Skip to main content

Create an automatic Tag Policy

A Tag Policy defines a rule for assigning tags automatically: when a resource matches the conditions (for example, its name contains "prod"), the system assigns the tag as soon as the resource is created or when you run the policy manually.

Before you begin​

  • You have at least 1 tag in the catalog.

Step 1: Open the Create Policy wizard​

There are two ways:

  • Policies tab → click Add Policy.
  • Resources tab → click Create Policy on a warning banner.

Step 2: Fill in the general details​

  1. Policy name: enter a descriptive name, for example Tag production instances.
  2. Resource scope: choose the resource type the policy applies to (Instance, K8S Cluster, etc.).
  3. Action when conditions match: choose one of the two:
    • Add tag (keep existing) — adds the tags while keeping existing tags.
    • Replace existing tags — removes all existing tags, keeping only the policy's tags.

Step 1 — General details

📝 Note: Resource scope and Action cannot be changed after creation. If you need to change them, create a new policy.

Some contextual banners appear automatically depending on your choices:

  • When scope = K8S Cluster: tags assigned to the cluster are inherited by all member VMs.
  • When scope = Instance and action = Replace: tags inherited from a K8S Cluster are not replaced — that VM is reported as Skipped.
  • When action = Replace: the On Resource Creation toggle is disabled; only Manual Run is available.

Step 3: Add match conditions​

A policy needs at least 1 condition. The first condition always starts with When.

  1. In the Match Conditions section, click + Add condition.
  2. Configure the condition:
    • Conjunction: When (the first row — fixed), AND, or OR (subsequent rows).
    • Field: Resource name (fixed in this version).
    • Operator: start with, end with, or contains.
    • Value: enter the string to match, for example prod.
  3. Click + Add condition to add more conditions if needed.
  4. Click the trash icon to delete a condition.

Step 2 — Match conditions

Example: Tag every Instance whose name starts with vm-prod or contains staging:

When   Resource name   start with   vm-prod
OR     Resource name   contains     staging

Step 4: Configure triggers​

On Resource Creation — runs automatically when a new resource is created:

  • Enable the toggle if you want tags assigned automatically as soon as a resource is created.
  • The toggle is disabled when Action = Replace existing tags.

Manual Run — run it manually when needed:

  • Can always be enabled.
  • Must be enabled when Action = Replace existing tags.

Step 3 — Configure triggers

Step 5: Select the tags to apply​

  1. Find and select the tags to be assigned when the policy matches.
  2. Up to 10 tags.

Step 4 — Select tags

Step 6: Create the policy​

Click Create. The policy appears in the Policies tab with the Active status.

Result​

After creation:

  • If On Creation is enabled: the policy runs automatically every time a new resource matching the conditions is created.
  • To apply it to existing resources: click Run now on the policy card.

Editing a policy​

⚠️ Warning: Resource scope and Action are locked when editing. You can only change the name, conditions, triggers, and tag list.

After you save, the policy applies to subsequent runs. Resources that were already tagged are not re-evaluated automatically — use Run now to backfill.