> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/application-security/risk-management/monitor-and-manage-code-build/traceability-and-tagging.md).
# Traceability and Tagging
IaC resource tags allow you to manage and organize resources in cloud environments. They are a flexible and efficient way to provide cost allocation, streamline resource management, enhance security, provide access control, and improve root cause analysis. Tags added to IaC resources are carried through to their corresponding cloud assets, enabling traceability and efficient management. Prisma Cloud’s tagging bot and [Yor](https://github.com/bridgecrewio/yor), an open source tool, automatically tag Terraform, CloudFormation, and Serverless resources with the following groups of tags to address the following use cases:
* Git organization, repository, and the exact file containing the IaC template used to create the cloud resource
* Timestamp of Git commits for supported cloud resources, including a list of all editors and contributors who modified the file
* [Custom Tags](#custom-tag) that you create for your resources
## Auto-Tagging with Prisma Cloud Bot
Prisma Cloud automatically scans resources and applies tags based on predefined rules. Predefined tags include `git_org` and `git_repo`. If a resource is not compliant with a tag rule, Prisma Cloud automatically creates a pull request (PR) to add the necessary tags to the non-compliant resource. This ensures tag consistency and compliance across the environment. To complete the tagging process, access your version control system and merge the tag PR.
Only one tag PR can be open per repository at a time. If there is already an open tag PR, Prisma Cloud will not create a new one.
## Yor Trace Tag
In addition to auto-tags and custom tags, each runtime resource is uniquely identified by a `yor_trace` tag, enabling you to manually identify the IaC resource that is the source of the cloud asset. For Terraform, Prisma Cloud uses this tag to trace alerts, [detect drift](/content-collections/application-security/risk-management/monitor-and-manage-code-build/drift-detection.md) in code, and locate the specific resource within a commit. CloudFormation uses methods that do not require tags to automatically trace resources.
By combining auto-tagging, custom tagging, and the yor\_trace tag, you can achieve comprehensive visibility and control over your cloud infrastructure.
## Custom Tags
Custom tags are tags that you create for your resources. Custom tags can be simple key-value pairs or a complex combination of values. For even more complex tagging capabilities, you can directly leverage Yor CLI/GitHub Action (GHA).
To create a custom tag see [Create Custom Tags](#create-tag) below.
### Custom Tag Rule Logic
* **Basic**: Assign a tag and value to all resources in selected repositories
* **Conditional**: Assign a tag and value to all resources in the selected repositories that meet a certain condition
* **Conditional with Multiple Conditions**: Define multiple conditions per rule with different key-value pairs per condition
### Custom Tag Rule Examples
**Example #1**: Define all resources of a given repository as relevant to the production environment: 'Key': 'environment', Value: 'production'.
**Example #2**: Assign 'team': 'dev' to all resources that include the tag 'group:rd'.
**Example #3**: Tag specific GitHub users to a devops team. All other users will be tagged by default as 'platform' users.
```
'Key': 'team'.
'Value': 'platform' (default) All GitHub users that are not assigned to devops.
'Value': 'devops' Assign the following GitHub users to the devops team GitHub by selecting the following tags under the 'if has tags (optional)' field: 'git_modifier: jhonf', 'git_modifier: janed'.
```
**Example #4**: Define tags for internal teams (“devops” and “platform”) based on specific GitHub users on each team.
```
'Key': 'team'.
'Value': 'devops' if resource has certain tag name-value pairs: 'git_modifier: jhonf', 'git_modifier: janed'.
'Value':'platform' if resource has tag name-value pair: 'git_modifier: jamesd', 'git_modifier: juliem'.
```
## Manage Custom Tags
You can manage tags and tag rules for all resources associated with integrated repositories. This includes custom tags, but excludes auto-generated Yor trace tags (yor\_trace). Managing tags includes enabling/disabling and adding conditional values to tags. In addition, you can create, clone or delete custom tag rules.
**Permissions**: If you do not have permissions for all of the resources associated with a Tag Rule, you will only be able to clone the rule.
To access resource tag management:
1. Select **Application Security** > **Projects**.
2. Select the **Actions** menu > **Manage IaC Tags**.
The **Tag Rules** popup opens, displaying a list og tags if Yor has processed your repositories. This includes yor\_trace tags, out-of-the-box and custom tags.
### Create Custom Tags
1. Access tag management - see [Manage Custom Tags](#manage-tag) above.
2. Click **Add Tag Rule** in the 'Tag Rules' popup.
3. Assign the tag to selected repositories or all repositories.
Assigning a repository affects the number of resources. This number is displayed in the popup. You can monitor the affected resources on the Prisma Cloud console.
4. (Optional): Add a **Description** for the tag rule.
5. Add a key/value. The key represents the tag name.
6. (Optional): Click **Add Conditional Value** to add an additional condition to the tag.
7. Select **Save**.
The created custom tag rule is added to and displayed in the tag list on the Tag Rule popup.
### Enable/Disable Tags
You can enable or disable all types of tags. Enabling a tag triggers a scan across all resources in the repositories you have assigned to it. Disabling a tag prevents future scans from being triggered by the disabled tag. Past actions, such as automated pull requests, will not be reverted. The status of each tag is shown in the Status column.
1. Access tag management - see [Manage Custom Tags](#manage-tag) above.
2. Under the **Actions** menu, select **Play** to enable or **Pause** to disable a tag.
### Edit Custom Tags
1. Access tag management - see [Manage Custom Tags](#manage-tag) above.
2. Locate the desired tag in the tags table and click **Edit** under the 'Actions' column.
3. Modify the required values in the **Edit a Tag Rule** popup > **Save**.
### Clone Custom Tags
Example usage: A large-scale project with multiple teams and environments (development, staging, production). You have a base tag rule that applies to all environments. However, the production environment requires additional specific tags for compliance or security reasons. In this case, cloning the base rule and adding the necessary tags for the production environment might be a viable approach, provided it’s carefully managed.
1. Access tag management - see [Manage Custom Tags](#manage-tag) above.
2. Locate the desired tag in the tags table and click > **Clone** under the 'Actions' column.
3. Fill in required values in the **Edit a Tag Rule** popup > **Save**.
### Delete Custom Tags
1. Access tag management - see [Manage Custom Tags](#manage-tag) above.
2. Locate the desired tag in the tags table and click > **Delete** under the 'Actions' column.
Deleting a tag rule will not affect existing actions triggered by the rule. This includes automated pull requests (PRs) generated for non-compliant resources or any resources that were previously cloned using the deleted tag.
## View Tags associated with Resources
To view tags associated with a resource:
1. In **Application Security**, select **Projects** > **Group by: Resource**.
2. Select a resource > View the tags associated with the resource in the **Details** tab of the sidecar.
## View Resources associated with Tags
To view resources associated with tags:
1. In **Application Security**, select the **Inventory** tab > **IaC Resources** tab.
2. Select **Add Filter** > **IaC ResourceTag**.
A list of frameworks which include assets that have tags associated with IaC resources are displayed.
3. Click on an asset to view the tags in the **Overview** tab of the sidecar.
For more information, refer to [IaC Resources](/content-collections/cloud-and-software-inventory/iac-resources.md).
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/content-collections/application-security/risk-management/monitor-and-manage-code-build/traceability-and-tagging.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.