What are tag policies?-Resource Management(ResourceManagement)-阿里云帮助中心

Tag policies enforce tag standardization by requiring compliant tags on resources, improving management efficiency for cost allocation, permission control, and automated O&M. Two modes are available: tag policies for the current account and for a resource directory.

Scenarios

As cloud resources grow, tags enable categorization, cost allocation, and automated O&M. However, users often forget to attach tags, attach incomplete tags, or misspell tag values — causing failures in cost allocation and automated management. Tag policies address these scenarios:

Pre-emptive blocking of non-compliant tags

Enforce tag compliance at resource creation time. The pre-emptive blocking feature ensures compliant tags are attached when resources are created.

By default, this feature validates only tags defined in the policy. With strong validation enabled, it also blocks resources with no tags or non-policy tags.

Use a tag policy to pre-emptively block non-compliant tags.
Automatic tag detection

After resource creation, tag policies monitor resource changes and identify non-compliant tags in the following cases:
- The tags attached to the resource are not standardized.
- The resource does not have the specified tags attached.
Automatic detection identifies compliance issues early and comprehensively.

Use a tag policy for automatic tag detection.
Automatic tag remediation

When automatic detection finds non-compliant tags and the rule supports automatic remediation, the tag policy fixes tags without manual intervention.

Use a tag policy for automatic tag remediation.
Automatic inheritance of tags from resource groups to resources within the group

Resources created in or added to a resource group automatically inherit the group's tags.

Use a tag policy for automatic tag inheritance based on resource groups.

How it works

Tag policies enforce compliance from resource creation (pre-emptive) through ongoing monitoring (post-event).

Pre-emptive blocking

When you create a resource or attach tags, the tag policy checks compliance. Non-compliant operations are blocked.
Post-event detection and remediation

Existing resources are checked for tag compliance. Non-compliant tags can be fixed manually or through automatic remediation.

Tag policy modes

Resource Management allows you to enable the Tag Policy feature in single-account mode or in resource directory mode. You can enable the Tag Policy feature that is in a specific mode based on your business scenario and the type of your logon account. The following table describes the two modes.

Scenario	Type of the logon account	Mode of the Tag Policy feature	References
If your business in the cloud is simple and you use a single Alibaba Cloud account and the RAM users within the Alibaba Cloud account to perform management operations, you can use the Alibaba Cloud account to enable the Tag Policy feature that is in single-account mode. Then, you can use tag policies to manage the tag-related operations performed by using the Alibaba Cloud account or the RAM users.	Alibaba Cloud account that is not the management account or a member of a resource directory	Single-account mode: The Tag Policy feature in this mode can be used to manage tag-related operations performed by using an Alibaba Cloud account or the RAM users within the Alibaba Cloud account.	Use an Alibaba Cloud account to enable the Tag Policy feature in single-account mode
If your business in the cloud is complex and you use a resource directory to manage all your accounts, you can use the management account of the resource directory to enable the Tag Policy feature that is in resource directory mode. Then, you can use tag policies to manage the tag-related operations performed by using a member of the resource directory.	Management account of a resource directory	You can enable the Tag Policy feature in both modes or in one of the modes based on your business requirements. Resource directory mode: The Tag Policy feature in this mode can be used to manage the tag-related operations performed by using a member of the resource directory. Important If a member of the resource directory is used to enable the Tag Policy feature that is in single-account mode, the management account of the resource directory cannot be used to enable the Tag Policy feature that is in resource directory mode. To enable the Tag Policy feature that is in resource directory mode, you must first disable the Tag Policy feature that is in single-account mode and enabled by using the member. Single-account mode: The Tag Policy feature in this mode can be used to manage only tag-related operations performed by using the management account of the resource directory.	Use the management account of a resource directory to enable the Tag Policy feature in resource directory mode
	Member of a resource directory	The following situations may occur based on whether the Tag Policy feature is enabled for a resource directory: If the Tag Policy feature is not enabled for the resource directory, you can use a member of the resource directory to enable the Tag Policy feature that is in single-account mode to manage only the tag-related operations performed by using the member. If the Tag Policy feature is enabled for the resource directory, you cannot use a member of the resource directory to enable the Tag Policy feature that is in single-account mode. Tag policies are managed by using the management account of the resource directory in a centralized manner. You can use the member only to view the effective policy of the member.	Use a member of a resource directory to enable the Tag Policy feature in single-account mode

Limits

Limitations	Specification
Maximum tag policies per account	100
Maximum tag policies per resource directory	100
Maximum tag policy length	2,048 characters
Pre-emptive blocking activation time	Takes effect within 5 minutes after being attached to a target. Takes effect within 5 minutes after policy content is modified.
Automatic detection activation time	Triggered within 1 hour after the policy is attached. Triggered within 10 minutes after a resource is created in the destination account. Triggered in real time when a resource in the destination account changes. After policy content is modified, a full check runs in the destination account. Duration depends on the resource count.
Automatic remediation activation time	Starts within 10 minutes after a non-compliant resource is detected.

Best practices

Alibaba Cloud services that support tag policies

Alibaba Cloud service	Service code	Resource type	Supports automatic tag detection and remediation	Supports automatic inheritance of tags from resource groups	APIs that support the default pre-emptive blocking feature^①	APIs that support the strong validation pre-emptive blocking feature^②
Elastic Computing Service	ecs	instance	Yes	Yes	RunInstances	RunInstances
					CreateInstance	CreateInstance
					TagResources	None
		eni	Yes	No	CreateNetworkInterface	CreateNetworkInterface
		eni	Yes	No	TagResources	None
		securitygroup	Yes	Yes	CreateSecurityGroup	CreateSecurityGroup
		securitygroup	Yes	Yes	TagResources	None
		disk	Yes	Yes	CreateDisk	CreateDisk
		disk	Yes	Yes	TagResources	None
		snapshot	Yes	No	CreateSnapshot	CreateSnapshot
		snapshot	Yes	No	TagResources	None
		ddh	Yes	Yes	AllocateDedicatedHosts	AllocateDedicatedHosts
		ddh	Yes	Yes	TagResources	None
		image	No	No	CreateImage	CreateImage
					CopyImage	None
					TagResources	None
		keypair	No	No	ImportKeyPair	ImportKeyPair
					CreateKeyPair	CreateKeyPair
					TagResources	None
		launchtemplate	Yes	Yes	CreateLaunchTemplate	CreateLaunchTemplate
		launchtemplate	Yes	Yes	TagResources	None
		snapshotpolicy	No	No	CreateAutoSnapshotPolicy	CreateAutoSnapshotPolicy
ApsaraDB RDS	rds	instance	Yes	Yes	CreateDBInstance	None
ApsaraDB RDS	rds	instance	Yes	Yes	TagResources	None
Server Load Balancer	slb	instance	Yes	Yes	TagResources	None
		certificate	No	No	TagResources	None
		acl	No	No	TagResources	None
Application Load Balancer	alb	acl	No	No	Add tags to a resource	None
		loadbalancer	No	No	Add tags to a resource	None
		securitypolicy	No	No	Add tags to a resource	None
		servergroup	No	No	Add tags to a resource	None
virtual private cloud	vpc	vpc	Yes	Yes	TagResources	None
		vswitch	Yes	No	TagResources	None
		routetable	Yes	No	TagResources	None
NAT Gateway	vpc	natgateway	Yes	Yes	TagResources	None
VPN Gateway	vpc	vpngateway	No	No	TagResources	None
Internet Shared Bandwidth	vpc	commonbandwidthpackage	No	No	TagResources	None
Elastic IP Address	vpc	eip	Yes	Yes	TagResources	None
Cloud Enterprise Network (CEN)	cen	cen	Yes	Yes	TagResources	None
Cloud Enterprise Network (CEN)	cen	bandwidthpackage	No	No	TagResources	None
CDN	cdn	domain	Yes	Yes	None	None
Object Storage Service	oss	bucket	Yes	Yes	None	None
ApsaraDB for Tair (Redis®-compatible)	kvstore	instance	Yes	Yes	CreateInstance - Create an instance	None
ApsaraDB for Tair (Redis®-compatible)	kvstore	instance	Yes	Yes	TagResources - Attach tags to one or more instances	None
ApsaraDB for MongoDB	dds	instance	Yes	Yes	TagResources	None
ApsaraDB for HBase	multimod	cluster	Yes	Yes	TagResources	None
PolarDB	polardb	cluster	Yes	Yes	None	None
File Storage NAS	nas	filesystem	Yes	Yes	TagResources	None
Anti-DDoS	ddoscoo	instance	Yes	Yes	Attach tags to a specified resource	None
Anti-DDoS	ddoscoo	instance	Yes	Yes	Associate tags with a resource	None
container service	cs	cluster	Yes	Yes	None	None
API Gateway	apigateway	api	Yes	Yes	None	None
		apigroup	Yes	Yes	None	None
		app	No	No	None	None
		instance	No	No	None	None
		plugin	No	No	None	None
Alibaba Cloud DNS	alidns	domain	No	No	Add or modify resource tags	None
Auto Scaling	ess	scalinggroup	No	No	CreateScalingGroup	CreateScalingGroup
Auto Scaling	ess	scalinggroup	No	No	TagResources	None
Elastic Container Instance	eci	containergroup	No	No	Create a container group	Create a container group
		containergroup	No	No	Update a container group	None
		imagecache	No	No	Update an image cache	None
		imagecache	No	No	Create an image cache	None
		virtualnode	No	No	Update a virtual node	None
		virtualnode	No	No	Create a virtual node	Create a virtual node
Message Queue for Apache RocketMQ	mq	group	No	No	TagResources	None
		instance	No	No	TagResources	None
		topic	No	No	TagResources	None
Bastionhost	bastionhost	instance	No	No	TagResources	None
Resource Orchestration Service	ros	changeset	No	No	TagResources	None
		stack	No	No	CreateStack	CreateStack
					UpdateStack	None
					TagResources	None
		template	No	No	TagResources	None

Note:

^①Pre-emptive blocking covers two scenarios: resource creation and tag attachment. Support varies by service, resource type, and API. For example, for ECS instances, CreateInstance blocks non-compliant tags during creation, and TagResources blocks them during tag attachment.

^②The strong validation feature for pre-emptive blocking must be manually enabled. Strong validation feature.