Get started with tag policies

Step 1: Enable the Tag Policy feature

1. Log on to the Resource Management console.

2. In the left-side navigation pane, choose Tag Policy > Settings.

3. On the Settings for Current Account tab, set Tag Policy to Enable.

4. In the Enable Tag Policy dialog box, click Enable.

   Enabling Tag Policy creates the service-linked role AliyunServiceRoleForTag for cross-service access.

Step 2: Create a tag policy

Create a tag policy that defines the required tags for resources. Resources are validated against this policy.

1. In the left navigation pane, choose Tag Policy > Policy Library.

2. On the Policy Library page, click Create Tag Policy.

3. In the Basic Information section, enter a policy name and description.

4. In the Details section, configure the policy using one of the following methods.

   • Quick Mode (Recommended)

     Select a policy scenario and configure rules.

     • Add Tags with Specified Tag Values to Resources

       Specify required tags for resources. Enable automatic detection, automatic remediation, and pre-event interception for non-compliant tags.

       Parameter	Description
       Tag Key	Enter a tag key.
       Specify Allowed Tag Values	Allowed tag values for the tag key. Specify one or more values, or use an asterisk (*) as a wildcard for any value.
       Policy Execution Mode	Post-event Detection Post-event detection is the default execution mode. Enable detection rules as needed and view results on the effective policy details page. Specify Resource Types for Detection: All supported resource types are detected by default. Specify resource types to narrow the scope. Resource Groups: All resource groups are detected by default. Specify resource groups to narrow the scope. Maximum: 20. Note The Resource Groups parameter is not supported for tag policies for a Resource Directory. Regions: All regions are detected by default. Specify regions to narrow the scope. Maximum: 20. Specify Tag Scope: Specify tags to narrow the detection scope. Only resources matching all specified tags (AND logic) are detected. Maximum: 20 tags. Specify Regular Expression of Resource Names: Specify a regular expression to detect only resources with matching names. For example, abc-.* detects resources whose names start with abc-. Automatic Remediation: Automatically remediate tags on non-compliant resources. Specify a unique remediation scope for each tag value. Pre-event Interception When you create a resource or add tags, the system checks compliance with the tag policy. Non-compliant operations are blocked. Enable pre-event interception of non-compliant tags.

     • Match Tag Values with Specified Regular Expression

       Specify a regular expression to enforce tag value formats. Non-matching values can be automatically remediated.

       Parameter	Description
       Tag Key	Enter a tag key.
       Specify Allowed Tag Values	Enter a regular expression to enforce the format of tag values.
       Policy Execution Mode	Post-event Detection is the default execution mode. Enable detection rules and view results on the effective policy details page. Specify Resource Types for Detection: All supported resource types are detected by default. Specify resource types to narrow the scope. Resource Groups: All resource groups are detected by default. Specify resource groups to narrow the scope. Maximum: 20. Note The Resource Groups parameter is not supported for tag policies for a Resource Directory. Regions: All regions are detected by default. Specify regions to narrow the scope. Maximum: 20. Specify Tag Scope: Specify tags to narrow the detection scope. Only resources matching all specified tags (AND logic) are detected. Maximum: 20 tags. Specify Regular Expression of Resource Names: Specify a regular expression to detect only resources with matching names. For example, abc-.* detects resources whose names start with abc-. Automatic Remediation: Automatically remediate tags on non-compliant resources. Specify a unique remediation scope for each tag value.

     • Automatically Inherit Tags for Resources from Resource Groups

       Configure automatic tag inheritance so that resources added to or created in a resource group inherit the resource group's tags.

       Parameter	Description
       Tag Key	Enter a tag key. In single-account mode, click View Resource Groups with the Tag Key to view resource groups that use this tag key.
       Specify Resource Types for Detection	All supported resource types are detected by default. Specify resource types to narrow the detection scope.
       Resource Groups	All resource groups are detected by default. Specify resource groups to narrow the scope. Maximum: 20. Note The Resource Groups parameter is not supported for tag policies for a Resource Directory.
       Specify IDs of Resources to Be Excluded	Specify resource IDs to exclude from tag inheritance. Maximum: 20.
       Regions	All regions are detected by default. Specify regions to narrow the scope. Maximum: 20.
       Specify Tag Scope	Specify tags to narrow the detection scope. Only resources matching all specified tags (AND logic) are detected. Maximum: 20 tags.

     Click Add Policy Scenario and Tag Key to add rules for multiple policy scenarios and tag keys.

   • JSON

     Specify policy details in JSON format for advanced configurations. You must understand the Syntax of a tag policy before using this mode.

5. Click Create.

Step 3: Attach the tag policy

Attach the tag policy to your Alibaba Cloud account to enforce it on resources within the account.

1. In the navigation pane on the left, choose Tag Policy > Policy Library.

2. For the tag policy you want to attach, click Attach in the Actions column.

3. In the Add dialog box, click Attach.

   The tag policy is attached to your current Alibaba Cloud account.

Step 4: (Optional) View the effective policy

View the effective policy applied to your account after attachment.

1. In the left-side navigation pane, choose Tag Policy > Effective Policies.

2. Click a tag key to view its effective policy details, including basic information, involved tag policies, detection results, and remediation records.

Step 5: Check whether the tag policy is in effect

Perform a tag operation with your account or a RAM user to verify that the policy is enforced. For example, if a policy requires the tag CostCenter:Beijing on a VPC, only the compliant tag CostCenter:Beijing can be added. Non-compliant tags such as costCenter:Shanghai are rejected.

Step 1: Enable the Tag Policy feature

1. Log on to the Resource Management console.

2. In the left-side navigation pane, choose Tag Policy > Settings.

3. On the Settings for Resource Directory tab, set Tag Policy to Enable.

   Note

   The management account can also enable a tag policy for itself on the Settings for Current Account tab.

4. In the Enable Tag Policy dialog box, click Enable.

   Enabling Tag Policy creates the service-linked role AliyunServiceRoleForTag for cross-service access.

Step 2: Create a tag policy

Create a tag policy that defines the required tags for resources. Resources are validated against this policy.

1. In the left navigation pane, choose Tag Policy > Policy Library.

2. On the Policy Library page, click the Resource Directory tab, and then click Create Tag Policy.

3. In the Basic Information section, enter a policy name and description.

4. In the Details section, configure the policy using one of the following methods.

   • Quick Mode (Recommended)

     Select a policy scenario and configure rules.

     • Add Tags with Specified Tag Values to Resources

       Specify required tags for resources. Enable automatic detection, automatic remediation, and pre-event interception for non-compliant tags.

       Parameter	Description
       Tag Key	Enter a tag key.
       Specify Allowed Tag Values	Allowed tag values for the tag key. Specify one or more values, or use an asterisk (*) as a wildcard for any value.
       Policy Execution Mode	Post-event Detection Post-event detection is the default execution mode. Enable detection rules as needed and view results on the effective policy details page. Specify Resource Types for Detection: All supported resource types are detected by default. Specify resource types to narrow the scope. Resource Groups: All resource groups are detected by default. Specify resource groups to narrow the scope. Maximum: 20. Note The Resource Groups parameter is not supported for tag policies for a Resource Directory. Regions: All regions are detected by default. Specify regions to narrow the scope. Maximum: 20. Specify Tag Scope: Specify tags to narrow the detection scope. Only resources matching all specified tags (AND logic) are detected. Maximum: 20 tags. Specify Regular Expression of Resource Names: Specify a regular expression to detect only resources with matching names. For example, abc-.* detects resources whose names start with abc-. Automatic Remediation: Automatically remediate tags on non-compliant resources. Specify a unique remediation scope for each tag value. Pre-event Interception When you create a resource or add tags, the system checks compliance with the tag policy. Non-compliant operations are blocked. Enable pre-event interception of non-compliant tags.

     • Match Tag Values with Specified Regular Expression

       Specify a regular expression to enforce tag value formats. Non-matching values can be automatically remediated.

       Parameter	Description
       Tag Key	Enter a tag key.
       Specify Allowed Tag Values	Enter a regular expression to enforce the format of tag values.
       Policy Execution Mode	Post-event Detection is the default execution mode. Enable detection rules and view results on the effective policy details page. Specify Resource Types for Detection: All supported resource types are detected by default. Specify resource types to narrow the scope. Resource Groups: All resource groups are detected by default. Specify resource groups to narrow the scope. Maximum: 20. Note The Resource Groups parameter is not supported for tag policies for a Resource Directory. Regions: All regions are detected by default. Specify regions to narrow the scope. Maximum: 20. Specify Tag Scope: Specify tags to narrow the detection scope. Only resources matching all specified tags (AND logic) are detected. Maximum: 20 tags. Specify Regular Expression of Resource Names: Specify a regular expression to detect only resources with matching names. For example, abc-.* detects resources whose names start with abc-. Automatic Remediation: Automatically remediate tags on non-compliant resources. Specify a unique remediation scope for each tag value.

     • Automatically Inherit Tags for Resources from Resource Groups

       Configure automatic tag inheritance so that resources added to or created in a resource group inherit the resource group's tags.

       Parameter	Description
       Tag Key	Enter a tag key. In single-account mode, click View Resource Groups with the Tag Key to view resource groups that use this tag key.
       Specify Resource Types for Detection	All supported resource types are detected by default. Specify resource types to narrow the detection scope.
       Resource Groups	All resource groups are detected by default. Specify resource groups to narrow the scope. Maximum: 20. Note The Resource Groups parameter is not supported for tag policies for a Resource Directory.
       Specify IDs of Resources to Be Excluded	Specify resource IDs to exclude from tag inheritance. Maximum: 20.
       Regions	All regions are detected by default. Specify regions to narrow the scope. Maximum: 20.
       Specify Tag Scope	Specify tags to narrow the detection scope. Only resources matching all specified tags (AND logic) are detected. Maximum: 20 tags.

     Click Add Policy Scenario and Tag Key to add rules for multiple policy scenarios and tag keys.

   • JSON

     Specify policy details in JSON format for advanced configurations. You must understand the Syntax of a tag policy before using this mode.

5. Click Create.

Step 3: Attach the tag policy

Attach the tag policy to the Root folder, a specific folder, or a specific member to enforce it on resources within those members.

1. In the left navigation bar, select Tag Policy > Policy Library.

2. On the Policy Library page, click the Resource Directory tab.

3. For the tag policy you want to attach, click Attach in the Actions column.

4. In the Add dialog box, select a target and then click Add.

   The effective scope of the policy depends on the selected target:

   • Root folder: The tag policy applies to all members in the resource directory.

   • Specific folder: The tag policy applies only to members in the selected folder.

   • Specific member: The tag policy applies only to the selected member.

   Note

   You cannot attach a tag policy for a resource directory to the management account. To apply a tag policy to the management account, use the single-account mode instead.

Step 4: (Optional) View the effective policy

View the effective policy of the Root folder, a folder, or a member. Effective policies are derived from the tag policy inheritance hierarchy. For more information, see Inheritance of a tag policy and calculation of an effective tag policy.

1. Log on to the Resource Management Tag console.

2. In the left-side navigation pane, choose Tag Policy > Effective Policies.

3. View the effective policy.

   • View the effective policy for the current account.

     Click a tag key to view the effective policy details for the current account, including basic information, attached tag policies, detection results, and remediation records.

     On the Current Account Policy tab, the table displays the Tag Key, Policy Type, Tag Value, and Status of effective policies. Click a value in the Tag Key column (such as cost, costcenter, or env) to open the effective policy details page.

   • View effective policies across a resource directory.

     • Click the All Members tab to see all members with attached tag policies. In the Actions column, click View Detection Results for a member to view its effective policy details, including basic information, attached tag policies, detection results, and remediation records.

     • Click the Resource Directory tab to browse effective policies by folder and member hierarchy. Click a tag key for any folder or member to view its effective policy details, including basic information, attached tag policies, detection results, and remediation records.

       The left pane shows a directory tree where resource directory nodes can be selected. The right pane displays the effective policies for the selected node in a table with columns for Tag Key, Policy Type, Tag Value, Status, and Actions.

Step 5: Check whether the tag policy is in effect

1. Use the RAM user to access a member to which the tag policy is attached.

   Use a member to log on to the Alibaba Cloud Management Console.

2. Perform a tag-related operation on a resource within the member to check whether the tag policy is in effect.

   For example, if a policy requires the tag CostCenter:Beijing on a VPC, only the compliant tag CostCenter:Beijing can be added. Non-compliant tags such as costCenter:Shanghai are rejected.