태그는 세분화된 액세스 제어를 위해 서비스에 적용할 수 있는 키-값 쌍입니다. 태그 관리자는 조직 또는 프로젝트 수준에서Google Cloud 간에 리소스 태그를 만들고 Resource Manager에서 이러한 태그를 관리합니다.
태그를 사용하면 리소스에 특정 태그가 있는지 여부에 따라 조건부로 정책을 허용하거나 거부할 수 있습니다.
Cloud Run 서비스에 연결된 태그를 특정 Cloud Run 버전으로 트래픽을 라우팅할 수 있는 Cloud Run 트래픽 태그와 혼동해서는 안 됩니다.
필요한 역할
태그를 연결하거나 분리하는 데 필요한 권한을 얻으려면 관리자에게 Cloud Run 서비스에 대한 다음 IAM 역할을 부여해 달라고 요청하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-08-23(UTC)"],[],[],null,["# Tag services\n\nTags are key-value pairs you can apply to your services for fine-grained access\ncontrol. Tag administrators create tags for resources across\nGoogle Cloud at the organization or project level and manage them in\n[Resource Manager](/resource-manager/docs/tags/tags-creating-and-managing).\nTags provides a way to conditionally allow or deny\npolicies based on whether a resource has a specific tag.\n\nTags *attached* to Cloud Run services should not be confused\nwith Cloud Run [traffic tags](/run/docs/rollouts-rollbacks-traffic-migration#tags)\nthat allow to route traffic to specific Cloud Run revisions.\n| **Note:** In contrast to tags, [labels](/run/docs/configuring/services/labels) are used to identify resources for billing-related reasons, filtering logs, and so forth.\n\nRequired roles\n--------------\n\n\nTo get the permissions that\nyou need to attach or detach tags,\n\nask your administrator to grant you the\nfollowing IAM roles on the Cloud Run service:\n\n- [Cloud Run Admin](/iam/docs/roles-permissions/run#run.admin) (`roles/run.admin`)\n- [Tag User](/iam/docs/roles-permissions/resourcemanager#resourcemanager.tagUser) (`roles/resourcemanager.tagUser`)\n\n\nTo manage access on the tag value resource in Resource Manager, your\naccount must also have the\n[Tag User](/iam/docs/understanding-roles#resourcemanager.tagUser) (`roles/resourcemanager.tagUser`) role\n[granted for the tag value](/resource-manager/docs/tags/tags-creating-and-managing#managing_access).\nThe tag value is the resource that is attached to the Cloud Run\nservice.\n\nFor a list of IAM roles and permissions that are associated with\nCloud Run, see\n[Cloud Run IAM roles](/run/docs/reference/iam/roles)\nand [Cloud Run IAM permissions](/run/docs/reference/iam/permissions).\nIf your Cloud Run service interfaces with\nGoogle Cloud APIs, such as Cloud Client Libraries, see the\n[service identity configuration guide](/run/docs/configuring/services/service-identity).\nFor more information about granting roles, see\n[deployment permissions](/run/docs/reference/iam/roles#additional-configuration)\nand [manage access](/iam/docs/granting-changing-revoking-access).\n\nAttaching tags\n--------------\n\nNote that attaching a tag to your service *does not* result in the creation\nof a new revision.\n\nYou can attach or detach tags using the Google Cloud console or the gcloud\ncommand line. \n\n### Console\n\n1. [Go to Cloud Run](https://console.cloud.google.com/run)\n\n2. Check the checkbox at the left of the service you are setting the tag\n on.\n\n3. Click **Tags** above the services list to display the tags pane.\n\n4. If your organization doesn't appear in the **Tags** panel, click\n **Select scope** . Select your organization and click\n **Open**.\n\n5. To attach a new tag to the service, click **Add Tag** and select one of the\n tag keys in the key dropdown menu, and select a value from the\n value dropdown menu.\n\n6. Click **Save** then confirm your changes if prompted.\n\n### gcloud\n\nYou can update tags for a service using the command: \n\n```bash\ngcloud resource-manager tags bindings create \\\n --tag-value=TAG_VALUE \\\n --parent=//run.googleapis.com/projects/PROJECT_ID/locations/REGION/services/SERVICE \\\n --location=REGION\n```\n\nTo update more than one tag, supply a comma delimited list of key/value\npairs.\n\nReplace\n\n- \u003cvar translate=\"no\"\u003eTAG_VALUE\u003c/var\u003e with the value for the key: you can use these different types of identifiers: a permanent ID such as `tagValues/12345678901`, a namespaced value such as `123456789012/env/prod` or a short name such as `prod`\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with project ID of your Google Cloud project\n- \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e with region your Cloud Run service is deployed to\n- \u003cvar translate=\"no\"\u003eSERVICE\u003c/var\u003e with name of your Cloud Run service\n\nDetaching a tag\n---------------\n\nYou can use the console or the command line to detach tags from your service. \n\n### Console\n\n1. [Go to Cloud Run](https://console.cloud.google.com/run)\n\n2. Check the checkbox at the left of the service you are detaching the tag\n from.\n\n3. Click **Tags** above the services list to display the tags pane.\n\n4. Locate the tag you want to detach.\n\n5. Hover your cursor to the right of the *Value* dropdown menu for the tag to\n display the trash icon, and click the trash icon.\n\n6. Click **Save** and confirm your changes if prompted.\n\n### gcloud\n\nTo detach a tag from a service: \n\n```bash\ngcloud resource-manager tags bindings delete \\\n --tag-value=TAG_VALUE \\\n --parent=//run.googleapis.com/projects/PROJECT_ID/locations/REGION/services/SERVICE \\\n --location=REGION\n```\n\nTo detach more than one tag, supply a comma delimited list of key/value\npairs.\n\nReplace\n\n- \u003cvar translate=\"no\"\u003eTAG_VALUE\u003c/var\u003e with the value for the key: you can use these different types of identifiers: a permanent ID such as `tagValues/12345678901`, a namespaced value such as `123456789012/env/prod` or a short name such as `prod`\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with project ID of your Google Cloud project\n- \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e with region your Cloud Run service is deployed to\n- \u003cvar translate=\"no\"\u003eSERVICE\u003c/var\u003e with name of your Cloud Run service"]]
