Google Cloud Platform Blog: Labelling and grouping your Google Cloud Platform resources

Google Cloud Platform Blog

Product updates, customer stories, and tips and tricks on Google Cloud Platform

Labelling and grouping your Google Cloud Platform resources

Wednesday, June 13, 2018

By Grace Mollison, Cloud Solutions ArchitectGoogle Cloud Platform

Annotation type: Security marksSecurity marksCloud Security Command CenterUse cases:

classifying and organizing assets and findings independent of resource-level labelling mechanisms, including multi-parented groupings

enabling tracking of violation severity and priority

integrating with workflow systems for assignment and resolution of incidents

enabling differentiated policy enforcement on resources, projects or groups of projects

enhancing security focused insights into your resources, e.g., clarifying which publicly accessible buckets are within policy and which are not

How to use:Cloud SCC python libraryWhat you can annotate:

While in Alpha, keys must have a minimum length of 1 character and a maximum length of 63 characters, and cannot be empty. In the Beta and GA releases keys will be extended to support up to 256 characters and value can then have a maximum of 4096 characters.

Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. All characters must use UTF-8 encoding, and can include international characters.

here Annotation type: LabelsLabelsresourcesexported billing data

Identify resources used by individual teams or cost centers

Distinguish deployment environments (prod,stage, qa, test)

Identify owners, state labels.

Use for cost allocation and billing breakdowns.

Monitor resource groups via Stackdriver, which can use labels accessible in the resource metadata

How to use:

Each label must be a key-value pair.

Keys must have a minimum length of 1 character and a maximum length of 63 characters, and cannot be empty. Values can be empty, and have a maximum length of 63 characters.

Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. All characters must use UTF-8 encoding, and can include international characters.

The key portion of a label must be unique. However, you can use the same key with multiple resources. Keys must start with a lowercase letter or international character.

supported resourcesBigQuery lets you add labelsWhat you can label:here Annotation type: Network tagsHow to use:Tags can be added or removedgcloud compute instances add-tags [INSTANCE_NAME] --tags production,webgcloud compute firewall-rules create web-logdata \ --network logging-network \ --allow TCP:443 \ --source-tags web-production \ --target-tags log-datagcloud compute routes create my-route --destination-range 10.0.0.0/16 \ --network my-network [--tags=web-prod,api-gate-prod]Compute InstanceAdmin rolecreate a custom rolecompute.instances.setTagCompute InstanceAdmin roleservice accountsservice accounts vs tags

Can be no longer than 63 characters each

Can only contain lowercase letters, numeric characters, and dashes

Must start and end with either a number or a lowercase character.

Marks, labels and network tags at a glance

Use Case	Annotation(s) required	Notes
Taking inventory of GCP resources	Security marks Labels	Labels currently support a wider range of resources than Security marks. The Cloud SCC view of your resources includes, as properties of the resource, the labels and tags you’ve applied; you can then further apply ACL’d security marks to control the organization and filtering of the super set of resources, tags and labels.
Classifying or grouping GCP resources and data into logical groups such as dev or production environments for non-ACL’d use cases	Labels
Classify or grouping GCP resources and data into logical groups such as dev or production environments for security use cases	Security marks	Use these when you want the control of the groups to be at either an organization level or specifically not in the control of the resource owner.
Grouping and classifying sensitive resources and/or organize resources for attribution in security use cases	Security marks	Reading & setting marks is restricted to the Cloud SCC specific roles
Billing break down and cost allocation	Labels
Network traffic management to and from instances	Tags	Network tags can be modified by anyone in your org who has the Compute InstanceAdmin role
Monitoring groupings of related resources for Operational tasks	Labels	Used with Stackdriver resource groups
Monitoring of groupings of related resources and/or findings for security risk assessments, vulnerability management and threat detection	Security marks	Used in Cloud SCC