What are tag policies?-Resource Management(ResourceManagement)-阿里云帮助中心

Tag policies enforce tag standardization by requiring compliant tags on resources, improving management efficiency for cost allocation, permission control, and automated O&M. Two modes are available: tag policies for the current account and for a resource directory.

Scenarios

As cloud resources grow, tags enable categorization, cost allocation, and automated O&M. However, users often forget to attach tags, attach incomplete tags, or misspell tag values — causing failures in cost allocation and automated management. Tag policies address these scenarios:

Pre-emptive blocking of non-compliant tags

Enforce tag compliance at resource creation time. The pre-emptive blocking feature ensures compliant tags are attached when resources are created.

By default, this feature validates only tags defined in the policy. With strong validation enabled, it also blocks resources with no tags or non-policy tags.

Use a tag policy to pre-emptively block non-compliant tags.
Automatic tag detection

After resource creation, tag policies monitor resource changes and identify non-compliant tags in the following cases:
- The tags attached to the resource are not standardized.
- The resource does not have the specified tags attached.
Automatic detection identifies compliance issues early and comprehensively.

Use a tag policy for automatic tag detection.
Automatic tag remediation

When automatic detection finds non-compliant tags and the rule supports automatic remediation, the tag policy fixes tags without manual intervention.

Use a tag policy for automatic tag remediation.
Automatic inheritance of tags from resource groups to resources within the group

Resources created in or added to a resource group automatically inherit the group's tags.

Use a tag policy for automatic tag inheritance based on resource groups.

How it works

Tag policies enforce compliance from resource creation (pre-emptive) through ongoing monitoring (post-event).

Pre-emptive blocking

When you create a resource or attach tags, the tag policy checks compliance. Non-compliant operations are blocked.
Post-event detection and remediation

Existing resources are checked for tag compliance. Non-compliant tags can be fixed manually or through automatic remediation.

Tag policy modes

Tag Policy supports single-account mode and resource directory mode. Choose a mode based on your scenario and account type.

Scenario	Type of the logon account	Mode of the Tag Policy feature	References
You manage cloud resources with a single Alibaba Cloud account and its RAM users. Enable Tag Policy in single-account mode to govern tag operations for the account and its RAM users.	Alibaba Cloud account that is not the management account or a member of a resource directory	Single-account mode: Governs tag operations for one Alibaba Cloud account and its RAM users.	Enable single-account mode with an Alibaba Cloud account
You use a resource directory to manage all your accounts. Use the management account to enable Tag Policy in resource directory mode and govern tag operations across all members.	Management account of a resource directory	You can enable one or both modes based on your requirements. Resource directory mode: Governs tag operations for all members in the resource directory. Important If any member has enabled Tag Policy in single-account mode, the management account cannot enable resource directory mode. Disable single-account mode on that member first. Single-account mode: Governs tag operations for the management account only.	Enable resource directory mode with the management account
	Member of a resource directory	The behavior depends on whether Tag Policy is enabled for the resource directory: If Tag Policy is not enabled for the resource directory, the member can enable single-account mode to govern its own tag operations. If Tag Policy is enabled for the resource directory, the member cannot enable single-account mode. Tag policies are managed centrally by the management account. The member can only view its effective policy.	Enable single-account mode with a directory member

Limits

Limitations	Specification
Maximum tag policies per account	100
Maximum tag policies per resource directory	100
Maximum tag policy length	2,048 characters
Pre-emptive blocking activation time	Takes effect within 5 minutes after being attached to a target. Takes effect within 5 minutes after policy content is modified.
Automatic detection activation time	Triggered within 1 hour after the policy is attached. Triggered within 10 minutes after a resource is created in the destination account. Triggered in real time when a resource in the destination account changes. After policy content is modified, a full check runs in the destination account. Duration depends on the resource count.
Automatic remediation activation time	Starts within 10 minutes after a non-compliant resource is detected.

Best practices

Alibaba Cloud services that support tag policies

Alibaba Cloud service	Service code	Resource type	Supports automatic tag detection and remediation	Supports automatic inheritance of tags from resource groups	APIs that support the default pre-emptive blocking feature^①	APIs that support the strong validation pre-emptive blocking feature^②
Elastic Computing Service	ecs	instance	Yes	Yes	RunInstances	RunInstances
					CreateInstance	CreateInstance
					TagResources	None
		eni	Yes	No	CreateNetworkInterface	CreateNetworkInterface
		eni	Yes	No	TagResources	None
		securitygroup	Yes	Yes	CreateSecurityGroup	CreateSecurityGroup
		securitygroup	Yes	Yes	TagResources	None
		disk	Yes	Yes	CreateDisk	CreateDisk
		disk	Yes	Yes	TagResources	None
		snapshot	Yes	No	CreateSnapshot	CreateSnapshot
		snapshot	Yes	No	TagResources	None
		ddh	Yes	Yes	AllocateDedicatedHosts	AllocateDedicatedHosts
		ddh	Yes	Yes	TagResources	None
		image	No	No	CreateImage	CreateImage
					CopyImage	None
					TagResources	None
		keypair	No	No	ImportKeyPair	ImportKeyPair
					CreateKeyPair	CreateKeyPair
					TagResources	None
		launchtemplate	Yes	Yes	CreateLaunchTemplate	CreateLaunchTemplate
		launchtemplate	Yes	Yes	TagResources	None
		snapshotpolicy	No	No	CreateAutoSnapshotPolicy	CreateAutoSnapshotPolicy
ApsaraDB RDS	rds	instance	Yes	Yes	CreateDBInstance	None
ApsaraDB RDS	rds	instance	Yes	Yes	TagResources	None
Server Load Balancer	slb	instance	Yes	Yes	TagResources	None
		certificate	No	No	TagResources	None
		acl	No	No	TagResources	None
Application Load Balancer	alb	acl	No	No	Add tags to a resource	None
		loadbalancer	No	No	Add tags to a resource	None
		securitypolicy	No	No	Add tags to a resource	None
		servergroup	No	No	Add tags to a resource	None
virtual private cloud	vpc	vpc	Yes	Yes	TagResources	None
		vswitch	Yes	No	TagResources	None
		routetable	Yes	No	TagResources	None
NAT Gateway	vpc	natgateway	Yes	Yes	TagResources	None
VPN Gateway	vpc	vpngateway	No	No	TagResources	None
Internet Shared Bandwidth	vpc	commonbandwidthpackage	No	No	TagResources	None
Elastic IP Address	vpc	eip	Yes	Yes	TagResources	None
Cloud Enterprise Network (CEN)	cen	cen	Yes	Yes	TagResources	None
Cloud Enterprise Network (CEN)	cen	bandwidthpackage	No	No	TagResources	None
CDN	cdn	domain	Yes	Yes	None	None
Object Storage Service	oss	bucket	Yes	Yes	None	None
ApsaraDB for Tair (Redis®-compatible)	kvstore	instance	Yes	Yes	CreateInstance - Create an instance	None
ApsaraDB for Tair (Redis®-compatible)	kvstore	instance	Yes	Yes	TagResources - Attach tags to one or more instances	None
ApsaraDB for MongoDB	dds	instance	Yes	Yes	TagResources	None
ApsaraDB for HBase	multimod	cluster	Yes	Yes	TagResources	None
PolarDB	polardb	cluster	Yes	Yes	None	None
File Storage NAS	nas	filesystem	Yes	Yes	TagResources	None
Anti-DDoS	ddoscoo	instance	Yes	Yes	Attach tags to a specified resource	None
Anti-DDoS	ddoscoo	instance	Yes	Yes	Associate tags with a resource	None
container service	cs	cluster	Yes	Yes	None	None
API Gateway	apigateway	api	Yes	Yes	None	None
		apigroup	Yes	Yes	None	None
		app	No	No	None	None
		instance	No	No	None	None
		plugin	No	No	None	None
Alibaba Cloud DNS	alidns	domain	No	No	Add or modify resource tags	None
Auto Scaling	ess	scalinggroup	No	No	CreateScalingGroup	CreateScalingGroup
Auto Scaling	ess	scalinggroup	No	No	TagResources	None
Elastic Container Instance	eci	containergroup	No	No	Create a container group	Create a container group
		containergroup	No	No	Update a container group	None
		imagecache	No	No	Update an image cache	None
		imagecache	No	No	Create an image cache	None
		virtualnode	No	No	Update a virtual node	None
		virtualnode	No	No	Create a virtual node	Create a virtual node
Message Queue for Apache RocketMQ	mq	group	No	No	TagResources	None
		instance	No	No	TagResources	None
		topic	No	No	TagResources	None
Bastionhost	bastionhost	instance	No	No	TagResources	None
Resource Orchestration Service	ros	changeset	No	No	TagResources	None
		stack	No	No	CreateStack	CreateStack
					UpdateStack	None
					TagResources	None
		template	No	No	TagResources	None

Note:

^①Pre-emptive blocking covers two scenarios: resource creation and tag attachment. Support varies by service, resource type, and API. For example, for ECS instances, CreateInstance blocks non-compliant tags during creation, and TagResources blocks them during tag attachment.

^②The strong validation feature for pre-emptive blocking must be manually enabled. Strong validation feature.