Create and manage tags

This guide describes how to create and manage tags on Cloud KMS key rings. Tags are key-value pairs that are attached to an organization, folder, or project. You can use tags to group related Cloud KMS key rings and store metadata about those resources based on their tags. See Tags overview for more information on resource hierarchy and tag inheritance.

Labels will continue to be used as is for the purposes of extensibility and automation.

Before you begin

Using tags requires the following resources and permissions:

Create tag keys and values

Before you can attach a tag, you need to create a tag and configure its value. To create tag keys and tag values, refer to Creating a tag and Adding a tag value.

Attach a tag to a key ring

After the tag has been created, you need to attach it to a key ring. Tags are attached by creating a tag binding resource that links the value to the key ring.

Console

  1. Go to the Cryptographic Key Rings page in the Cloud Console.

    Go to the Cryptographic Key Rings page

  2. Select the key ring for which you would like to attach a tag.

  3. Click Show info panel and then click the Tags tab.

  4. In the Tags tab, select Add tag bindings.

  5. Enter the Tag value for the tag you would like to add. The Tag value is of the form: ORGANIZATION_ID/TAGKEY_SHORTNAME, ORGANIZATION_ID/TAGKEY_SHORTNAME/TAGVALUE_SHORTNAME, or the permanent ID or namespaced name of the tag value to be attached; for example: tagValues/4567890123. See the following Tag value components for more information.

  6. Click Save bindings to attach the tag.

When the tag is added, its value is shown in the Tags column of the key ring as well as the Bound Tags section in the info panel.

Tag value components:

  • ORGANIZATION_ID is the ID of the organization to be the parent resource to this tag key; for example: 12345678901. To learn how to get your organization ID, see Creating and managing organizations.

  • TAGKEY_SHORTNAME is the display name for your tag key.

  • TAGVALUE_SHORTNAME is the short name for your tag value.

gcloud

To attach a tag to a key ring, you must create a tag binding resource by using the gcloud alpha resource-manager tags bindings create command:

gcloud alpha resource-manager tags bindings create \
--tag-value=TAGVALUE_NAME \
--parent=KEY_RING_RESOURCE_ID
--location=LOCATION

Where:

  • TAGVALUE_NAME is the permanent ID or namespaced name of the tag value to be attached; for example: tagValues/4567890123.

  • RESOURCE_ID is the full ID of the key ring, including the API domain name to idenitfy the type of resource (//cloudkms.googleapis.com/). For example, to attach a tag to projects/7890123456, the full ID is: //cloudkms.googleapis.com/projects/7890123456/locations/LOCATION/keyRings/KEY_RING_NAME

  • LOCATION is the location of your resource. If you are attaching a tag to a global resource, such as a folder or a project, you should omit this flag. If you are attaching a tag to a regional resource, you must specify the location; for example: us-central1.

For help with locating a Cloud KMS resource ID, see Retrieving a resource's ID.

List tags attached to a key ring

The following examples provide a list of tag bindings attached directly to the key ring, but won't return any tags that have been inherited from parent resources.

Console

  1. Go to the Cryptographic Key Rings page in the Cloud Console.

    Go to the Cryptographic Key Rings page

  2. Tags attached to a key ring are displayed in the Tags column for the associated key ring.

Alternatively, tags are also listed in the Bound Tags section of the info panel for the key ring.

gcloud

To get a list of tag bindings attached to a resource, use the gcloud alpha resource-manager tags bindings list command:

gcloud alpha resource-manager tags bindings list \
    --parent=RESOURCE_ID \
    --location=LOCATION

Where:

  • RESOURCE_ID is the full ID of the resource; for example: //cloudkms.googleapis.com/projects/7890123456/locations/LOCATION/keyRings/KEY_RING_NAME

  • LOCATION is the location of your resource. If you are attaching a tag to a global resource, such as a folder or a project, you should omit this flag. If you are attaching a tag to a regional resource, you must specify the location; for example: us-central1.

You should get a response similar to the following:

name: tagBindings/%2F%2Fcloudresourcemanager.googleapis.com%2Fprojects%2F7890123456/tagValues/567890123456
tagValue: tagValues/567890123456
resource: //cloudkms.googleapis.com/projects/7890123456/

Detach tags from a key ring

You can detach a tag from a resource by deleting the tag binding resource. If you need to delete a tag, you must first detach the tag.

Console

  1. Go to the Cryptographic Key Rings page in the Cloud Console.

    Go to the Cryptographic Key Rings page

  2. Select the key ring for which you would like remove the tag.

  3. Click Show info panel and then click the Tags tab.

  4. In the Tags tab, select Remove tag bindings.

  5. Select the tag to be removed from the Bound Tags list.

  6. Click Remove Selected Bindings to remove the tag.

gcloud

To delete a tag binding, use the gcloud alpha resource-manager tags bindings delete command:

gcloud alpha resource-manager tags bindings delete \
--tag-value=TAGVALUE_NAME \
--parent=RESOURCE_ID \
--location=LOCATION

Where:

  • TAGVALUE_NAME is the permanent ID or namespaced name of the tag value that is attached; for example: tagValues/567890123456.

  • RESOURCE_ID is the full ID of the resource; for example: //cloudkms.googleapis.com/projects/7890123456/locations/LOCATION/keyRings/KEY_RING_NAME

  • LOCATION is the location of your resource. If you are attaching a tag to a global resource, such as a folder or a project, you should omit this flag. If you are attaching a tag to a regional resource, you must specify the location; for example: us-central1

Delete tag keys and values

When removing a tag key or value definition, ensure the tag is detached from the key ring. You must delete existing tag attachments, called tag bindings, before deleting the tag definition itself. To delete tag keys and tag values, refer to Deleting tags.

What's next