Add Tag Hold for Access Control

[roxannelandry]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to a user, that user is claiming responsibility for the issue.
• Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.

Description

Currently, we can create tags and bind them to resources, which is great. But here's the thing: we're missing a crucial piece. We can't put a hold on that binding, which means there's no way to prevent the deletion of a tag, even if it's associated with critical resources.

Here's what I'm thinking: it would be super helpful to have the ability to add holds to resource tags. This would allow us to designate certain tags as critical, and prevent their deletion in critical environments. Essentially, it would give us an added layer of control over our resources, ensuring that important tags are maintained, especially in high-stakes scenarios.

Implementing this feature would provide users with a cleaner and more secure way to manage tags and resources within GCP projects.

Thanks for considering this suggestion!

https://cloud.google.com/resource-manager/docs/tags/tags-creating-and-managing#protecting_tags

New or Affected Resource(s)

google_tags_location_tag_hold

Potential Terraform Configuration

resource "google_tags_location_tag_hold" "public_assets_bucket_tag_hold" {
  holder    = "//storage.googleapis.com/projects/_/buckets/${google_storage_bucket.public_assets.name}"
  location  = var.gcp_region
  tag_value = var.dm_environments_tag_value_id
}

References

No response

b/341735543