Policy: GCP > Network > Firewall > Target Tags > Approved

Determine the action to take when a GCP Network firewall rule targets a network tag that is not approved by GCP > Network > Firewall > Target Tags > Approved > Tags.

A firewall rule applies to instances by matching its targetTags against instance network tags, so a stray target tag puts the rule in scope of instances it should not govern. The Target Tags > Approved control checks each of the rule's targetTags against the approved list and, under Enforce: Delete unapproved, removes only the unapproved target tags in place — approved target tags are preserved.

It will not remove the last remaining target tag: an empty targetTags applies the rule to every instance in the network (a strictly broader outcome), so a rule whose tags are all unapproved is alarmed for manual review rather than auto-emptied.