Policy: GCP > Compute Engine > Instance > Network Tags > Approved > Tags

A list of network tags that GCP Compute Engine instances are approved to carry.

The expected format is a YAML array of tag names. You may use the * (matches any sequence of characters) and ? (matches a single character) wildcard characters. Matching is performed with micromatch; patterns are anchored (a pattern must match the whole tag), so app does not match app-1 — use app-* for that.

Example:

yaml - "http-server" - "https-server" - "app-*"

This policy is evaluated by the GCP > Compute Engine > Instance > Network Tags > Approved control. A network tag that matches no pattern in this list is considered unapproved and will be removed under Enforce: Delete unapproved — so include any tags configured in Network Tags > Required > Items here as well. While this list is empty (the default), the control reports Invalid rather than alarming or enforcing — an empty list would otherwise disallow every network tag and, under enforcement, strip all tags (changing firewall behavior) across every targeted instance. Populate the list to activate the control.