Configure tags for services

Tags are key-value pairs you can apply to your services for fine-grained accesscontrol. Tag administrators create tags for resources acrossGoogle Cloud at the organization or project level and manage them inResource Manager.Tags provide a way to conditionally allow or denypolicies based on whether a resource has a specific tag.

Tagsattached to Cloud Run services should not be confusedwith Cloud Runtraffic tagsthat allow you to route traffic to specific Cloud Run revisions.

Note: In contrast to tags,labels are usedto identify resources for billing-related reasons, filtering logs, and so forth.

Required roles

To get the permissions that you need to attach or detach tags, ask your administrator to grant you the following IAM roles on the Cloud Run service:

To manage access on the tag value resource in Resource Manager, youraccount must also have theTag User (roles/resourcemanager.tagUser) rolegranted for the tag value.The tag value is the resource that is attached to the Cloud Runservice.

For a list of IAM roles and permissions that are associated withCloud Run, seeCloud Run IAM rolesandCloud Run IAM permissions.If your Cloud Run service interfaces withGoogle Cloud APIs, such as Cloud Client Libraries, see theservice identity configuration guide.For more information about granting roles, seedeployment permissionsandmanage access.

Attach tags to Cloud Run services

Note that attaching a tag to your servicedoes not result in the creationof a new revision.

You can attach or detach tags using the Google Cloud console or the Google Cloud CLI.

Console

  1. Go to Cloud Run

  2. Check the checkbox at the left of the service you are setting the tagon.

  3. ClickTags above the services list to display the tags pane.

    Cloud Run Google Cloud console showing the tags panel for attaching and detaching service tags.

  4. If your organization doesn't appear in theTags panel, clickSelect scope. Select your organization and clickOpen.

  5. To attach a new tag to the service, clickAdd Tag and select one of thetag keys in the key dropdown menu, and select a value from thevalue dropdown menu.

  6. ClickSave then confirm your changes if prompted.

gcloud

You can update tags for a service using the command:

gcloudresource-managertagsbindingscreate\--tag-value=TAG_VALUE\--parent=//run.googleapis.com/projects/PROJECT_ID/locations/REGION/services/SERVICE\--location=REGION

To update more than one tag, supply a comma-delimited list of tag values.

Replace

  • TAG_VALUE with the value for the key: you can use thesedifferent types of identifiers: a permanent ID such astagValues/12345678901,a namespaced value such as123456789012/env/prod or a short name such asprod
  • PROJECT_ID with project ID of your Google Cloud project
  • REGION with region your Cloud Run service is deployed to
  • SERVICE with name of your Cloud Run service

Detach tags from Cloud Run services

You can use the console or the command line to detach tags from your service.

Console

  1. Go to Cloud Run

  2. Check the checkbox at the left of the service you are detaching the tagfrom.

  3. ClickTags above the services list to display the tags pane.

  4. Locate the tag you want to detach.

  5. Hold the pointer of your cursor to the right of theValue drop-down menu for the tag todisplay the trash icon, and click the trash icon.

  6. ClickSave and confirm your changes if prompted.

gcloud

To detach a tag from a service:

gcloudresource-managertagsbindingsdelete\--tag-value=TAG_VALUE\--parent=//run.googleapis.com/projects/PROJECT_ID/locations/REGION/services/SERVICE\--location=REGION

To detach more than one tag, supply a comma delimited list of tag values.

Replace

  • TAG_VALUE with the value for the key: you can use thesedifferent types of identifiers: a permanent ID such astagValues/12345678901,a namespaced value such as123456789012/env/prod or a short name such asprod
  • PROJECT_ID with project ID of your Google Cloud project
  • REGION with region your Cloud Run service is deployed to
  • SERVICE with name of your Cloud Run service

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-02-19 UTC.