Manage tags for resources

Console

Depending on the resource type, the exact steps might vary. For example, the following steps attach a tag to a VM:

1. In the Trusted Cloud console, go to the VM instances page.

   Go to VM instances

2. Select your project and click Continue.

3. In the Name column, click the name of the VM for which you want to add tags.

4. From the VM instance details page, complete the following steps:

   1. Click Edit.
   2. In the Basic information section, click Manage tags and add the tags that you want for the instance.
   3. Click Save.

gcloud

For information about how to use these flags, read Attaching tags to resources in the Resource Manager documentation.

For example, the following command attaches a tag to a VM:

gcloud resource-manager tags bindings create \
    --location LOCATION_NAME \
    --tag-value=tagValues/TAGVALUE_ID \
    --parent=//compute.googleapis.com/projects/PROJECT_NUMBER/zones/ZONE/instances/VM_ID

Replace the following:

• LOCATION_NAME: the region that contains the target resource; in this example, the region of the VM instance
• TAGVALUE_ID: the numeric ID of the tag value
• PROJECT_NUMBER: the numeric ID of your project that contains the target resource
• ZONE: the zone that contains the target resource; in this example, the zone of the VM instance
• VM_ID: the VM instance ID

REST

To attach a tag to a resource, you must first create a JSON representation of a tag binding that includes the permanent ID or namespace name of the tag value and the permanent ID of the resource. For more information about the format of a tag binding, see the tagBindings reference.

To attach the tag to a zonal resource, such as a VM instance, use the tagBindings.create method with the regional endpoint where your resource is located. For example:

POST https://LOCATION_NAME-cloudresourcemanager.googleapis.com/v3/tagBindings

The request body can be one of the following two options:

{
  "parent": "//compute.googleapis.com/projects/PROJECT_NUMBER/zones/ZONE/instances/VM_ID",
  "tagValue": "tagValue/TAGVALUE_ID"
}

{
  "parent": "//compute.googleapis.com/projects/PROJECT_NUMBER/zones/ZONE/instances/VM_ID",
  "tagValueNamespacedName": TAGVALUE_NAMESPACED_NAME
}

Replace the following:

• LOCATION_NAME: the region that contains the target resource; in this example, the region of the VM instance
• PROJECT_NUMBER: the numeric ID of your project that contains the target resource
• ZONE: the zone that contains the target resource; in this example, the zone of the VM instance
• VM_ID: the VM instance ID
• TAGVALUE_ID: the permanent ID of the tag value that is attached—for example: 4567890123
• TAGVALUE_NAMESPACED_NAME: the namespace name of the tag value that is attached and is of the format: parentNamespace/tagKeyShortName/tagValueShortName

Console

Depending on the resource type, the exact steps might vary. The following steps are for a VM:

1. In the Trusted Cloud console, go to the VM instances page.

   Go to VM instances

2. Select your project and click Continue.

3. Click Create instance. The Create an instance page appears and displays the Machine configuration pane.

4. In the navigation menu, click Advanced. In the Advanced pane that appears, do the following:

   1. Expand the expand_moreManage tags and labels section.
   2. Click addAdd tags.
   3. In the Tags pane that opens, follow the instructions to add a tag to the instance.
   4. Click Save.

5. Specify other configuration options for your instance. For more information, see Configuration options during instance creation.

6. To create and start the VM, click Create.

gcloud

To attach a tag to a resource during resource creation, add the --resource-manager-tags flag with the respective create command. For example, to attach a tag to a VM, use the following command:

  gcloud compute instances create INSTANCE_NAME \
      --zone=ZONE \
      --resource-manager-tags=tagKeys/TAGKEY_ID=tagValues/TAGVALUE_ID

Replace the following:

• INSTANCE_NAME: the name of your VM instance
• ZONE: the zone that contains the VM instance
• TAGKEY_ID: the tag key number numeric ID
• TAGVALUE_ID: the permanent numeric ID of the tag value that is attached—for example: 4567890123

Specify multiple tags by separating the tags with a comma, for example, TAGKEY1=TAGVALUE1,TAGKEY2=TAGVALUE2.

REST

Make a POST request to the following URL:

POST https://compute.googleapis.com/compute/v1/projects/PROJECT/zones/ZONE/instances

Include the following request JSON body:

{
  "name": INSTANCE_NAME,
  "params": {
    "resourceManagerTags": {
      "tagKeys/TAGKEY_ID": "tagValues/TAGVALUE_ID",
    },
  }
  // other fields omitted
}

Replace the following:

• INSTANCE_NAME: the name of your VM instance
• TAGKEY_ID: the tag key number numeric ID
• TAGVALUE_ID: the permanent numeric ID of the tag value that is attached—for example: 4567890123

Console

Depending on the resource type, the exact steps might be a bit different. For example, the following steps detaches a tag from a VM:

1. In the Trusted Cloud console, go to the VM instances page.

   Go to VM instances

2. Select your project and click Continue.

3. In the Name column, click the name of the instance for which you want to remove tags.

4. From the VM instance details page, complete the following steps:

   1. Click Edit.
   2. For resource manager tags, in the Basic information section, click Manage Tags. Remove the tags that you want for the instance. You can only remove tags that were directly added to the instance.
   3. For network tags, in the Networking section, remove the tag from the Network tags list.
   4. Click Save.

gcloud

To detach a tag from a compute instance, use the resource-manager tags bindings delete command:

gcloud resource-manager tags bindings delete \
    --location LOCATION_NAME \
    --tag-value=tagValues/TAGVALUE_ID \
    --parent //compute.googleapis.com/projects/PROJECT_NUMBER/zones/ZONE/instances/INSTANCE_ID

Replace the following:

• LOCATION_NAME: the zone of the target resource, such as us-central1-a
• TAGVALUE_ID: the numeric ID of the Tag key
• PROJECT_NUMBER: the numeric ID of your project that contains the target resource
• ZONE: the zone name such as us-central1-a
• INSTANCE_ID: the numeric ID of the compute instance

To update or replace an existing tag binding to another one, detach the old tag binding and attach the new one.

REST

To delete a tag binding attached to a resource, such as a compute instance, use the tagBindings.delete method with the regional endpoint where your resource is located.

DELETE https://LOCATION-cloudresourcemanager.googleapis.com/v3/{name=TAGBINDINGS_NAME}

Replace the following:

• LOCATION: the regional endpoint for your resource—for example, us-central1
• TAGBINDINGS_NAME: the permanent ID of the TagBinding; for example: tagBindings/%2F%2Fcloudresourcemanager.googleapis.com%2Fprojects%2F1234567890/tagValues/567890123456

Console

Depending on the resource type, the exact steps might be a bit different. For example, the following steps show how to view tags for a VM:

1. In the Trusted Cloud console, go to the VM instances page.

   Go to VM instances

2. Select your project and click Continue.

3. In the Name column, click the name of the VM for which you want to view tags.

4. From the VM instance details page, look for tags under the Tags section.

gcloud

To get a list of tag bindings directly attached to a resource, use the gcloud resource-manager tags bindings list command. If you add the --effective flag, you will also return a list of tags inherited by this resource. For example:

gcloud resource-manager tags bindings list \
    --location=LOCATION_NAME \
    --parent //compute.googleapis.com/projects/PROJECT_NUMBER/zones/ZONE/instances/VM_ID

Replace the following:

• LOCATION_NAME: the zone of the target resource, such as us-central1-a
• PROJECT_NUMBER: the numeric ID of your project that contains the target resource
• ZONE: the zone name such as us-central1-a
• VM_ID: the numeric ID of the VM instance

If you add the --effective flag to the tags bindings list command, you also return a list of all tags inherited by this resource.

The output is similar to the following:

namespacedTagKey: 961309089256/environment
namespacedTagValue: 961309089256/environment/production
tagKey: tagKeys/417628178507
tagValue: tagValues/247197504380
inherited: true

If all tags evaluated on a resource are directly attached, the inherited field is false and is omitted.

REST

To list the tag bindings attached to a regional resource, such as Compute Engine instances, use the tagBindings.list method with the regional endpoint where your resource is located. For example:

GET https://LOCATION_NAME-cloudresourcemanager.googleapis.com/v3/tagBindings

{
    "parent": "//compute.googleapis.com/projects/PROJECT_NUMBER/zones/ZONE/instances/VM_ID"
}

Replace the following:

• LOCATION_NAME: the region to of the target resource, such as us-central1
• PROJECT_NUMBER: the numeric ID of your project that contains the target resource
• ZONE: the zone name such as us-central1-a
• VM_ID: the numeric ID of the VM instance