the permanent ID of the tag key for which you want to display information; for example: tagKeys/123456789012.

To display the information related to a given tag key using its namespaced name, use the tagKeys.getNamespaced method:

GET https://cloudresourcemanager.googleapis.com/v3/tagKeys/namespaced?name={TAGKEY_NAMESPACED_NAME}

TAGKEY_NAMESPACED_NAME is the namespaced name of the tag key and is of the format parentNamespace/tagKeyShortName.

Console

To create a tag value, do the following:

1. Open the Tags page in the Google Cloud console.

   Open Tags page

2. From the Scope picker at the top of the page, select the organization or project under which you want to create a tag value.

3. In the list of tags, click the tag to which you want to add a new value.

4. Click add Add value.

5. In the Tag value box, enter the display name of your tag value. This becomes part of the namespaced name of your tag.

6. In the Tag value description box, enter a description of your tag value.

7. Click Save.

gcloud

To create a tag value, use the gcloud resource-manager tags values create command. You must specify the key under which this value is created:

gcloud resource-manager tags values create TAGVALUE_SHORTNAME \
    --parent=TAGKEY_NAME

Where:

• TAGVALUE_SHORTNAME is the short name of the new tag value; for example: production.

• TAGKEY_NAME is the permanent ID or namespaced name of the parent tag key; for example: tagKeys/4567890123.

You should get a response similar to the following:

Creating tag value production in tag key 123456789012/environment...
<blocking wait until creation completes>
name: tagValues/7890123456
short_name: production
namespaced_name: 123456789012/environment/production
parent: tagKeys/123456789012

Terraform

Use the google_tags_tag_value resource.

Before you create tag values using Terraform, enable the Cloud Resource Manager API.

The following example creates tag values named prod and sales:

data "google_project" "default" {}

resource "google_tags_tag_key" "env_tag_key" {
  parent     = "projects/${data.google_project.default.project_id}"
  short_name = "env1"
}

resource "google_tags_tag_key" "department_tag_key" {
  parent     = "projects/${data.google_project.default.project_id}"
  short_name = "department1"
}

resource "google_tags_tag_value" "env_tag_value" {
  parent     = "tagKeys/${google_tags_tag_key.env_tag_key.name}"
  short_name = "prod"
}

resource "google_tags_tag_value" "department_tag_value" {
  parent     = "tagKeys/${google_tags_tag_key.department_tag_key.name}"
  short_name = "sales"
}

To apply your Terraform configuration in a Google Cloud project, complete the steps in the following sections.

Prepare Cloud Shell

1. Launch Cloud Shell.

2. Set the default Google Cloud project where you want to apply your Terraform configurations.

   You only need to run this command once per project, and you can run it in any directory.

   export GOOGLE_CLOUD_PROJECT=PROJECT_ID

   Environment variables are overridden if you set explicit values in the Terraform configuration file.

Prepare the directory

Each Terraform configuration file must have its own directory (also called a root module).

1. In Cloud Shell, create a directory and a new file within that directory. The filename must have the .tf extension—for example main.tf. In this tutorial, the file is referred to as main.tf.

   mkdir DIRECTORY && cd DIRECTORY && touch main.tf

2. If you are following a tutorial, you can copy the sample code in each section or step.

   Copy the sample code into the newly created main.tf.

   Optionally, copy the code from GitHub. This is recommended when the Terraform snippet is part of an end-to-end solution.

3. Review and modify the sample parameters to apply to your environment.
4. Save your changes.
5. Initialize Terraform. You only need to do this once per directory.

   terraform init

   Optionally, to use the latest Google provider version, include the -upgrade option:

   terraform init -upgrade

Apply the changes

1. Review the configuration and verify that the resources that Terraform is going to create or update match your expectations:

   terraform plan

   Make corrections to the configuration as necessary.

2. Apply the Terraform configuration by running the following command and entering yes at the prompt:

   terraform apply

   Wait until Terraform displays the "Apply complete!" message.

3. Open your Google Cloud project to view the results. In the Google Cloud console, navigate to your resources in the UI to make sure that Terraform has created or updated them.

API

To create a tag value, create a JSON representation of the value. For more information about the format of a tag value, see the TagValue reference.

Then, use the tagValues.create method:

POST https://cloudresourcemanager.googleapis.com/v3/tagValues/ -d

Request JSON body:

{
    "parent": TAGKEY_NAME,
    "shortName": SHORT_NAME,
    "description": DESCRIPTION,
}

Where:

• TAGKEY_NAME is the permanent ID of the parent tag key; for example:tagKeys/4567890123.

• SHORT_NAME is the display name for your tag value; for example: environment.

• DESCRIPTION is a description of the value, and no longer than 256 characters. After you have created the value, you can find the unique human-readable display name called the namespacedName that is namespaced within its parent resource, and a globally unique permanent ID called the name.

Console

To view a created tag, do the following:

1. Open the Tags page in the Google Cloud console.

   Open Tags page

2. From the Scope picker at the top of the page, select the organization or project that contains your tag.

3. All tags you have created under this organization or project appear in the list. Click the tag for which you want to see tag values.

gcloud

To display the information related to a given tag value, use the gcloud resource-manager tags values describe command:

gcloud resource-manager tags values describe TAGVALUE_NAME

TAGVALUE_NAME is the permanent ID or namespaced name of the tag value; for example: tagValues/4567890123 or 123456789012/environment/production.

You should get a response similar to the following:

name: tagValues/456789012345
short_name: production
namespaced_name: 123456789012/environment/production
parent: tagKeys/123456789012

API

To display the information related to a given tag value, use the tagValues.get method:

GET https://cloudresourcemanager.googleapis.com/v3/{name=TAGVALUE_NAME}

TAGVALUE_NAME is the permanent ID of the tag value; for example: tagValues/4567890123.

To display the information related to a given tag value using its namespaced name, use the tagValues.getNamespaced method:

GET https://cloudresourcemanager.googleapis.com/v3/tagValues/namespaced?name={TAGVALUE_NAMESPACED_NAME}

TAGVALUE_NAMESPACED_NAME is the namespaced name of the tag value and is of the format parentNamespace/tagKeyShortName/tagValueShortName.

Console

To update a tag key's description, do the following:

1. Open the Tags page in the Google Cloud console.

   Open Tags page

2. From the Scope picker at the top of the page, select the organization or project that contains your tag key.

3. Click more_vert Actions next to the tag key you want to update, then click View details.

4. Click edit Edit next to Description near the top of the screen.

5. Update the description of the tag key.

6. Click Save.

gcloud

To modify a tag key description, use the gcloud resource-manager tags keys update command:

gcloud resource-manager tags keys update TAGKEY_NAME \
    --description=NEW_DESCRIPTION

Where:

• TAGKEY_NAME is the permanent ID or namespaced name of the key to be updated; for example: tagKeys/123456789012.

• NEW_DESCRIPTION is a string of no more than 256 characters to use as the new description.

You should get a response similar to the following:

name: tagKeys/123456789012
short_name: environment
namespaced_name: 123456789012/environment
description: "new description"
parent: organizations/123456789012

API

To modify a tag key description, use the tagKeys.patch method:

PATCH https://cloudresourcemanager.googleapis.com/v3/{tagKey.name=TAGKEY_NAME} -d

Request JSON body:

{
    "description": DESCRIPTION,
}

Where:

• TAGKEY_NAME is the permanent ID of the tag key; for example: tagKeys/123456789012.

• DESCRIPTION is a description of the key, and no longer than 256 characters.

Console

To update a tag value's description, do the following:

1. Open the Tags page in the Google Cloud console.

   Open Tags page

2. From the Scope picker at the top of the page, select the organization or project that contains your tag value.

3. Click more_vert Actions next to the tag key for the value you want to update, then click View details.

4. Click more_vert Actions next to the tag value you want to update, then click View details.

5. Click edit Edit next to Description near the top of the screen.

6. Update the description of the tag value.

7. Click Save.

gcloud

To modify a tag value description, use the gcloud resource-manager tags values update command:

gcloud resource-manager tags values update TAGVALUE_NAME \
    --description="NEW_DESCRIPTION"

Where:

• TAGVALUE_NAME is the permanent ID or namespaced name of the tag value to be updated; for example: tagValues/4567890123.

• NEW_DESCRIPTION is a string of no more than 256 characters to use as the new description.

You should get a response similar to the following:

short_name: production
namespaced_name: 123456789012/environment/production
parent: tagKeys/123456789012
description: "new description"

API

To modify a tag key description, use the tagValues.patch command:

PATCH https://cloudresourcemanager.googleapis.com/v3/{tagKey.name=TAGVALUE_NAME} -d

Request JSON body:

{
    "description": DESCRIPTION,
}

Where:

• TAGVALUE_NAME is the permanent ID name of the tag value; for example: tagValues/4567890123.

• DESCRIPTION is a description of the key, and no longer than 256 characters.

Console

To view all tags:

1. Open the Tags page in the Google Cloud console.

   Open Tags page

2. From the Scope picker at the top of the page, select the organization or project that contains your tags.

3. All tags you have created under this organization or project appear in the list.

gcloud

To return a list of all tag keys created under a organization or a project resource, use the gcloud resource-manager tags keys list command:

gcloud resource-manager tags keys list --parent=RESOURCE_ID

RESOURCE_ID is the ID of the organization or project resource for which you want to find attached tag keys.

• An organization or project ID should be provided in the format organizations/ORGANIZATION_ID or projects/PROJECT_NAME; for example: organizations/123456789012 and projects/test-project123. To learn how to get your organization ID, see Creating and managing organizations. To learn how to get your project ID, see Creating and managing projects. You should get a response similar to the following:

NAME                     SHORT_NAME      DESCRIPTION
tagKeys/123456789012     environment     description of tag key

API

To return a list of all tag keys for a given resource, use the tagKeys.list method, with the parent resource specified in the query:

GET https://cloudresourcemanager.googleapis.com/v3/tagKeys

{
    "parent": "RESOURCE_ID"
}

RESOURCE_ID is the ID of the organization or project resource for which you want to find attached tag keys; for example: organizations/123456789012 and projects/test-project123.

Console

To view all tag values attached to a tag key, do the following:

1. Open the Tags page in the Google Cloud console.

   Open Tags page

2. From the Scope picker at the top of the page, select the organization or project that contains your tag key.

3. Click more_vert Actions next to the tag key containing the tag values you want to find, then click View details.

4. All tag values you have created under this tag key appear in the list.

gcloud

To return a list of all tag values attached to a key, use the gcloud resource-manager tags values list command:

gcloud resource-manager tags values list --parent=TAGKEY_NAME

TAGKEY_NAME is the permanent ID or namespaced name of the tag key for which you want to find attached values; for example: tagKeys/123456789012 or 1234567/environment.

You should get a response similar to the following:

NAME                     SHORT_NAME
tagValues/123456789012   production

API

To return a list of all tag values attached to a key, use the tagValues.list method, with the parent tag key specified in the query:

GET https://cloudresourcemanager.googleapis.com/v3/tagValues

{
    "parent": "TAGKEY_NAME"
}

TAGKEY_NAME is the permanent ID name of the tag key; for example: tagKeys/123456789012.

Tag keys

To manage access for users on a tag key, do the following:

1. Open the Tags page in the Google Cloud console.

   Open Tags page

2. From the Scope picker at the top of the page, select the organization or project that contains the tag key on which you want to manage access.

3. Click the checkbox next to the tag for which you want to manage access.

4. Click person Manage access.

5. To add a role to a principal, click person_add Add principal.

   1. In the New principals text box, enter the email address of the principal you want to grant a new role.

   2. Select a role from the Select a role dropdown menu. If you want to add more than one role, click add Add another role.

   3. Click Save.

6. To edit a principal's role, click edit Edit next to the principal you want to edit.

   1. You can change any roles that are assigned to the principals on this tag by clicking on the Role dropdown menu and choosing a new role.

   2. If you want to add more roles, click add Add another role.

   3. To delete a role from this principal on this tag, click delete Delete role next to the role you want to delete.

   4. Click Save.

7. To delete a principal's role, click delete Delete role next to the role you want to delete.

   1. Click Remove.

Tag values

To manage access for users on a tag value, do the following:

1. Open the Tags page in the Google Cloud console.

   Open Tags page

2. From the Scope picker at the top of the page, select the organization or project that contains the tag key for which you want to manage access.

3. Click more_vert Actions next to the tag key for the value for which you want to manage access, then click View details.

4. Click person Manage access.

5. To add a role to a principal, click person_add Add principal.

   1. In the New principals text box, enter the email address of the principal you want to grant a new role.

   2. Select a role from the Select a role dropdown menu. If you want to add more than one role, click add Add another role.

   3. Click Save.

6. To edit a principal's role, click edit Edit next to the principal you want to edit.

   1. You can change any roles that are assigned to the principals on this tag by clicking on the Role dropdown menu and choosing a new role.

   2. If you want to add more roles, click add Add another role.

   3. To delete a role from this principal on this tag, click delete Delete role next to the role you want to delete.

   4. Click Save.

7. To delete a principal's role, click delete Delete role next to the role you want to delete.

   1. Click Remove.

Console

To attach a tag to an organization, folder, or project resource, do the following:

1. Open the Manage resources page in the Google Cloud console.

   Open Manage resources page

2. Click the organization, folder, or project to which you want to attach a tag.

3. Click label_importantTags.

4. In the Tags panel, click Select scope.

5. Select the organization or project that contains your tags, and then click Open.

6. In the Tags panel, select Add tag.

7. In the Key field, select the key for the tag you want to attach from the list. You can filter the list by typing keywords.

8. In the Value field, select the value for the tag you want to attach from the list. You can filter the list by typing keywords.

9. If you want to attach more tags, click add Add Tag, and then select the key and value for each.

10. Click Save.

11. In the Confirm dialog, click Confirm to attach the tag.

12. A notification confirms that your tags are updated. The new tags appear under the Tags column on the Manage resources page.

gcloud

To attach a tag to a resource, you must create a tag binding resource by using the gcloud resource-manager tags bindings create command:

gcloud resource-manager tags bindings create \
--tag-value=TAGVALUE_NAME \
--parent=RESOURCE_ID \
--location=LOCATION

Where:

• TAGVALUE_NAME is the permanent ID or namespaced name of the tag value to be attached; for example: tagValues/4567890123 or 12345678/environment/production.

• RESOURCE_ID is the full ID of the resource, including the API domain name to identify the type of resource (//cloudresourcemanager.googleapis.com/). For example, to attach a tag to projects/7890123456, the full ID would be: //cloudresourcemanager.googleapis.com/projects/7890123456.

• LOCATION is the location of your resource. If you are attaching a tag to a global resource, such as a folder or a project, you should omit this flag. If you are attaching a tag to a regional resource, such as a Compute Engine instance, you must specify the location; for example: us-central1.

API

To attach a tag to a resource, you must first create a JSON representation of a tag binding that includes the permanent ID or namespaced name of the tag value and the permanent ID of the resource. For more information about the format of a tag binding, see the TagBinding reference.

If you are attaching the tag to a global resource such as an organization, use the tagBindings.create method with the global endpoint hostname:

POST https://cloudresourcemanager.googleapis.com/v3/tagBindings

If you are attaching the tag to a regional resource, such as a Compute Engine instance, use the tagBindings.create method with the regional endpoint where your resource is located.

POST https://LOCATION-cloudresourcemanager.googleapis.com/v3/tagBindings

Request JSON body:

{
    "parent": RESOURCE_ID,
    "tagValue": TAGVALUE_NAME,
}

OR

{
    "parent": RESOURCE_ID,
    "tagValueNamespacedName": TAGVALUE_NAMESPACED_NAME,
}

Where:

• RESOURCE_ID is the full ID of the resource, including the API domain name to identify the type of resource (//cloudresourcemanager.googleapis.com/). For example, to attach a tag to projects/7890123456, the full ID would be: //cloudresourcemanager.googleapis.com/projects/7890123456.

• TAGVALUE_NAME is the permanent ID of the tag value that is attached; for example: tagValues/4567890123.

• TAGVALUE_NAMESPACED_NAME is the namespaced name of the tag value that is attached and is of the format: parentNamespace/tagKeyShortName/tagValueShortName.

Console

To see all tags that are attached to or inherited by a resource, do the following:

1. Open the Manage resources page in the Google Cloud console.

   Open Manage resources page

2. Find your organization, folder, or project in the list of resources.

3. The tags attached to the resource appear under the Tags column. Tags that are inherited will be marked as lanInherited.

gcloud

To get a list of tag bindings directly attached to a resource, use the gcloud resource-manager tags bindings list command. If you add the --effective flag, you will also return a list of tags inherited by this resource.

gcloud resource-manager tags bindings list \
    --parent=RESOURCE_ID \
    --location=LOCATION

Where:

• RESOURCE_ID is the full ID of the resource; for example: //cloudresourcemanager.googleapis.com/projects/7890123456

• LOCATION is the location of your resource. If you are listing the tags attached to a global resource, such as a folder or a project, you should omit this flag. If you are attaching a tag to a regional resource, such as a Compute Engine instance, you must specify the location; for example: us-central1.

You should get a response similar to the following:

name: tagBindings/%2F%2Fcloudresourcemanager.googleapis.com%2Fprojects%2F7890123456/tagValues/567890123456
tagValue: tagValues/567890123456
resource: //cloudresourcemanager.googleapis.com/projects/7890123456

If you add the --effective flag to the tags bindings list command, you will also return a list of all tags inherited by this resource. You should get a respond similar to the following:

namespacedTagKey: 961309089256/environment
namespacedTagValue: 961309089256/environment/production
tagKey: tagKeys/417628178507
tagValue: tagValues/247197504380
inherited: true

If all tags evaluated on a resource are directly attached, the inherited field is false and is omitted.

API

To get a list of tag bindings directly attached to a global resource such as an organization, use the tagBindings.list method, specifying the parent resource in the query:

GET https://cloudresourcemanager.googleapis.com/v3/tagBindings

{
    "parent": "RESOURCE_ID"
}

If you want to list the tag bindings attached to a regional resource, such as Compute Engine instances, use the tagBindings.list method with the regional endpoint where your resource is located.

GET https://LOCATION-cloudresourcemanager.googleapis.com/v3/tagBindings

{
    "parent": "RESOURCE_ID"
}

Where:

• RESOURCE_ID is the full ID of the resource; for example: //cloudresourcemanager.googleapis.com/projects/7890123456.

• LOCATION is the regional endpoint for your resource; for example: us-central1.

If successful, the response body should include a list of TagBinding objects. For example:

name: tagBindings/cloudresourcemanager.googleapis.com/projects/7890123456/567890123456
tagValue: tagValues/567890123456
resource: //cloudresourcemanager.googleapis.com/projects/7890123456

Console

To detach a tag from an organization, folder, or project resource, do the following:

1. Open the Manage resources page in the Google Cloud console.

   Open Manage resources page

2. Click the organization, folder, or project from which you want to detach a tag.

3. Click label_importantTags.

4. In the Tags panel, next to the tag you want to detach, click deleteDelete item.

5. Click Save.

6. In the Confirm dialog, click Confirm to detach the tag.

7. A notification confirms that your tags are updated. The updated list of tags appears under the Tags column on the Manage resources page.

gcloud

To delete a tag binding, use the gcloud resource-manager tags bindings delete command:

gcloud resource-manager tags bindings delete \
--tag-value=TAGVALUE_NAME \
--parent=RESOURCE_ID \
--location=LOCATION

Where:

• TAGVALUE_NAME is the permanent ID or namespaced name of the tag value that is attached; for example: tagValues/567890123456.

• RESOURCE_ID is the full ID of the resource. For example: //cloudresourcemanager.googleapis.com/projects/7890123456

• LOCATION is the location of your resource. If you are deleting a tag binding that is attached to a global resource, such as a folder or a project, you should omit this flag. If you are deleting a tag binding attached to a regional resource, such as a Compute Engine instance, you must specify the location; for example: us-central1.

API

To delete a tag binding that is attached to a global resource such as an organization, use the tagBindings.delete method:

DELETE https://cloudresourcemanager.googleapis.com/v3/{name=TAGBINDINGS_NAME}

If you want to delete a tag binding that is attached to a regional resource, such as a Compute Engine instance, use the tagBindings.delete method with the regional endpoint where your resource is located.

DELETE https://LOCATION-cloudresourcemanager.googleapis.com/v3/{name=TAGBINDINGS_NAME}

Where:

• TAGBINDINGS_NAME is the permanent ID of the TagBinding; for example: tagBindings/%2F%2Fcloudresourcemanager.googleapis.com%2Fprojects%2F1234567890/tagValues/567890123456.

• LOCATION is the regional endpoint for your resource; for example: us-central1.

gcloud

To create a tag hold, use the gcloud resource-manager tags holds create gcloud CLI command:

  gcloud resource-manager tags holds create TAGVALUE_NAME \
  --holder=HOLDER_NAME \
  --location=LOCATION

Where:

• TAGVALUE_NAME is the permanent ID or namespaced name of the tag value for which this tag hold should be created; for example: tagValues/567890123456.

• HOLDER_NAME is the name of the resource where the tag value is attached. Must be less than 200 characters.

• LOCATION is the location of your resource. If you are creating a tag hold for a global resource, such as a Google Cloud project, you should omit this flag. If you are creating a tag hold for a regional or zonal resource you must specify the location; for example: us-central1.

API

To create a tag hold for a tag value, you must first create a JSON representation of a tag hold. This JSON reference must include a reference to the resource to which the tag value is attached. For more information about the format of a tag hold, see the TagHolds reference.

If you are creating a tag hold for a tag value attached to a global resource such as an organization, use the tagHolds.create method with the global endpoint hostname:

POST https://cloudresourcemanager.googleapis.com/v3/tagValues/TAGVALUE_NAME/tagHolds

If you are creating a tag hold for a tag value attached to a regional resource, such as a Compute Engine instance, use the tagHolds.create method with the regional endpoint where your resource is located.

POST https://LOCATION-cloudresourcemanager.googleapis.com/v3/TAGVALUE_NAME/tagHolds

Request JSON body:

{
    "holder":HOLDER_NAME,
    "origin":ORIGIN_NAME
}

Where:

• TAGVALUE_NAME is the permanent ID of the tag value that is attached; for example: tagValues/4567890123.

• HOLDER_NAME is the name of the resource where the tag value is attached. Must be less than 200 characters.

• ORIGIN_NAME is an optional string representing the origin of this request. This field should include human-understandable information to distinguish origins from each other. Must be less than 200 characters.

gcloud

To list tag holds that are under a tag value, use the gcloud resource-manager tags holds list gcloud CLI command:

  gcloud resource-manager tags holds list TAGVALUE_NAME \
  --location=LOCATION

Where:

• TAGVALUE_NAME is the permanent ID or namespaced name of the tag value; for example: tagValues/567890123456.

• LOCATION is the location of your resource. If you are looking for tag holds created globally, you should omit this flag. If you are looking for tag holds under a regional or zonal resource, you must specify the location; for example: us-central1.

API

To get a list of tag holds under a tag value, use the tagHolds GET method, specifying the parent tag value in the URL:

GET https://cloudresourcemanager.googleapis.com/v3/{TAGVALUE_NAME}/tagHolds

Where:

• TAGVALUE_NAME is the permanent ID or namespaced name of the tag value; for example: tagValues/567890123456.

gcloud

To delete a tag hold, use the gcloud resource-manager tags holds delete gcloud CLI command:

  gcloud resource-manager tags holds delete TAGHOLD_NAME \
  --location=LOCATION

Where:

• TAGHOLD_NAME is the namespaced name of the tag hold, which can be found by using the list command. For example: tagValues/1012910994523/tagHolds/d1c8f5e2-2954-43d6-8f46-5f812ab48c37.

• LOCATION is the location of your resource. If you are deleting a tag hold that is under a tag value attached to a global resource, such as a folder or a project, you should omit this flag. If you are deleting a tag hold created from a regional or zonal process, you must specify the location; for example: us-central1.

API

To delete a tag value, use the tagHolds.delete method:

DELETE https://cloudresourcemanager.googleapis.com/v3/{TAGVALUE_NAME}/tagHolds/{TAGHOLD_NAME}

Where:

• TAGVALUE_NAME is the permanent ID of the tag value to which the tag hold you want to delete is attached; for example: tagValues/567890123456.

• TAGHOLD_NAME is the namespaced name of the tag hold you want to delete, which can be found by using the list command. For example: tagValues/1012910994523/tagHolds/d1c8f5e2-2954-43d6-8f46-5f812ab48c37.

Console

To delete a tag value, do the following:

1. Open the Tags page in the Google Cloud console.

   Open Tags page

2. From the Scope picker at the top of the page, select the organization or project that contains your tag value.

3. Click more_vert Actions next to the tag key containing the tag value you want to delete, then click View details.

4. In the list of tag values associated with this tag key, click the tag value you want to delete.

5. Click the checkbox next to the tag value you want to delete, then click delete Delete values.

6. Click Confirm.

gcloud

To delete a tag value, use the gcloud resource-manager tag values delete command:

gcloud resource-manager tags values delete TAGVALUE_NAME

TAGVALUE_NAME is the permanent ID or namespaced name of the tag value you want to delete; for example: tagValues/567890123456.

API

To delete a tag value, use the tagValues.delete method:

DELETE https://cloudresourcemanager.googleapis.com/v3/{name=TAGVALUE_NAME}

TAGVALUE_NAME is the permanent ID of the tag value you want to delete; for example: tagValues/567890123456.

Console

To delete a tag key, do the following:

1. Open the Tags page in the Google Cloud console.

   Open Tags page

2. From the Scope picker at the top of the page, select the organization or project that contains your tag key.

3. Click the checkbox next to the tag key you want to delete.

4. Click delete Delete tags.

5. Click Confirm.

gcloud

To delete a tag key, use the gcloud resource-manager tags keys delete command:

gcloud resource-manager tags keys delete TAGKEYS_NAME

TAGKEYS_NAME is the permanent ID or namespaced name of the tag key you want to delete; for example: tagKeys/123456789012.

API

To delete a tag key, use the tagKeys.delete method:

DELETE https://cloudresourcemanager.googleapis.com/v3/{name=TAGKEYS_NAME}

TAGKEYS_NAME is the permanent ID of the tag key you want to delete; for example: tagKeys/123456789012.