1. Kion Success Center
  2. Automation
  3. Automation Policies
  4. Automation Policy Templates

Auto-Tag Resources

Follow

Last updated

The purpose of this page is to provide you with an overview of the built-in Automation Policy in Kion that provides the automatic tagging capabilities. You will find information on how this policy works as well as instructions on configuring this policy. This page is intended for a Kion administrator or technical user that is configuring and using this feature in the Kion platform.

Purpose

The purpose of this policy is to automatically tag all supported resource types using a Custom Variables configuration. This policy will tag in this way across the Cloud Service Providers based on your configuration:

  • AWS - AWS Tags are applied
  • Azure - Azure Tags are applied
  • GCP - GCP Labels are applied

Default Configuration

By default, the Auto-Tag Resources policy is set to execute on Mondays at 12:00pm ET to perform tagging functions. The policy is configured to use the system-resourcetags System Managed Custom Variable.

Required Configuration

This policy requires that you pre-configure the required Custom Variable overrides with the tag values that you desire.

Out-of-the-box, the Automation Policies feature creates a System Managed Custom Variable named system-resourcetags. This variable is a map type but is empty by default. The intention of this policy is that, using overrides at the Billing Source, OU, Project, or Account-levels, you will supply the correct tag configurations that are required for those resources.

We recommend that you start with a sub-set of your accounts or Organization Chart in Kion rather than trying to adopt everything into the Auto-Tag Resources policy at one time.

Cross-Cloud Tag Keys

Across the supported cloud providers, tagging and keys are handled differently. We recommend that you adopt lowercase tag keys if you intend to tag resources across all supported cloud providers.

  • AWS
    • AWS tag keys are case-sensitive and can be a mix of upper- and lower-case characters. See this for more information on AWS tags.
  • Azure
    • Azure tag keys are case-insensitive but keys are allowed to be a mix of upper- and lower-case characters. The casing is preserved on first use of a tag key. See this for more information on Azure tags.
  • GCP
    • GCP label keys are case-insensitive but only support lowercase characters. Uppercase characters in tag keys are rejected as an error condition. See this for more information on GCP labels.

Placing Overrides and Variable Precedence

Depending on the scope at which you plan on configuring tags, you must override them at different levels within Kion. Custom Variables have a precedence order in which they are evaluated. The section below explains how overrides will work in this context with these items precedence order from lowest to highest:

  • At the Global level:
    • This is the lowest order of precedence for the Custom Variable values.
    • This will become the “default” value for the variable. Any key:value pairs defined here will be applied anywhere this policy used if this variable is not otherwise overridden.
  • At the Billing Source level:
    • Accounts that are attached to this Billing Source will use the key:value pairs defined here unless otherwise overridden lower in the chain.
  • At the OU level:
    • Accounts that are below this OU will use the key:value pairs defined here unless otherwise overridden further in the chain.
  • At the Project level:
    • Accounts that are attached to this Project will use the key:value pairs defined here unless otherwise overridden further in the chain.
  • At the Account level:
    • This is the highest order of precedence in the Custom Variable values.
    • This account will use the key:value pairs defined here. These values cannot be overridden.

Examples of Precedence

In the examples below, we’ve drawn out situations where we’ve explained which level of Custom Variable “override” will win in the given scenarios to help you understand how to place overrides.

Project Overrides

  • Global level:
    • Custom Variable system-resourcetags:
      • Department:IACS
  • OU 1 level:
    • Custom Variable system-resourcetags:
      • Department:IACS-Research
      • BillingCode:44566
  • Project A level:
    • Custom Variable system-resourcetags:
      • Department:IACS-Research-AutoGen2
      • BillingCode:47899
      • ContactName:Jim Edwards

In this instance, the Project A-level will always win in precedence because it is higher in the precedence order than the other values provided.

Billing Source Overrides

  • Global level:
    • Custom Variable system-resourcetags:
      • Department:IACS
  • Billing Source 1 level:
    • Custom Variable system-resourcetags:
      • Department:IACS-Research
      • BillingCode:44566

In this instance, the Billing Source 1-level will win only for accounts attached to that specific Billing Source. Otherwise, the Global level would win for all other accounts.

Important Notes on Custom Variable Overrides

Custom Variables in Kion are not cumulative. That means that the values that Custom Variables hold are absolute. In the instance of Auto-Tag Resources, the system-resourcetags variable holds an absolute representation of the values that will be tagged. If an override higher in the order explained above omits a key:value pair, it will not be included in the final result.

Taking from the examples above, here is this scenario at-play:

  • Global level:
    • Custom Variable system-resourcetags:
      • Department:IACS
      • FRASResource:No
  • OU 1 level:
    • Custom Variable system-resourcetags:
      • Department:IACS-Research
      • BillingCode:44566
  • Project A level:
    • Custom Variable system-resourcetags:
      • Department:IACS-Research-AutoGen2
      • BillingCode:47899
      • ContactName:Jim Edwards

In the example above, we included the key:value of FRASResource:No at the global level. However, it will not be included in the final result for accounts below OU 1 or attached to Project A. This is because the override at both OU 1 and Project A omit FRASResource:No as a key:value pair.

Distributed Management of Overrides

You can easily put the power to specify the necessary overrides for Auto-Tag Resources into the hands of those that manage OUs or Projects. This alleviates the burden on the Kion Administrators group to add and maintain all of this data. To provide this capability to a user, they must have the appropriate permissions on a role at the appropriate level based on the scope you wish to grant:

  • OU-level Override Management
    • Manage OU Custom Variable Overrides
    • Browse OU Custom Variable Overrides & Inherited Values
  • Project-level Override Management
    • Manage Project Custom Variable Overrides
    • Browse Project Custom Variable Overrides & Inherited Values

Overwriting or Preserving Existing Tag Values

The default configuration for this policy is to overwrite existing tag values. Alternatively, you can choose to preserve existing tag values. Follow these steps to make the change to the existing policy (or clone it to make a second instance to have the option of both behaviors):

  1. Navigate to Automation > Automation Policies.
  2. Select Auto-Tag - All Supported Resources from the list.
  3. On the page that appears, select the dots menu at the top right and select Edit.
  4. On the Edit page, scroll to the bottom and select Continue.
  5. You should now be on the Cloud Service Provider selection page. For each of the policy blocks representing the cloud service providers, you will see a policy listed. Modify the policy to change overwrite: true to overwrite: false without any other modifications.
    1. NOTE: You must do this in each of the cloud service provider blocks.
  6. Scroll to the bottom and select Update Automation Policy.

Now, when this policy executes, it will not overwrite existing tag values and only write new values.

Activating

Once you’ve placed the correct overrides, simply use the automatically-generated Auto-Tag Resources Cloud Rule at the appropriate scope to enable this policy.

For hierarchical implementations, you can simply apply this Cloud Rule to the appropriate OU and allow it to be inherited down to Projects and Accounts.

For implementations that do not follow a hierarchy, we recommend labeling target Projects or OUs with a distinct Kion Label and then using Action Plans to apply this Cloud Rule.

Outcomes

The outcome of this operation can be found on the individual Automation Policy page under Impacted Resources. Here’s an example of checking the impact on all resources:

  1. Navigate to Automation > Automation Policies.
  2. At the top, select Enabled to quickly see only the active policies.
  3. On the Enabled tab, type “Auto-Tag” in the By Keyword field to filter the policies down.
  4. In the list, select the Auto-Tag - All Supported Resources policy.
  5. On the policy’s details page, select the Impacted Resources tab. This page will display all of the impacted resource information about the modifications made by the policy.

Quick Start Instructions

If you want to easily get started with this policy, you can follow the steps below:

  1. Navigate to a Project where you’d like to set tag values.
  2. On the Project, select the Automation > Custom Variables tabs.
  3. On the Custom Variables tab, select the Add button at the top-right and select Override Existing Variable from the menu.
  4. On the selection dialog that appears, select system-resourcetags. Choose Select to continue.
  5. On the Override screen that appears, select the Add New Key : Value Pair button. A key and value field will appear.
    1. For each tag you wish to apply, enter the tag’s key into the Key field and the value into the Value field.
      1. NOTE: If you are tagging across cloud providers, we recommend lowercase keys. See the Cross-Cloud Tag Keys section in this document for more information.
    2. If you want to specify multiple tags to apply at once, just choose Add New Key : Value Pair for each set.
  6. Once you’ve entered all the desired tags, select the confirmation warning and then Set Override.
  7. While still on the Automation tab, select the Cloud Rules sub-tab.
  8. On the Cloud Rules tab, select Add Existing Cloud Rule button or the more options menu and choose Add Existing Cloud Rule.
  9. On the dialog that appears, choose Auto-Tag Resources as the Cloud Rule and then Confirm selection.
  10. This will apply the Cloud Rule that contains the Automation Policy for tagging.
    1. To force tagging to occur immediately on the Project, navigate to the Automation > Automation Policies tabs on the Project. You will see Auto-Tag - All Supported Resources listed. Choose the more options menu to the right and select Run Once. Choose Run Policy on the dialog that appears and the policy will be executed shortly after.