Control: GCP > Compute Engine > Instance > Network Tags > Approved

Check or enforce that a GCP Compute Engine instance carries only approved network tags.

Network tags (tags.items) are the free-form strings that GCP firewall rules match against via targetTags, so a stray tag can put an instance in scope of firewall rules it should not match. This control matches each of the instance's network tags against the patterns in GCP > Compute Engine > Instance > Network Tags > Approved > Tags (wildcards * and ? are supported). If any tag is unapproved, the control raises an alarm and, under Enforce: Delete unapproved, removes only the unapproved tags in place. Approved tags are preserved, and because network tags can be changed on a running instance, the instance is neither stopped nor deleted.

Network Tags > Approved and Network Tags > Required are evaluated independently, so a tag you require via Network Tags > Required > Items should also be listed here (or matched by a pattern) — otherwise this control will flag it as unapproved.