Replace tag values using a tag policy

Use cases

A company might need to replace the tag project:A with project:B on its resources for easier management or cost allocation.

This topic shows how to use the automatic remediation feature of a tag policy to replace tag values. You can scope the resources for detection and remediation by using the tag project:A. This feature works with tag policies applied to the current account or within a resource directory. The following example uses a tag policy on the current account.

For a list of resource types that support automatic remediation, see the Support for automatic tag detection and remediation column in Cloud services that support tag policies.

Procedure

1. Log on to the Resource Management console.

2. Enable the tag policy feature.

   For more information, see Enable the tag policy feature.

3. Create a tag policy.

   1. On the Policy Library page, click Replace Tag Values.

   2. In the Replace tag values dialog box, specify the tag key and values for the replacement, and then click Set Resource Scope.

      The tag information includes Tag key, Original tag value, and New tag value. For example, you can replace the tag value A with B for the tag key project.

   3. On the Create Tag Policy page, review the policy parameters and configure the resource scope as needed.

      In the Select policy scenario section, select Resource must have a specific tag value. For Tag key, enter project. For Specify allowed tag values, enter B.

      Select Specify tag scope and set the detection scope by specifying a tag, for example, project:A. If you specify multiple tags, the relationship between them is AND.

      Select Enable automatic remediation and click Edit automatic remediation scope. Set the remediation scope for the tag value B to All non-compliant resources.

   4. Click Create.

4. Attach the tag policy.

   1. In the tag policy list, find the tag policy that you created in the previous step and click Attach in the Actions column.

   2. In the Add dialog box, click OK.

5. Wait for some time, and then check the automatic remediation results on the Effective Policies page.

   You can also check the tags on specific resources. If a tag is updated to project:B, the remediation is successful.

   Click the Remediation records tab. From the Execution result drop-down list, filter for Successful records. The table displays the Resource ID, Product, Resource type, Execution time, Execution result, and Execution ID. Confirm that the policy has automatically remediated the relevant resources.

Going forward, the tag policy continuously scans for resources with the tag project:A and automatically remediates them to project:B.

Related documents

The preceding operations are for tag remediation. If you also want to require that the tag project:B is attached when you create resources or attach tags to resources, you can use the preventive control feature of a tag policy. For more information, see Use a tag policy to implement preventive controls for non-compliant tags.