セキュアタグは、 Google Cloud 階層内の親リソースから継承されます。この継承により、タグを上位レベル（組織レベルなど）で定義して、フォルダやプロジェクトなどの子リソースに自動的に伝播できるため、管理が簡素化されます。これにより、組織全体で一貫したタグ付けが可能になります。詳細については、タグの継承をご覧ください。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-01 UTC。"],[[["\u003cp\u003eSecure tags on Dataproc clusters enhance security by using IAM-controlled access, unlike network tags, preventing unauthorized modifications to firewall rules.\u003c/p\u003e\n"],["\u003cp\u003eSecure tags simplify firewall management by enabling the efficient grouping and updating of multiple rules across shared networks via network firewall policies, all governed by IAM access controls.\u003c/p\u003e\n"],["\u003cp\u003eSecure tags inherit from parent resources in the Google Cloud hierarchy, allowing for organization-wide consistency in tagging by propagating tags from higher levels to child resources.\u003c/p\u003e\n"],["\u003cp\u003eAttaching secure tags to a Dataproc cluster must be done at the time of cluster creation and requires the \u003ccode\u003eTag Administrator\u003c/code\u003e and \u003ccode\u003eTag Viewer\u003c/code\u003e IAM roles.\u003c/p\u003e\n"],["\u003cp\u003eSecure tags can be utilized to configure cluster networking, including defining firewall rules and conditionally granting or denying IAM roles.\u003c/p\u003e\n"]]],[],null,["This document describes how to create secure tags, attach them to a\nDataproc cluster, and then use the tags to secure cluster networking.\n| **Note:** In this document, [Resource Manager tags](/resource-manager/docs/tags/tags-overview) attached to Dataproc clusters are called `secure tags`.\n\nBenefits of using secure tags\n\nSecure tags have key differences from\n[network tags](/vpc/docs/add-remove-network-tags),\nincluding Identity and Access Management access control, tag inheritance,\nand single VPC network binding, which produce the following key benefits:\n\n\u003cbr /\u003e\n\nEnhanced access control and security Secure tags resolve the security issues inherent with network tags by providing IAM controlled access. Unlike network tags, which can be modified by a user with cluster access, secure tags prevent unauthorized modification of tags and the resulting unwanted changes to firewall rules.\u003cbr /\u003e\n\nUsing secure tags in IAM policies enable\n[conditional access control](/iam/docs/conditions-overview), strengthening\nsecurity by granting or denying roles based on the presence of tags.\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nSimplified firewall management The [global](/firewall/docs/network-firewall-policies) and [regional](/firewall/docs/regional-firewall-policies) network firewall policies support secure tags. This support simplifies firewall management in Dataproc across shared networks.\n\n\u003cbr /\u003e\n\nUnlike VPC firewall rules, network firewall policies that are enhanced by secure\ntags enable efficient grouping and simultaneous updating of multiple rules, all\ngoverned by IAM access controls. Compared to VPC firewall rules\nthat utilize network tags, secure tags provide enhanced security and management\ncapabilities within network firewall policies.\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nHierarchical resource inheritance for efficient management Secure tags inherit from parent resources within the Google Cloud hierarchy. This inheritance simplifies management by letting you define tags at a higher level---for example, at the organization level---so that they automatically propagate to child resources, such as folders and projects. This enables consistent tagging across your organization. For more information, see [Tag inheritance](/resource-manager/docs/tags/tags-overview#inheritance).\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nImproved network management across shared and peered VPCs Network tags identify sources or targets in firewall rules within a specified VPC network. Secure tags, when used to specify a source for an ingress rule in a network firewall policy, identify traffic sources in both the Dataproc cluster VPC network and peered VPC networks. When secure tags are used to specify targets for ingress or egress rules, they identify targets only within their own VPC network.\n\n\u003cbr /\u003e\n\nTo learn more about the differences between Resource Manager tags and network tags,\nsee\n[Comparison of Tags and network tags](/firewall/docs/tags-firewalls-overview#differences).\n\nTo learn more about the differences between Resource Manager tags and labels,\nsee\n[Tags and labels](/resource-manager/docs/tags/tags-overview#tags_and_labels).\n\nLimitations\n\n- You can attach secure tags to a cluster only at the time of cluster creation.\n- Updation and deletion of secure tags aren't supported.\n\nRequired roles\n\n\nTo get the permissions that\nyou need to create and attach secure tags to a Dataproc cluster,\n\nask your administrator to grant you the\nfollowing IAM roles on Resource Manager tags:\n\n- Create tags: [Tag Administrator](/iam/docs/roles-permissions/resourcemanager#resourcemanager.tagAdmin) (`roles/resourcemanager.tagAdmin`)\n- Attach tags to a custer: [Tag Viewer](/iam/docs/roles-permissions/resourcemanager#resourcemanager.tagViewer) (`roles/resourcemanager.tagViewer`)\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nCreate a secure tag\n\nTo attach a secure tag to a Dataproc cluster, you must first\n[create a Resource Manager tag](/resource-manager/docs/tags/tags-creating-and-managing#creating)\nwith a specified key and one or more values.\n\nAttach secure tags to the Dataproc cluster\n\nCreate a Dataproc cluster, specifying the secure tag\n\u003cvar translate=\"no\"\u003eTAG_KEY\u003c/var\u003e`:`\u003cvar translate=\"no\"\u003eTAG_VALUE\u003c/var\u003e pair. \n\nGoogle Cloud CLI\n\nTo create a Dataproc cluster and add a secure tag to the\ncluster, run the\n[gcloud Dataproc clusters create](/sdk/gcloud/reference/dataproc/clusters/create)\ncommand with the `--resource-manager-tags` flag. \n\n gcloud dataproc clusters create \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --region \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e \\\n --resource-manager-tags=\u003cvar translate=\"no\"\u003eTAG_KEY\u003c/var\u003e=\u003cvar translate=\"no\"\u003eTAG_VALUE\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e: the name of the new cluster.\n\n- \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e: the\n [Compute Engine region](/compute/docs/regions-zones#available)\n in which to locate the cluster.\n\n- \u003cvar translate=\"no\"\u003eTAG_KEY\u003c/var\u003e and \u003cvar translate=\"no\"\u003eTAG_VALUE\u003c/var\u003e: the key and a value of\n the [Resource Manager tag that you created](#create-a-secure-tag).\n You can specify a comma-separated list to attach multiple secure\n tags comprised of the same key with different values, or different keys\n and values.\n\nREST\n\nTo create a Dataproc cluster and add a secure tag to the\ncluster, include the\n[`resourceManagerTags`](/dataproc/docs/reference/rest/v1/ClusterConfig#GceClusterConfig.FIELDS.resource_manager_tags)\nfield as part of a\n[clusters.create](/dataproc/docs/reference/rest/v1/projects.regions.clusters/create)\nrequest.\n\nThe following is an sample JSON body of a `cluster.create` request that\nincludes attaching a `\"`\u003cvar translate=\"no\"\u003eTAG_KEY\u003c/var\u003e`\":\"`\u003cvar translate=\"no\"\u003eTAG_VALUE\u003c/var\u003e`\"`\nsecure tag to the cluster: \n\n {\n \"clusterName\": \"\u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e\",\n \"config\": {\n \"gceClusterConfig\": {\n \"resourceManagerTags\": {\n \"\u003cvar translate=\"no\"\u003eTAG_KEY\u003c/var\u003e\": \"\u003cvar translate=\"no\"\u003eTAG_VALUE\u003c/var\u003e\"\n }\n }\n }\n }\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: your project ID that is listed in the\n **Project info** section in the Google Cloud console\n [Dashboard](https://console.cloud.google.com/home/dashboard).\n\n- \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e: the name of the new cluster.\n\n- \u003cvar translate=\"no\"\u003eTAG_KEY\u003c/var\u003e and \u003cvar translate=\"no\"\u003eTAG_VALUE\u003c/var\u003e: the key and a value of\n the [Resource Manager tag that you created](#create-a-secure-tag).\n You can specify multiple secure tags comprised of the same key with\n different values or different keys and values.\n\nUse secure tags for cluster networking\n\nAfter attaching secure tags to a cluster, use secure tags to configure\ncluster networking:\n\n- Use secure tags to [define firewall rules](/dataproc/docs/concepts/configuring-clusters/network#firewall_requirements).\n- Use secure tags to [conditionally grant or deny](/iam/docs/conditions-overview) the IAM [Tag Administrator TAG viewer roles](#required-roles) needed to create and attach secure tags to a cluster.\n\nWhat's next\n\n- Learn more about [tags](/resource-manager/docs/tags/tags-overview).\n- Learn more about [network tags](/vpc/docs/add-remove-network-tags)."]]
