Control: 3.2 Ensure default tags are used on resources

Description

Using default tags is a way to ensure all resources that support tags are tagged during creation. Tags can be based on static values or based on computed values. It is recommended to setup default tags early on to ensure all created resources will get tagged. Tags are scoped to Compartments and are inherited by Child Compartments. The recommendation is to create default tags like “CreatedBy” at the Root Compartment level to ensure all resources get tagged. When using Tags it is important to ensure that Tag Namespaces are protected by IAM Policies otherwise this will allow users to change tags or tag values. Depending on the age of the OCI Tenancy there may already be Tag defaults setup at the Root Level and no need for further action to implement this action.

Remediation

From Console

1. Go to the Tag Namespaces page.
2. Select the Root compartment.
3. Click Create Namespace Definition.
4. Create the Namespace in the Root Compartment.
5. Click on the newly created Namespace definition.
6. Click Create Tag Key Definition. Create a Tag key definition by providing a Tag Key, Description and selecting “Static Value” for Tag Value Type.
7. Go to the Compartments page.
8. Select the Root compartment.
9. Select the Tag Defaults Link.
10. Click Create Tag Default.
11. Create the Tag Default by providing the Tag namespace and Tag Key created previously and as the Default Value provide: ${iam.principal.name}.

From Command Line

1. Create a Tag Namespace in the Root Compartment

oci iam tag-namespace create --compartment-id=<tenancy OCID> --name=<name> -- description=<description> --query data.{"\"Tag Namespace OCID\":id"} --output table

2. Note the Tag Namespace OCID and use it when creating the Tag Key Definition

oci iam tag create --tag-namespace-id=<tag namespace OCID> --name=<tag namespace OCID> --description=<description> --query data.{"\"Tag Key Definition OCID\":id"} --output table

3. Note the Tag Key Definition OCID and use it when creating the Tag Default in the Root compartment

oci iam tag-default create --compartment-id=<tenancy OCID> --tag-definitionid=<tag key definition id> --value="\${iam.principal.name}"

Default Value

New OCI Tenancies will have Tag Defaults setup for CreatedBy and CreatedOn as default. If this is the case then there is no remediate action required in the Tenancy in order to meet this specific control.