Working with tags

Creating access management tags in the console

Before you can attach your access management tags to individual resources or service IDs, you need to create them first. To create access management tags, you must have the administrator role on either the Tagging Service or on All Account management services.

IBM Cloud® allows up to 250 access management tags per account.

1. Go to Manage > Account in the IBM Cloud® console, and select Tags.
2. Click Access management tags.
3. Type the names of your tags, and click Create Tags. These tags are now ready to be attached to resources or service IDs, and to scope access policies.

Next, see Attaching and detaching tags. For a full tutorial, see Controlling access to resources by using tags.

Creating access management tags by using the CLI

Before you can attach your access management tags to individual resources or service IDs, you need to create them first. To create access management tags, you need to have administrator role on either the Tagging Service that is listed under the Account management services or on all Account management services.

IBM Cloud® allows up to 250 access management tags per account.

1. Log in to IBM Cloud CLI. If you have multiple accounts, you are prompted to select which account to use. If you do not specify a region with the -r flag, you must also select a region.

   ibmcloud login
   

   If your credentials are rejected, you might be using a federated ID. To log in with a federated ID, use the --sso flag. See Logging in with a federated ID for more details.

   If it's your first time using the IBM Cloud CLI, check out the getting started tutorial.

2. Enter the ibmcloud resource tag-create command to create an access management tag in your account. This example creates a tag that is called project:myproject:

   ibmcloud resource tag-create --tag-names project:myproject
   

For more information, see the ibmcloud resource command reference.

Next, see Attaching and detaching tags.

Creating access management tags by using the API

Before you can attach your access management tags to individual resources or service IDs, you need to create them first. To create access management tags, you need to have administrator role on either the Tagging Service that is listed under the Account management services or on all Account management services.

IBM Cloud® allows up to 250 access management tags per account.

You can programmatically create access management tags by calling the Global Search and Tagging - Tagging API as shown in the following sample request. The example creates a tag that is called project:myproject.

curl -X POST -H "Authorization: {iam_token}" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-d '{ "tag_names": ["project:myproject"] }' \
"tags.global-search-tagging.cloud.ibm.com/v3/tags?tag_type=access"

CreateTagOptions createTagOptions = new CreateTagOptions.Builder()
    .addTagNames("project:myproject")
    .tagType("access")
    .build();

Response<CreateTagResults> response = service.createTag(createTagOptions).execute();
CreateTagResults createTagResults = response.getResult();
System.out.println(createTagResults);

const params = {
  tagNames: ['project:myproject'],
  tagType: 'access',
};

globalTaggingService.createTag(params)
  .then(res => {
    console.log(JSON.stringify(res.result, null, 2));
  })
  .catch(err => {
    console.warn(err)
  });

create_tag_results = global_tagging_service.create_tag(
  tag_names=['project:myproject'],
  tag_type='access').get_result()

print(json.dumps(create_tag_results, indent=2))

createTagOptions := globalTaggingService.NewCreateTagOptions(
  []string{"project:myproject"},
)
createTagOptions.SetTagType("access")

createTagResults, response, err := globalTaggingService.CreateTag(createTagOptions)
if err != nil {
  panic(err)
}
b, _ := json.MarshalIndent(createTagResults, "", "  ")
fmt.Println(string(b))

Next, see Attaching and detaching tags.

Creating access management tags by using Terraform

Before you can create access management tags by using Terraform, make sure that you have completed the following:

• Install the Terraform CLI and configure the IBM Cloud Provider plug-in for Terraform. For more information, see the tutorial for Getting started with Terraform on IBM Cloud®. The plug-in abstracts the IBM Cloud APIs that are used to complete this task.
• Create a Terraform configuration file that is named main.tf. In this file, you define resources by using HashiCorp Configuration Language. For more information, see the Terraform documentation.
• Before you can attach your access management tags to individual resources or service IDs, you need to create them first. To create access management tags, you need to have administrator role on either the Tagging Service that is listed under the Account management services or on all Account management services.

IBM Cloud® allows up to 250 access management tags per account.

Use the following steps to create access management tags by using Terraform:

1. Create an argument in your main.tf file. The following example creates the access management tag ibm_tag to the ibm resource for the resource ID ibm_satellite_location.location.crn.

   resource "ibm_resource" "ibm" {
   resource_id = ibm_satellite_location.location.crn
   tags        = [ "ibm_tag" ]
   }
   

2. After you finish building your configuration file, initialize the Terraform CLI. For more information, see Initializing Working Directories.

   terraform init
   

3. Provision the resources from the main.tf file. For more information, see Provisioning Infrastructure with Terraform.

   1. Run terraform plan to generate a Terraform execution plan to preview the proposed actions.

      terraform plan
      

   2. Run terraform apply to create the resources that are defined in the plan.

      terraform apply