Policy: GCP > Compute Engine > Instance > Network Tags > Required

Determine the action to take when a GCP Compute Engine instance is missing a network tag listed in GCP > Compute Engine > Instance > Network Tags > Required > Items.

Network tags (tags.items) are the strings that GCP firewall rules match against via targetTags — a deny or baseline rule keyed on a tag only applies to an instance while the tag is present, so a missing mandatory tag silently exempts the instance from those rules. The Network Tags > Required control checks that every required tag is attached and, under Enforce: Required > Items, adds the missing tags in place — existing tags are preserved and the instance keeps running.

Use enforcement with care: adding a tag puts the instance in scope of every firewall rule that targets that tag, including allow rules. Set this policy at a scope where that is intended.