Policy: GCP > Compute Engine > Instance > Network Tags > Required > Items

A list of network tags that GCP Compute Engine instances are required to carry.

The expected format is a YAML array of literal tag names — wildcards are not supported here, since a pattern cannot be attached to an instance.

Example:

yaml - "iap-ssh" - "deny-internet-egress"

This policy is evaluated by the GCP > Compute Engine > Instance > Network Tags > Required control. A tag in this list that is not attached to the instance raises an alarm and, under Enforce: Required > Items, is added to the instance. While this list is empty (the default), the control reports Invalid — populate the list to activate the control.

Network Tags > Approved is evaluated independently and does not automatically approve these tags, so add them to Network Tags > Approved > Tags as well if the Approved control is in use.