Policy: GCP > Compute Engine > Instance > Network Tags > Approved

Determine the action to take when a GCP Compute Engine instance carries a network tag that is not approved by GCP > Compute Engine > Instance > Network Tags > Approved > Tags.

Network tags (tags.items) are the free-form strings that GCP firewall rules match against via targetTags, so a stray tag can put an instance in scope of firewall rules it should not match. The Network Tags > Approved control checks each of the instance's network tags against the approved list and, under Enforce: Delete unapproved, removes only the unapproved tags in place — approved tags are preserved, and because network tags can be changed on a running instance, the instance is neither stopped nor deleted.

Network Tags > Approved and Network Tags > Required are evaluated independently, so any tag configured in Network Tags > Required > Items should also be covered by the approved list — otherwise this control flags it as unapproved (and, if both controls enforce, removes it).