Create and manage tags for regional secrets

This guide describes how to create and manage tags on regional secrets. You can use tags to group related Secret Manager secrets and store metadata about those resources based on their tags.

About tags

A tag is a key-value pair that can attach to a resource within Google Cloud. You can use tags to conditionally allow or deny policies based on whether a resource has a specific tag. For example, you can conditionally grant Identity and Access Management (IAM) roles based on whether a resource has a specific tag. For more information about tags, see Tags overview.

Tags are attached to resources by creating a tag binding resource that links the value to the Google Cloud resource.

Required permissions

To get the permissions that you need to manage tags, ask your administrator to grant you the following IAM roles:

  • Tag Viewer (roles/resourcemanager.tagViewer) on the resources the tags are attached to
  • View and manage tags at the organization level: Organization Viewer (roles/resourcemanager.organizationViewer) on the organization
  • Create, update, and delete tag definitions: Tag Administrator (roles/resourcemanager.tagAdmin) on the resource you're creating, updating, or deleting tags for
  • Attach and remove tags from resources: Tag User (roles/resourcemanager.tagUser) on the tag value and the resources that you are attaching or removing the tag value to

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

To attach tags to Secret Manager secrets, you need the Secret Manager Admin role (roles/secretmanager.admin).

Create tag keys and values

Before you can attach a tag, you need to create a tag and configure its value. To create tag keys and tag values, see Creating a tag and Adding a tag value.

Add tags during resource creation

You can add tags at the time of creating regional secrets. Adding tags during resource creation, lets you instantly provide essential metadata for your resources and also helps with better organization, cost tracking, and automated policy application.

Console

  1. Go to the Secret Manager page in the Google Cloud console.

    2. Go to Secret Manager

  2. On the Secret Manager page, click the Regional secrets tab.
  3. Select the option to create a new regional secret.
  4. Click Manage tags.
  5. If your organization doesn't appear in the Manage tags panel, click Select scope. Choose to add tags defined either at your organization or project level, and then enter the ID for the same.
  6. Click Add tag.
  7. Select the key for the tag you want to attach from the list. You can filter the list by typing keywords.
  8. Select the value for the tag you want to attach from the list. You can filter the list by typing keywords.
  9. Click Save. The Tags section is updated with the tags information.
  10. Create your regional secret. The new regional secret is created with the provided tags.

gcloud

To add tags during regional secret creation, run the following command:

       gcloud secrets create SECRET_ID --location=LOCATION --tags=TAG_KEY=TAG_VALUE

Replace the following:

  • SECRET_ID: the unique identifier of the secret
  • LOCATION: the location of the secret
  • TAG_KEY: the permanent ID or namespaced name of the tag key that is attached-for example, tagKeys/567890123456
  • TAG_VALUE: the permanent ID or namespaced name of the tag value that is attached—for example, tagValues/567890123456

Specify multiple tags by separating the tags with a comma, for example, TAGKEY1=TAGVALUE1,TAGKEY2=TAGVALUE2

API

Send a POST request to the following URL:

      https://secretmanager.LOCATION.rep.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/secrets?secretId=SECRET_ID

Provide the following JSON in the request body:

      
{"tags": {"TAGKEY_NAME": "TAGVALUE_NAME"}}

Replace the following:

  • LOCATION: the location of the secret
  • PROJECT_ID: the ID of the project
  • SECRET_ID: the unique identifier of the secret
  • TAGKEY_NAME: the permanent ID or namespaced name of the tag key that is attached-for example, tagKeys/567890123456
  • TAGVALUE_NAME: the permanent ID or namespaced name of the tag value that is attached—for example, tagValues/567890123456

Add tags to existing resources

To add a tag to existing regional secrets, follow these steps:

Console

  1. Go to the Secret Manager page in the Google Cloud console.

    2. Go to Secret Manager

  2. Select the regional secret for which you would like to attach a tag.
  3. Click Tags.
  4. If your organization doesn't appear in the Tags panel, click Select scope. Select your organization and click Open.
  5. Click Add tag.
  6. Select the key for the tag you want to attach from the list. You can filter the list by typing keywords.
  7. Select the value for the tag you want to attach from the list. You can filter the list by typing keywords.
  8. Click Save.
  9. In the Confirm dialog, click Confirm to attach the tag.

    10. A notification confirms that your tags updated.

gcloud

To attach a tag to a regional secret, you must create a tag binding resource by using the gcloud resource-manager tags bindings create command:

      gcloud resource-manager tags bindings create \
          --tag-value=TAGVALUE_NAME \
          --parent=RESOURCE_ID \
          --location=LOCATION

Replace the following:

  • TAGVALUE_NAME: the permanent ID or namespaced name of the tag value that is attached—for example, tagValues/567890123456.
  • RESOURCE_ID is the full ID of the resource, including the API domain name to identify the type of resource (//secretmanager.googleapis.com/). For example, to attach a tag to projects/PROJECT_ID/locations/LOCATION/secrets/SECRET_ID, the full ID is //secretmanager.googleapis.com/projects/PROJECT_ID/locations/LOCATION/secrets/SECRET_ID.
  • LOCATION: the location of your resource. If you're attaching a tag to a global resource, such as a folder or a project, omit this flag. If you're attaching a tag to a regional or a zonal resource, you must specify the location—for example, us-central1 (region) or us-central1-a (zone).

List tags attached to resources

You can view a list of tag bindings directly attached to or inherited by the regional secret.

Console

  1. Go to the Secret Manager page in the Google Cloud console.

    2. Go to Secret Manager

  2. Tags are displayed in the Tags column of the regional secret.

gcloud

To get a list of tag bindings attached to a resource, use the gcloud resource-manager tags bindings list command:

      gcloud resource-manager tags bindings list \
          --parent=RESOURCE_ID \
          --location=LOCATION

Replace the following:

  • RESOURCE_ID is the full ID of the resource, including the API domain name to identify the type of resource (//secretmanager.googleapis.com/). For example, to attach a tag to projects/PROJECT_ID/locations/LOCATION/secrets/SECRET_ID, the full ID is //secretmanager.googleapis.com/projects/PROJECT_ID/locations/LOCATION/secrets/SECRET_ID.
  • LOCATION: the location of your resource. If you're viewing a tag attached to a global resource, such as a folder or a project, omit this flag. If you're viewing a tag attached to a regional or a zonal resource, you must specify the location—for example, us-central1 (region) or us-central1-a (zone).

You should get a response similar to the following:

name: tagBindings/%2F%2Fcloudresourcemanager.googleapis.com%2Fprojects%2F7890123456/tagValues/567890123456
          tagValue: tagValues/567890123456
          resource: //secretmanager.googleapis.com/projects/production-1/locations/us-central1/secrets/database-pwd

Detach tags from resources

You can detach tags that have been directly attached to a regional secret. Inherited tags can be overridden by attaching a tag with the same key and a different value, but they can't be detached.

Console

  1. Go to the Secret Manager page in the Google Cloud console.

    2. Go to Secret Manager

  2. Select the regional secret from which you want to remove a tag.
  3. Click Tags.
  4. In the Tags panel, next to the tag you want to detach, click Delete item.
  5. Click Save.
  6. In the Confirm dialog, click Confirm to detach the tag.

A notification confirms that your tags updated.

gcloud

To delete a tag binding, use the gcloud resource-manager tags bindings delete command:

      gcloud resource-manager tags bindings delete \
          --tag-value=TAGVALUE_NAME \
          --parent=RESOURCE_ID \
          --location=LOCATION

Replace the following:

  • TAGVALUE_NAME: the permanent ID or namespaced name of the tag value that is attached—for example, tagValues/567890123456.
  • RESOURCE_ID is the full ID of the resource, including the API domain name to identify the type of resource (//secretmanager.googleapis.com/). For example, to attach a tag to projects/PROJECT_ID/locations/LOCATION/secrets/SECRET_ID, the full ID is //secretmanager.googleapis.com/projects/PROJECT_ID/locations/LOCATION/secrets/SECRET_ID.
  • LOCATION: the location of your resource. If you're attaching a tag to a global resource, such as a folder or a project, omit this flag. If you're attaching a tag to a regional or a zonal resource, you must specify the location—for example, us-central1 (region) or us-central1-a (zone).

Delete tag keys and values

When removing a tag key or value definition, ensure that the tag is detached from the regional secret. You must delete existing tag attachments, called tag bindings, before deleting the tag definition itself. To delete tag keys and tag values, see Deleting tags.

Identity and Access Management conditions and tags

You can use tags and IAM conditions to conditionally grant role bindings to users in your hierarchy. Changing or deleting the tag attached to a resource can remove user access to that resource if an IAM policy with conditional role bindings has been applied. For more information, see Identity and Access Management conditions and tags.

What's next