Create and manage tags

This guide describes how to create and manage tags on Secret Manager secrets. You can use tags to group related Secret Manager secrets and store metadata about those resources based on their tags.

About tags

A tag is a key-value pair that can be attached to a resource within Google Cloud. You can use tags to conditionally allow or deny policies based on whether a resource has a specific tag. For example, you can conditionally grant Identity and Access Management (IAM) roles based on whether a resource has a specific tag. For more information, see Tags overview.

Tags are attached to resources by creating a tag binding resource that links the value to the Google Cloud resource.

Required permissions

To get the permissions that you need to manage tags, ask your administrator to grant you the following IAM roles:

  • Tag Viewer (roles/resourcemanager.tagViewer) on the resources the tags are attached to
  • View and manage tags at the organization level: Organization Viewer (roles/resourcemanager.organizationViewer) on the organization
  • Create, update, and delete tag definitions: Tag Administrator (roles/resourcemanager.tagAdmin) on the resource you're creating, updating, or deleting tags for
  • Attach and remove tags from resources: Tag User (roles/resourcemanager.tagUser) on the tag value and the resources that you are attaching or removing the tag value to

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

To attach tags to Secret Manager secrets, you need the Secret Manager Admin role (roles/secretmanager.admin).

Create tag keys and values

Before you can attach a tag, you need to create a tag and configure its value. For more information, see Creating a tag and Adding a tag value.

Add tags during resource creation

You can add tags when you create secrets. Doing so lets you provide essential metadata for your resources and allows for better organization, cost tracking, and automated policy application.

Console

  1. Go to the Secret Manager page in the Google Cloud console.

    2. Go to Secret Manager

  2. Select the option to create a new secret.
  3. Click Manage tags.
  4. If your organization doesn't appear in the Manage tags panel, click Select scope for tags and select your organization or project.
  5. Click Add tag.
  6. Select the tag key and tag value from the list. You can filter the list using keywords.
  7. Click Save. The Tags section is updated with the tags information.
  8. Create your secret. The new secret is created with the provided tags.

gcloud

Before using any of the command data below, make the following replacements:

  • SECRET_ID: the unique identifier of the secret.
  • TAG_KEY: the permanent ID or namespaced name of the tag key that's attached-for example, tagKeys/567890123456.
  • TAG_VALUE: the permanent ID or namespaced name of the tag value that's attached—for example, tagValues/567890123456.

Specify multiple tags by separating the tags with a comma, for example, TAGKEY1=TAGVALUE1,TAGKEY2=TAGVALUE2.

Execute the following command:

Linux, macOS, or Cloud Shell

gcloud secrets create SECRET_ID --tags=TAG_KEY=TAG_VALUE

Windows (PowerShell)

gcloud secrets create SECRET_ID --tags=TAG_KEY=TAG_VALUE

Windows (cmd.exe)

gcloud secrets create SECRET_ID --tags=TAG_KEY=TAG_VALUE

REST

Before using any of the request data, make the following replacements:

  • PROJECT_ID: the ID of the project
  • SECRET_ID: the unique identifier of the secret
  • TAGKEY_NAME: the permanent ID or namespaced name of the tag key that's attached—for example, tagKeys/567890123456.
  • TAGVALUE_NAME: the permanent ID or namespaced name of the tag value that is attached—for example, tagValues/567890123456.

HTTP method and URL: 

POST https://secretmanager.googleapis.com/v1/projects/PROJECT_ID/secrets?secretId=SECRET_ID

Request JSON body: 

{
  "replication": {
    "automatic": {}
  },
  "tags": {
    "TAGKEY_NAME": "TAGVALUE_NAME"
  }
}

To send your request, choose one of these options:

curl

Save the request body in a file named request.json, and execute the following command: 

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://secretmanager.googleapis.com/v1/projects/PROJECT_ID/secrets?secretId=SECRET_ID"

PowerShell

Save the request body in a file named request.json, and execute the following command: 

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://secretmanager.googleapis.com/v1/projects/PROJECT_ID/secrets?secretId=SECRET_ID" | Select-Object -Expand Content

You should receive a successful status code (2xx) and an empty response.

C#

To run this code, first set up a C# development environment and install the Secret Manager C# SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope. 


using Google.Api.Gax.ResourceNames;
using Google.Cloud.SecretManager.V1;
using System.Collections.Generic;

public class CreateSecretWithTagsSample
{
    public Secret CreateSecretWithTags(
      string projectId = "my-project", string secretId = "my-secret", string tagKeyName = "tagKey/value", string tagValueName = "tagValue/value")
    {
        // Create the client.
        SecretManagerServiceClient client = SecretManagerServiceClient.Create();

        // Build the parent resource name.
        ProjectName projectName = new ProjectName(projectId);

        // Build the secret.
        Secret secret = new Secret
        {
            Replication = new Replication
            {
                Automatic = new Replication.Types.Automatic(),
            },
            Tags =
            {
              { tagKeyName, tagValueName }
            },
        };

        // Call the API.
        Secret createdSecret = client.CreateSecret(projectName, secretId, secret);
        return createdSecret;
    }
}

Go

To run this code, first set up a Go development environment and install the Secret Manager Go SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope. 

import (
	"context"
	"fmt"
	"io"

	secretmanager "cloud.google.com/go/secretmanager/apiv1"
	"cloud.google.com/go/secretmanager/apiv1/secretmanagerpb"
)

// createSecretWithTags creates a new secret with the given name and tags.
func createSecretWithTags(w io.Writer, parent, id, tagKey, tagValue string) error {
	// parent := "projects/my-project"
	// id := "my-secret"

	// Create the client.
	ctx := context.Background()
	client, err := secretmanager.NewClient(ctx)
	if err != nil {
		return fmt.Errorf("failed to create secretmanager client: %w", err)
	}
	defer client.Close()

	// Build the request.
	req := &secretmanagerpb.CreateSecretRequest{
		Parent:   parent,
		SecretId: id,
		Secret: &