Tag-based access control
Tags are key-value pairs that can be attached to organizations, folders, or projects. They are an IAM construct and differ from labels and network tags. Tags follow an inheritance model, where a tag applied at the organization level is inherited by child objects, but this inheritance can be overridden if needed. Conditional IAM roles can be granted based on specific tags assigned to a resource.
In the resource hierarchy, tags are automatically inherited, but you can attach an additional tag to a resource to prevent it from inheriting a specific tag value. Essentially, each tag on an organization or folder sets a default value, which can be overridden by tags on lower-level resources such as folders or projects. Once tags are attached to a resource, you can define conditions to grant access based on those tags.
Tag structure
Here are how tags are structured in IAM:
- A tag is a key and value pair.
- A permanent ID, which is globally unique and...