Policy: GCP > Network > Firewall > Target Tags > Approved > Tags

A list of the network tags a GCP Network firewall rule is approved to target via targetTags.

The expected format is a YAML array of tag names. You may use the * (matches any sequence of characters) and ? (matches a single character) wildcard characters. Matching is performed with micromatch; patterns are anchored (a pattern must match the whole tag), so app does not match app-1 — use app-* for that.

Example:

yaml - "http-server" - "https-server" - "app-*"

This policy is evaluated by the GCP > Network > Firewall > Target Tags > Approved control. A target tag that matches no pattern in this list is considered unapproved and will be removed under Enforce: Delete unapproved — unless it is the rule's only remaining target tag, since an empty targetTags would apply the rule to every instance in the network. While this list is empty (the default), the control reports Invalid rather than alarming or enforcing. Populate the list to activate the control.