About access tags
Tag-based access control
Using conditions and a set of tag variables, you can add a policy to scope access based on the tags that have been applied to a resource. Access can be controlled based on a tag that exists on the resource. Tag-based access control provides additional flexibility to your policies by allowing you to define access policies with tags.
- Access tags are visible account-wide in all Kyndryl Bridge Services; avoid using personal information.
- Access tags must always be in the key:value format. Think of it as a string to isolate two logical parts. For example, project:projectname. The Kyndryl Bridge Access Management user interface (UI) makes this distinction very clear.
- Access tags, both key and value, are case sensitive.
What is a resource?
A resource is any item that is created or owned by an application, such as Virtual Machines (VM), orders, and provider connections.
What is a resource group?
A resource group helps you organize your resources in a way that best fits within your business. With resource groups, you can quickly grant users access to one or more resources at the same time. So, a resource group is a group that contains one or more resource attributes that maps to a collection of similar resources.
What is an attribute?
An attribute is an element or metadata of the resource that helps identifying the resources, such as AssetID, OrderID, virtual machine in a specific region or virtual machine of a given provider.
Use case: Assigning access tags in policy authoring
Access tags are designed for integration with ABAC. When authoring an access policy:
- You can define policies like:
- Allow access to resources where Project=Finance
- Deny access if Environment=Prod
- Tags can be used across users, access groups, and service identities for granular access control.