Control: 3.2 Ensure default tags are used on resources
Description
Using default tags is a way to ensure all resources that support tags are tagged during creation. Tags can be based on static values or based on computed values. It is recommended to setup default tags early on to ensure all created resources will get tagged. Tags are scoped to Compartments and are inherited by Child Compartments. The recommendation is to create default tags like “CreatedBy” at the Root Compartment level to ensure all resources get tagged. When using Tags it is important to ensure that Tag Namespaces are protected by IAM Policies otherwise this will allow users to change tags or tag values. Depending on the age of the OCI Tenancy there may already be Tag defaults setup at the Root Level and no need for further action to implement this action.
Remediation
From Console
- Go to the Tag Namespaces page.
- Select the Root
compartment
. - Click
Create Namespace Definition
. - Create the
Namespace
in theRoot Compartment
. - Click on the newly created
Namespace definition
. - Click
Create Tag Key Definition
. Create a Tag key definition by providing aTag Key
,Description
and selecting“Static Value”
forTag Value Type
. - Go to the Compartments page.
- Select the
Root compartment
. - Select the
Tag Defaults
Link. - Click
Create Tag Default
. - Create the
Tag Default
by providing theTag namespace
andTag Key
created previously and as theDefault Value
provide:${iam.principal.name}
.
From Command Line
- Create a Tag Namespace in the Root Compartment
oci iam tag-namespace create --compartment-id=<tenancy OCID> --name=<name> -- description=<description> --query data.{"\"Tag Namespace OCID\":id"} --output table
- Note the Tag Namespace OCID and use it when creating the Tag Key Definition
oci iam tag create --tag-namespace-id=<tag namespace OCID> --name=<tag namespace OCID> --description=<description> --query data.{"\"Tag Key Definition OCID\":id"} --output table
- Note the Tag Key Definition OCID and use it when creating the Tag Default in the Root compartment
oci iam tag-default create --compartment-id=<tenancy OCID> --tag-definitionid=<tag key definition id> --value="\${iam.principal.name}"
Default Value
New OCI Tenancies will have Tag Defaults setup for CreatedBy and CreatedOn as default. If this is the case then there is no remediate action required in the Tenancy in order to meet this specific control.
Usage
Run the control in your terminal:
powerpipe control run oci_compliance.control.cis_v120_3_2
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run oci_compliance.control.cis_v120_3_2 --share
SQL
This control uses a named query:
identity_default_tag