This page describes how to attach, detach, and list tags on Cloud SQLinstances. For an overview of tags on Cloud SQL, seeAccess control with Google Cloud tags.

Before you begin

Tags are managed through the Resource Manager. You need the followingCloud SQL IAM permissions to view and set tags onCloud SQL instances:

• cloudsql.instances.createTagBinding
• cloudsql.instances.deleteTagBinding
• cloudsql.instances.listTagBindings
• resourcemanager.tagUser

Thecloudsql permissions are inherited through thecloudsql.admin IAMrole. Theresourcemanager.tagUser is required to tag and instance during instance creation

Create a Cloud SQL instance with a tag

To create an instance with a tag attached, use the--tags flag when creating the instance.This combines the tags with organization policies, custom organization policies, and IAM conditions togive more customization to instance creation policies.

For example, the following command creates an instance in thegcloud CLI with the 1234 tag with a value of 5678[gcloud sql instances create tags-instance --tags=tagKeys/1234=tagValues/5678]

Attach tags to Cloud SQL instances

Once you'vecreated and defineda tag using Resource Manager, you can attach the tag directly to yourCloud SQL instance.

For example:

• The tag value is815471563813/environment/development.
  • 815471563813 is the organization ID.
  • environment is the tag key.
  • development is the tag value.
• Your project name ismy-project.
• Your instance name ismy-instance.
• Your instance is inus-central1.

Thegcloud resource-manager tags bindings create command attaches the tag to a resource, in this case,my-instance:

gcloudresource-managertagsbindingscreate\--tag-value=815471563813/environment/development\--parent=//sqladmin.googleapis.com/projects/my-project/instances/my-instance\--location=us-central1

Detach tags from Cloud SQL instances

Thegcloud resource-manager tags bindings delete command detaches the tag frommy-instance:

gcloudresource-managertagsbindingsdelete\--tag-value=815471563813/environment/development\--parent=//sqladmin.googleapis.com/projects/my-project/instances/my-instance\--location=us-central1

List tags on Cloud SQL instances

Thegcloud resource-manager tags bindings list command lists all tags directly attached tomy-instance,except tags thatmy-instance has inherited:

gcloudresource-managertagsbindingslist\--parent=//sqladmin.googleapis.com/projects/my-project/instances/my-instance\--location=us-central1

What's next

• For an overview of tags on Cloud SQL, seeAccess control with Google Cloud tags
• For more detailed instructions, seeAttach tags to resources.
• Learn aboutIAM conditionals.
• Learn how touse IAM conditionals with Cloud SQL.