启用标签策略

启用方式

标签策略支持当前账号标签策略和资源目录标签策略两种。您可以根据实际的使用场景和当前登录的账号类型，启用对应的标签策略。具体如下表所示。

RAM权限

推荐您使用RAM用户启用标签策略。具体如下：

• 当前账号标签策略：为阿里云账号（主账号）下的RAM用户授予以下自定义权限策略。

  {
      "Version": "1",
      "Statement": [
          {
              "Action": [
                "tag:GetConfigRuleReport",
                "tag:GenerateConfigRuleReport",
                "tag:GetEffectivePolicy",
                "tag:ListConfigRulesForTarget",
                "tag:ListPoliciesForTarget",
                "tag:ListTargetsForPolicy",
                "tag:ListPolicies",
                "tag:GetPolicy",
                "tag:GetPolicyEnableStatus",
                "tag:DetachPolicy",
                "tag:DeletePolicy",
                "tag:ModifyPolicy",
                "tag:AttachPolicy",
                "tag:CreatePolicy",
                "tag:DisablePolicyType",
                "tag:EnablePolicyType",
                "tag:ListSupportResourceTypes"
              ],
              "Resource": "*",
              "Effect": "Allow"
          },
          {
              "Action": [
                  "rd:ListAccountsForParent",
                  "rd:ListFoldersForParent",
                  "rd:GetResourceDirectory",
                  "config:GetAggregateResourceComplianceByConfigRule",
                  "config:ListAggregateConfigRuleEvaluationResults",
                  "config:GetAggregateConfigRulesReport",
                  "config:GetResourceComplianceGroupByRegion",
                  "config:ListConfigRuleEvaluationResults",
                  "config:GetConfigRulesReport",
                  "config:ListRemediations",
                  "oos:ListExecutions"
              ],
              "Resource": "*",
              "Effect": "Allow"
          },
          {
              "Action": "ram:CreateServiceLinkedRole",
              "Resource": "*",
              "Effect": "Allow",
              "Condition": {
                "StringEquals": {
                  "ram:ServiceName": "tag.aliyuncs.com"
                 }
              }
          }
      ]
  }

• 资源目录标签策略：为资源目录管理账号下的RAM用户先授予资源目录管理权限（AliyunResourceDirectoryFullAccess），然后再授予上述的自定义权限策略。

具体操作，请参见创建自定义权限策略和为RAM用户授权。