Automate tag management with Cloud Config-Cloud Config(CloudConfig)-阿里云帮助中心

Background information

Enterprises typically use tags to categorize cloud resources for permission management, cost allocation, and audits. Efficiently associating tags with resources and maintaining tag compliance can be challenging in IT governance. Cloud Config provides rule templates and remediation capabilities to address common tag management needs. The following sections describe these templates and their usage scenarios.

Rule templates

The following table lists the tag management rule templates available in Cloud Config.

Rule template	Detection logic	Scenario	Remediation support
required-tags	If a resource has all specified tags, the evaluation result is Compliant. You can specify up to six tags in key-value pairs. Tag keys and values are case-sensitive. You can specify only one tag value for a tag key.	The resource must have all specified tags in key-value pairs. The key-value pairs must meet the format requirements.	Template remediation is supported. Multiple non-compliant tags can be remediated at the same time.
required-any-tags	If a resource has at least one of the specified tags, the evaluation result is Compliant. You can specify up to six tags in key-value pairs. Tag keys and values are case-sensitive. You can specify only one tag value for a tag key.	The resource must have at least one of the specified tags in key-value pairs. The key-value pairs must meet the format requirements.	Custom remediation is supported.
contains-all-tag	If a resource has all specified tags, the evaluation result is Compliant. You can specify up to six tags in key-value pairs. Tag keys and values are case-sensitive. You can use asterisks (*) and question marks (?) as wildcard characters. You can specify only one tag key but you can specify multiple tag values for each tag. Separate multiple tag values with commas (,). A tag that is associated with the resource only needs to match one of the tag values.	The resource must have all specified tags in key-value pairs. The key-value pairs must contain asterisks (*) or question marks (?) as wildcard characters.	Custom remediation is supported.
contains-tag	If a resource has the specified tag whose value is one of the specified values, the evaluation result is Compliant. The tag key and value are case-sensitive. You can use asterisks (*) and question marks (?) as wildcard characters. You can specify only one tag key but you can specify multiple tag values for each tag. Separate multiple tag values with commas (,). If the tag that is associated with the resource can match one of the tag values, the resource is considered compliant.	The resource must have tag key-value pairs that match a specific wildcard format and meet at least one set of requirements.	Custom remediation is supported.
resources-tags-not-empty	If the tag information of a resource is not empty, the evaluation result is Compliant.	The resource must have valid tag information.	Custom remediation is supported.
matched-tag	If a tag of a resource that belongs to a supported resource type matches the specified regular expression for tags in key-value pairs, the evaluation result is Compliant. You can specify a regular expression for tag keys. The regular expression for tag values is optional.	This rule is used to evaluate resources whose tags are in complicated formats.	You can modify templates to specify fixed tag key-value pairs.
resources-inherit-tags-from-ecs-instance	If a resource that is associated with an Elastic Compute Service (ECS) instance inherits a specified tag of the ECS instance, the evaluation result is Compliant. If the ECS instance does not have the specified tag key, the rule is not applicable.	The resource inherits a specified tag of the ECS instance with which the resource is associated.	Template remediation is supported.
resources-inherit-tags-from-resource-group	If a resource that belongs to a resource group inherits a specified tag of the resource group, the evaluation result is Compliant. If the resource does not belong to a resource group or the resource group does not have the specified tag key, the rule is not applicable.	The resource inherits a specified tag of the resource group to which the resource belongs.	Template remediation is supported.

Scenario 1

Description

You can use creator tags from Resource Management to define the scope of a Cloud Config rule and automatically check whether resources created by a specific account have a required tag key-value pair. The following example checks whether a resource created by the RAM user 20654616023382**** has the env:test tag and automatically adds the tag if it is missing.

Prerequisites

The createdby tags feature is enabled. For more information, see Enable or disable createdby tags.

Procedure

Log on to the Cloud Config console.
In the left-side navigation pane, choose Compliance Evaluation > Rules.
On the Rules page, click Create Rule.
1. On the Select Create Method page, select Based on managed rule. Search for and select the required-tags rule, named Checks whether a resource has all specified tags. Then, click Next.
2. On the Set Basic Properties page, for Rule Parameters, set the tag1Key parameter to env and the Expected Value for the tag1Value parameter to test. Configure other parameters as needed and click Next.
3. On the Set Effective Scope page, under Scope based on Tags, set Key to acs:tag:createdby and Value to sub:20654616023382****:dongdong_****.
  
  Note
  If the resource creator is a RAM user, the creator tag value is in the format sub:<RamUserId>:<RamUserName>. In this format, <RamUserId> is the RAM user ID, and <RamUserName> is the RAM user name.
4. On the Set Correction page, enable remediation and set the Invoke Type to Automatic.
5. Click Submit.
Enable the rule to evaluate resources, view the evaluation result of the resources, and check whether non-compliant resources are automatically remediated.

FAQ

Some resources are not automatically remediated after an audit.

After you enable the createdby tags feature, the acs:tag:createdby tag is automatically associated with newly created resources. Resources created before the feature is enabled do not have the acs:tag:createdby tag and are not evaluated by the rule. As a result, any non-compliant resources among them are not automatically remediated.

Scenario 2

Description

Cloud Config can automatically check and correct the tag key-value pairs of resources in a specific resource group. The following example uses a rule template to check whether resources in the resource group rg-aekz5zudjfo**** (resource group identifier: test-resource-group) have the env:test tag and automatically corrects non-compliant resources.

Prerequisites

Make sure the resource group has the env:test tag attached. You can verify this in the Tag console. If the tag is not attached, see Create and attach a custom tag.

Procedure

Log on to the Cloud Config console.
In the left-side navigation pane, choose Compliance Evaluation > Rules.
On the Rules page, click Create Rule.
1. On the Select Create Method page, select Based on managed rule. Search for and select the resources-inherit-tags-from-resource-group rule, named Checks whether a resource inherits the specified tag from its resource group. Then, click Next.
2. On the Set Basic Properties page, for Rule Parameters, set the Expected Value for inheritTagKeys to env. Configure other parameters as needed and click Next.
3. On the Set Effective Scope page, for Resource group IDs, enter test-resource-group and click Next.
  
  Note
  You can set the resource group ID using the Resource Group Name, Resource Group Identifier, or Resource Group ID.
4. On the Set Correction page, enable remediation and set the Invoke Type to Automatic.
5. Click Submit.
6. Manually run the audit. Then, query the audit results and verify that the resources in the resource group rg-aekz5zudjfo**** have the env:test tag key-value pair attached.

FAQ

Why do non-compliant resources still exist after I enable the rule that can automatically remediate resources?

Go to the rule details page and click the Result tab to check whether automatic remediation is complete. Remediation duration varies based on the number of non-compliant resources. After remediation completes, resource status updates in Cloud Config within 10 minutes, and then the resources are re-evaluated based on the rule.