Control: GCP > Network > Firewall > Target Tags > Approved

Check or enforce that a GCP Network firewall rule targets only approved network tags via targetTags.

A firewall rule applies to instances by matching its targetTags against instance network tags, so a stray target tag puts the rule in scope of instances it should not govern. This control matches each of the rule's targetTags against the patterns in GCP > Network > Firewall > Target Tags > Approved > Tags (wildcards * and ? are supported). If any target tag is unapproved, the control raises an alarm and, under Enforce: Delete unapproved, removes only the unapproved target tags in place. Approved target tags are preserved.

It will not remove a rule's last remaining target tag: an empty targetTags applies the rule to every instance in the network (a strictly broader outcome), so a rule whose tags are all unapproved is alarmed for manual review rather than auto-emptied.