Help Center/ Config/ Best Practices/ Querying Resources That Do Not Have Specific Tags

Updated on 2025-03-26 GMT+08:00

View PDF

Querying Resources That Do Not Have Specific Tags

This section describes how to query resources that are not attached with certain tags.

Applicable Scenario

After a company moves to the cloud, as cloud resources keep growing, they usually need to manage hundreds of thousands or millions of resources within one account. You can use Tag Management Service (TMS) to classify and group resources by department, region, or project.

Config helps you identify resources that are not correctly tagged.

Procedure

Log in to the Config Console.
In the navigation pane on the left, choose Resource Compliance.
On the Rules tab, click Add Rule.
On the Basic Configurations page, select required-tag-check in the Built-in Policy area, and click Next.
On the Configure Rule Parameters page, select Virtual Private Cloud (VPC) for Service, Security Groups for Resource type, and All for Region.
Set specifiedTagKey to department and specifiedTagValue to ["team1", "team2", "team3"].
Confirm the configurations and click Submit.

On the Rules tab, you can view the evaluation result of the rule.

Built-in policies

Policy	Description
required-all-tags	If a resource does not have all the specified tags attached, this resource is noncompliant.
required-tag-exist	If a resource is missing all the specified tags, this resource is noncompliant.
resource-tag-key-prefix-suffix	If a resource does not have any tags that are specified with specific key prefixes and suffixes, this resource is not compliant.
resource-tag-not-empty	If a resource is not tagged, this resource is noncompliant.
required-tag-check	If a resource does not have the specified tag attached, this resource is noncompliant.