Process OCI CloudEvents for Tag Default resources.

The router receives events from the tenancy event handler and creates, updates,
or deletes Tag Default resources in the CMDB based on OCI CloudEvents.


OCI > Governance > Tag Default

tenancy

compartment

OCI > Governance > Tag Default > Router

Process OCI CloudEvents for Tag Definition resources.

The router receives events from the tenancy event handler and creates, updates,
or deletes Tag Definition resources in the CMDB based on OCI CloudEvents.


OCI > Governance > Tag Definition

OCI > Governance > Tag Definition > Router

Process OCI CloudEvents for Tag Namespace resources.

The router receives events from the tenancy event handler and creates, updates,
or deletes Tag Namespace resources in the CMDB based on OCI CloudEvents.


OCI > Governance > Tag Namespace

OCI > Governance > Tag Namespace > Router

Record and synchronize details for the OCI Governance tag default into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n

OCI > Governance > Tag Default > CMDB

Discover all OCI Governance tag default resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery) control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n

OCI > Tenancy

OCI > Compartment

OCI > Governance > Tag Default > Discovery

This control serves as a hierarchical parent for more specific Allowed controls, such as region/compartment-based controls and custom rule-based controls.&#92;n

OCI > Governance > Tag Definition > Allowed

Take an action when an OCI Governance tag definition is not allowed based on custom rules.&#92;n&#92;nThe `Allowed &gt; Custom` control checks if the tag definition is allowed based on the `Allowed &gt; Custom &gt; *` policies. If the tag definition is not allowed, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete if not allowed and resource is new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n

OCI > Governance > Tag Definition > Allowed > Custom > Rules

OCI > Governance > Tag Definition > Allowed > Custom

Record and synchronize details for the OCI Governance tag definition into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n

OCI > Governance > Tag Definition > CMDB

Discover all OCI Governance tag definition resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery) control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n

OCI > Governance > Tag Definition > Discovery

OCI > Governance > Tag Namespace > Allowed

Take an action when an OCI Governance tag namespace is not allowed based on custom rules.&#92;n&#92;nThe `Allowed &gt; Custom` control checks if the tag namespace is allowed based on the `Allowed &gt; Custom &gt; *` policies. If the tag namespace is not allowed, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete if not allowed and resource is new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n

OCI > Governance > Tag Namespace > Allowed > Custom > Rules

OCI > Governance > Tag Namespace > Allowed > Custom

Record and synchronize details for the OCI Governance tag namespace into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n

OCI > Governance > Tag Namespace > CMDB

Discover all OCI Governance tag namespace resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery) control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n

OCI > Governance > Tag Namespace > Discovery

Governance

governance

The OCID of the compartment containing the tag default

Whether a value is required for this tag default

The OCID of the tag definition associated with the tag default

The name of the tag definition associated with the tag default

The OCID of the tag namespace associated with the tag default

Date and time the tag default was created

tagDefault

The description assigned to the tag definition

Whether the tag definition is used for cost tracking

The lifecycle state of the tag definition

The OCID of the tag namespace that contains the tag definition

The name of the tag namespace that contains the tag definition

Date and time the tag definition was created

tagDefinition

The OCID of the compartment containing the tag namespace

The description assigned to the tag namespace

Date and time the tag namespace was created

tagNamespace

oci-governance

Configure whether to record and synchronize details for the OCI Governance tag default into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;nAll policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n

This policy serves as a hierarchical parent for more specific Allowed policies, such as region/compartment-based policies and custom rule-based policies.&#92;n

Determine the action to take when an OCI Governance tag definition is not allowed based on custom rules.&#92;n&#92;nThe `Allowed &gt; Custom` control checks if the tag definition is allowed based on the `Allowed &gt; Custom &gt; *` policies. If the tag definition is not allowed, the control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete if not allowed and resource is new`, the control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n

Determine whether the OCI Governance tag definition is allowed to exist based on custom rules.&#92;n&#92;nThis policy will be evaluated by the `Allowed &gt; Custom` control. If an OCI Governance tag definition is not allowed, it will be subject to the action specified in the `Allowed &gt; Custom` policy.&#92;n&#92;n**Note**: The policy value must be a string with a value of `Allowed`, `Not allowed` or `Skip`, or in the form of YAML objects. The object(s) must contain the key `result` with its value as `Allowed` or `Not allowed`. A custom title and message can also be added using the keys `title` and `message` respectively.&#92;n&#92;n**Examples:**&#92;n&#92;nSimple string values:&#92;n```yaml&#92;n- Allowed&#92;n- Not allowed&#92;n- Skip&#92;n```&#92;n&#92;nObject format with custom message:&#92;n```yaml&#92;n- result: Allowed&#92;n- title: Cost Center Check&#92;n  result: Not allowed&#92;n- title: Environment Tag Check&#92;n  result: Allowed&#92;n  message: Resource has valid environment tag&#92;n```&#92;n&#92;nMultiple rules (array):&#92;n```yaml&#92;n- - title: Cost Center Check&#92;n    result: Allowed&#92;n    message: Resource has valid cost center tag&#92;n  - title: Owner Tag Check&#92;n    result: Not allowed&#92;n    message: Resource missing required owner tag&#92;n```&#92;n

string

Configure whether to record and synchronize details for the OCI Governance  into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;nAll policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n

Determine the action to take when an OCI Governance tag namespace is not allowed based on custom rules.&#92;n&#92;nThe `Allowed &gt; Custom` control checks if the tag namespace is allowed based on the `Allowed &gt; Custom &gt; *` policies. If the tag namespace is not allowed, the control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete if not allowed and resource is new`, the control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n

Determine whether the OCI Governance tag namespace is allowed to exist based on custom rules.&#92;n&#92;nThis policy will be evaluated by the `Allowed &gt; Custom` control. If an OCI Governance tag namespace is not allowed, it will be subject to the action specified in the `Allowed &gt; Custom` policy.&#92;n&#92;n**Note**: The policy value must be a string with a value of `Allowed`, `Not allowed` or `Skip`, or in the form of YAML objects. The object(s) must contain the key `result` with its value as `Allowed` or `Not allowed`. A custom title and message can also be added using the keys `title` and `message` respectively.&#92;n&#92;n**Examples:**&#92;n&#92;nSimple string values:&#92;n```yaml&#92;n- Allowed&#92;n- Not allowed&#92;n- Skip&#92;n```&#92;n&#92;nObject format with custom message:&#92;n```yaml&#92;n- result: Allowed&#92;n- title: Cost Center Check&#92;n  result: Not allowed&#92;n- title: Environment Tag Check&#92;n  result: Allowed&#92;n  message: Resource has valid environment tag&#92;n```&#92;n&#92;nMultiple rules (array):&#92;n```yaml&#92;n- - title: Cost Center Check&#92;n    result: Allowed&#92;n    message: Resource has valid cost center tag&#92;n  - title: Owner Tag Check&#92;n    result: Not allowed&#92;n    message: Resource missing required owner tag&#92;n```&#92;n

Configure whether to record and synchronize details for the OCI Governance tag namespace into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;nAll policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n

OCI Governance provides tag management and governance services for Oracle Cloud Infrastructure.&#92;nThis includes Tag Namespaces for organizing tags, Tag Definitions for defining allowed tags&#92;nand their validators, and Tag Defaults for automatically applying tags to new resources.&#92;n

OCI > Governance

Oracle Cloud Infrastructure Governance Tag Default. A tag default applies a defined tag&#92;nto all resources created in the specified compartment. Tag defaults are inherited&#92;nby child compartments. When a resource is created, the tag default value is&#92;nautomatically applied unless overridden.&#92;n

Oracle Cloud Infrastructure Governance Tag Definition. A tag definition specifies the&#92;nkey portion of a defined tag. Tag definitions must be unique within a tag namespace. A tag definition&#92;ncan optionally include a validator that specifies the allowed values for the tag.&#92;n

Oracle Cloud Infrastructure Governance Tag Namespace. A tag namespace is a container for tag key&#92;ndefinitions. Tag namespaces are owned by the compartment. Tag namespaces must have&#92;nunique names within a tenancy. Tag key definitions within a namespace also must have&#92;nunique names.&#92;n

Mod: oci-governance

Recommended Version

Resource Types

Controls

Policies