Control: GCP > Compute Engine > Instance > Network Tags > Required

Check or enforce that a GCP Compute Engine instance carries every required network tag.

Network tags (tags.items) are the strings that GCP firewall rules match against via targetTags — a deny or baseline rule keyed on a tag only applies to an instance while the tag is present, so a missing mandatory tag silently exempts the instance from those rules. This control checks that every tag in GCP > Compute Engine > Instance > Network Tags > Required > Items is attached and, under Enforce: Required > Items, adds the missing tags in place. Existing tags are preserved and the instance keeps running.

Resource Types

This control targets the following resource types:

GCP > Compute Engine > Instance

Policies

The following policies can be used to configure this control:

GCP > Compute Engine > Instance > Network Tags > Required

This control type relies on these other policies when running actions:

GCP > Compute Engine > Instance > Network Tags > Required > Items

Quick Actions

GCP > Compute Engine > Instance > Set Network Tags

Permissions

Cloud permissions used by this control and its actions:

compute.instances.setTags

In Your Workspace

Developers

Control Type URI

tmod:@turbot/gcp-computeengine#/control/types/instanceNetworkTagsRequired

Category URI

tmod:@turbot/turbot#/control/categories/security

GraphQL

query controlType(id: "tmod:@turbot/gcp-computeengine#/control/types/instanceNetworkTagsRequired") { … }

query controls(filter: "controlTypeId:'tmod:@turbot/gcp-computeengine#/control/types/instanceNetworkTagsRequired'") { … }

CLI

Get Controls

turbot graphql controls --filter "controlTypeId:tmod:@turbot/gcp-computeengine#/control/types/instanceNetworkTagsRequired"