# Tagging in Amazon Managed Service for Prometheus
A *tag* is a custom attribute label that you or AWS assigns to an AWS resource. Each AWS tag has two parts:
+ A *tag key* (for example, `CostCenter`, `Environment`, `Project`, or `Secret`). Tag keys are case sensitive.
+ An optional field known as a *tag value* (for example, `111122223333`, `Production`, or a team name). Omitting the tag value is the same as using an empty string. Like tag keys, tag values are case sensitive.
Together these are known as key-value pairs. You can have as many as 50 tags assigned to each workspace.
Tags help you identify and organize your AWS resources. Many AWS services support tagging, so you can assign the same tag to resources from different services to indicate that the resources are related. For example, you can assign the same tag to an Amazon Managed Service for Prometheus workspace that you assign to an Amazon S3 bucket. For more information about tagging strategies, see [Tagging AWS Resources](https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html).
In Amazon Managed Service for Prometheus, both workspaces and rule groups namespaces can be tagged. You can use the console, the AWS CLI, APIs, or SDKs to add, manage, and remove tags for these resources. In addition to identifying, organizing, and tracking your workspaces and rule groups namespaces with tags, you can use tags in IAM policies to help control who can view and interact with your Amazon Managed Service for Prometheus resources.
**Tag restrictions**
The following basic restrictions apply to tags:
+ Each resource can have a maximum of 50 tags.
+ For each resource, each tag key must be unique, and each tag key can have only one value.
+ The maximum tag key length is 128 Unicode characters in UTF-8.
+ The maximum tag value length is 256 Unicode characters in UTF-8.
+ If your tagging schema is used across multiple AWS services and resources, remember that other services may have restrictions on allowed characters. Generally allowed characters are letters, numbers, spaces representable in UTF-8, and the following characters: ***. : \$1 = @ \$1 / -*** (hyphen).
+ Tag keys and values are case sensitive. As a best practice, decide on a strategy for capitalizing tags and consistently implement that strategy across all resource types. For example, decide whether to use `Costcenter`, `costcenter`, or `CostCenter` and use the same convention for all tags. Avoid using similar tags with inconsistent case treatment.
+ Don't use `aws:`, `AWS:`, or any upper or lowercase combination of such as a prefix for either keys or values. These are reserved only for AWS use. You can't edit or delete tag keys or values with this prefix. Tags with this prefix do not count against your tags-per-resource limit.
**Topics**
+ [Tag Amazon Managed Service for Prometheus workspaces](tagging-workspaces.md)
+ [Tagging rule groups namespaces](tagging-rulegroupsnamespaces.md)
# Tag Amazon Managed Service for Prometheus workspaces
Tags are custom labels that can be assigned to a resource. They include a unique key and an optional value (in a key-value pair). Tags help you identify and organize your AWS resources. In Amazon Managed Service for Prometheus, workspaces (and rule groups namespaces) can be tagged. You can use the console, the AWS CLI, APIs, or SDKs to add, manage, and remove tags for these resources. In addition to identifying, organizing, and tracking your workspaces with tags, you can use tags in IAM policies to help control who can view and interact with your Amazon Managed Service for Prometheus resources.
Use the procedures in this section to work with tags for Amazon Managed Service for Prometheus workspaces.
**Topics**
+ [Add a tag to a workspace](how-to-tag-workspace-add.md)
+ [View tags for a workspace](how-to-tag-workspace-list.md)
+ [Edit tags for a workspace](how-to-tag-workspace-update.md)
+ [Remove a tag from a workspace](how-to-tag-workspace-delete.md)
# Add a tag to a workspace
Adding tags to an Amazon Managed Service for Prometheus workspace can help you identify and organize your AWS resources and manage access to them. First, you add one or more tags (key-value pairs) to a workspace. After you have tags, you can create IAM policies to manage access to the workspace based on these tags. You can use the the console or the AWS CLI to add tags to an Amazon Managed Service for Prometheus workspace.
**Important**
Adding tags to a workspace can impact access to that workspace. Before you add a tag to a workspace, make sure to review any IAM policies that might use tags to control access to resources.
For more information about adding tags to an Amazon Managed Service for Prometheus workspace when you create it, see [Create a Amazon Managed Service for Prometheus workspace](AMP-create-workspace.md).
**Topics**
+ [Add a tag to a workspace (console)](#how-to-tag-workspace-add-console)
+ [Add a tag to a workspace (AWS CLI)](#how-to-tag-workspace-add-cli)
## Add a tag to a workspace (console)
You can use the console to add one or more tags to a Amazon Managed Service for Prometheus workspace.
1. Open the Amazon Managed Service for Prometheus console at [https://console.aws.amazon.com/prometheus/](https://console.aws.amazon.com/prometheus/home).
1. In the navigation pane, choose the menu icon.
1. Choose **All workspaces**.
1. Choose the workspace ID of the workspace that you want to manage.
1. Choose the **Tags** tab.
1. If no tags have been added to the Amazon Managed Service for Prometheus workspace, choose **Create tag**. Otherwise, choose **Manage tags**.
1. In **Key**, enter a name for the tag. You can add an optional value for the tag in **Value**.
1. (Optional) To add another tag, choose **Add tag** again.
1. When you have finished adding tags, choose **Save changes**.
## Add a tag to a workspace (AWS CLI)
Follow these steps to use the AWS CLI to add a tag to an Amazon Managed Service for Prometheus workspace. To add a tag to a workspace when you create it, see [Create a Amazon Managed Service for Prometheus workspace](AMP-create-workspace.md).
In these steps, we assume that you have already installed a recent version of the AWS CLI or updated to the current version. For more information, see [Installing the AWS Command Line Interface](https://docs.aws.amazon.com/cli/latest/userguide/installing.html).
At the terminal or command line, run the **tag-resource** command, specifying the Amazon Resource Name (ARN) of the workspace where you want to add tags and the key and value of the tag you want to add. You can add more than one tag to an workspace. For example, to tag an Amazon Managed Service for Prometheus workspace named **My-Workspace** with two tags, a tag key named *Status* with the tag value of *Secret*, and a tag key named *Team* with the tag value of *My-Team*:
```
aws amp tag-resource --resource-arn arn:aws:aps:us-west-2:123456789012:workspaces/IDstring
--tags Status=Secret,Team=My-Team
```
If successful, this command returns nothing.
# View tags for a workspace
Tags can help you identify and organize your AWS resources and manage access to them. For more information about tagging strategies, see [Tagging AWS Resources](https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html).
## View tags for an Amazon Managed Service for Prometheus workspace (console)
You can use the console to view the tags associated with a Amazon Managed Service for Prometheus workspace.
1. Open the Amazon Managed Service for Prometheus console at [https://console.aws.amazon.com/prometheus/](https://console.aws.amazon.com/prometheus/home).
1. In the navigation pane, choose the menu icon.
1. Choose **All workspaces**.
1. Choose the workspace ID of the workspace that you want to manage.
1. Choose the **Tags** tab.
## View tags for an Amazon Managed Service for Prometheus workspace (AWS CLI)
Follow these steps to use the AWS CLI to view the AWS tags for an workspace. If no tags have been added, the returned list is empty.
At the terminal or command line, run the **list-tags-for-resource** command. For example, to view a list of tag keys and tag values for a workspace:
```
aws amp list-tags-for-resource --resource-arn arn:aws:aps:us-west-2:123456789012:workspace/IDstring
```
If successful, this command returns information similar to the following:
```
{
"tags": {
"Status": "Secret",
"Team": "My-Team"
}
}
```
# Edit tags for a workspace
You can change the value for a tag associated with a workspace. You can also change the name of the key, which is equivalent to removing the current tag and adding a different one with the new name and the same value as the other key.
**Important**
Editing tags for an Amazon Managed Service for Prometheus workspace can impact access to that workspace. Before you edit the name (key) or value of a tag for a workspace, make sure to review any IAM policies that might use the key or value for a tag to control access to resources such as repositories.
## Edit a tag for an Amazon Managed Service for Prometheus workspace (console)
You can use the console to edit the tags associated with a Amazon Managed Service for Prometheus workspace.
1. Open the Amazon Managed Service for Prometheus console at [https://console.aws.amazon.com/prometheus/](https://console.aws.amazon.com/prometheus/home).
1. In the navigation pane, choose the menu icon.
1. Choose **All workspaces**.
1. Choose the workspace ID of the workspace that you want to manage.
1. Choose the **Tags** tab.
1. If no tags have been added to the workspace, choose **Create tag**. Otherwise, choose **Manage tags**.
1. In **Key**, enter a name for the tag. You can add an optional value for the tag in **Value**.
1. (Optional) To add another tag, choose **Add tag** again.
1. When you have finished adding tags, choose **Save changes**.
## Edit tags for an Amazon Managed Service for Prometheus workspace (AWS CLI)
Follow these steps to use the AWS CLI to update a tag for a workspace. You can change the value for an existing key, or add another key.
At the terminal or command line, run the **tag-resource** command, specifying the Amazon Resource Name (ARN) of the Amazon Managed Service for Prometheus workspace where you want to update a tag and specify the tag key and tag value:
```
aws amp tag-resource --resource-arn arn:aws:aps:us-west-2:123456789012:workspace/IDstring --tags Team=New-Team
```
# Remove a tag from a workspace
You can remove one or more tags associated with a workspace. Removing a tag does not delete the tag from other AWS resources that are associated with that tag.
**Important**
Removing tags for a Amazon Managed Service for Prometheus workspace can impact access to that workspace. Before you remove a tag from a workspace, make sure to review any IAM policies that might use the key or value for a tag to control access to resources such as repositories.
## Remove a tag from an Amazon Managed Service for Prometheus workspace (console)
You can use the console to remove the association between a tag and a workspace.
1. Open the Amazon Managed Service for Prometheus console at [https://console.aws.amazon.com/prometheus/](https://console.aws.amazon.com/prometheus/home).
1. In the navigation pane, choose the menu icon.
1. Choose **All workspaces**.
1. Choose the workspace ID of the workspace that you want to manage.
1. Choose the **Tags** tab.
1. Choose **Manage tags**.
1. Find the tag that you want to delete, and choose **Remove**.
## Remove a tag from an Amazon Managed Service for Prometheus workspace (AWS CLI)
Follow these steps to use the AWS CLI to remove a tag from an workspace. Removing a tag does not delete it, but simply removes the association between the tag and the workspace.
**Note**
If you delete an Amazon Managed Service for Prometheus workspace, all tag associations are removed from the deleted workspace. You do not have to remove tags before you delete a workspace.
At the terminal or command line, run the **untag-resource** command, specifying the Amazon Resource Name (ARN) of the workspace where you want to remove tags and the tag key of the tag you want to remove. For example, to remove a tag on a workspace named **My-Workspace** with the tag key *Status*:
```
aws amp untag-resource --resource-arn arn:aws:aps:us-west-2:123456789012:workspace/IDstring --tag-keys Status
```
If successful, this command returns nothing. To verify the tags associated with the workspace, run the **list-tags-for-resource** command.
# Tagging rule groups namespaces
Tags are custom labels that can be assigned to a resource. They include a unique key and an optional value (in a key-value pair). Tags help you identify and organize your AWS resources. In Amazon Managed Service for Prometheus, rule groups namespaces (and workspaces) can be tagged. You can use the console, the AWS CLI, APIs, or SDKs to add, manage, and remove tags for these resources. In addition to identifying, organizing, and tracking your rule groups namespaces with tags, you can use tags in IAM policies to help control who can view and interact with your Amazon Managed Service for Prometheus resources.
Use the procedures in this section to work with tags for Amazon Managed Service for Prometheus rule groups namespaces.
**Topics**
+ [Add a tag to a rule groups namespace](how-to-tag-rule-groups-namespace-add.md)
+ [View tags for a rule groups namespace](how-to-tag-rule-groups-namespace-list.md)
+ [Edit tags for a rule groups namespace](how-to-tag-rule-groups-namespace-update.md)
+ [Remove a tag from a rule groups namespace](how-to-tag-rule-groups-namespace-delete.md)
# Add a tag to a rule groups namespace
Adding tags to an Amazon Managed Service for Prometheus rule groups namespaces can help you identify and organize your AWS resources and manage access to them. First, you add one or more tags (key-value pairs) to a rule groups namespace. After you have tags, you can create IAM policies to manage access to the namespace based on these tags. You can use the the console or the AWS CLI to add tags to an Amazon Managed Service for Prometheus rule groups namespace.
**Important**
Adding tags to a rule groups namespace can impact access to that rule groups namespace. Before you add a tag, make sure to review any IAM policies that might use tags to control access to resources.
For more information about adding tags to a rule groups namespace when you create it, see [Create a rules file](AMP-ruler-rulesfile.md).
**Topics**
+ [Add a tag to a rule groups namespace (console)](#how-to-tag-rule-groups-namespace-add-console)
+ [Add a tag to a rule groups namespace (AWS CLI)](#how-to-tag-rule-groups-namespace-add-cli)
## Add a tag to a rule groups namespace (console)
You can use the console to add one or more tags to a Amazon Managed Service for Prometheus rule groups namespace.
1. Open the Amazon Managed Service for Prometheus console at [https://console.aws.amazon.com/prometheus/](https://console.aws.amazon.com/prometheus/home).
1. In the navigation pane, choose the menu icon.
1. Choose **All workspaces**.
1. Choose the workspace ID of the workspace that you want to manage.
1. Choose the **Rules management** tab.
1. Choose the button next to the namespace name and choose **Edit**.
1. Choose **Create tags**, **Add new tag**.
1. In **Key**, enter a name for the tag. You can add an optional value for the tag in **Value**.
1. (Optional) To add another tag, choose **Add new tag** again.
1. When you have finished adding tags, choose **Save changes**.
## Add a tag to a rule groups namespace (AWS CLI)
Follow these steps to use the AWS CLI to add a tag to an Amazon Managed Service for Prometheus rule groups namespace. To add a tag to a rule groups namespace when you create it, see [Upload a rules configuration file to Amazon Managed Service for Prometheus](AMP-rules-upload.md).
In these steps, we assume that you have already installed a recent version of the AWS CLI or updated to the current version. For more information, see [Installing the AWS Command Line Interface](https://docs.aws.amazon.com/cli/latest/userguide/installing.html).
At the terminal or command line, run the **tag-resource** command, specifying the Amazon Resource Name (ARN) of the rule groups namespace where you want to add tags and the key and value of the tag you want to add. You can add more than one tag to an rule groups namespace. For example, to tag an Amazon Managed Service for Prometheus namespace named **My-Workspace** with two tags, a tag key named *Status* with the tag value of *Secret*, and a tag key named *Team* with the tag value of *My-Team*:
```
aws amp tag-resource \
--resource-arn arn:aws:aps:us-west-2:123456789012:rulegroupsnamespace/IDstring/namespace_name \
--tags Status=Secret,Team=My-Team
```
If successful, this command returns nothing.
# View tags for a rule groups namespace
Tags can help you identify and organize your AWS resources and manage access to them. For more information about tagging strategies, see [Tagging AWS Resources](https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html).
## View tags for an Amazon Managed Service for Prometheus rule groups namespace (console)
You can use the console to view the tags associated with a Amazon Managed Service for Prometheus rule groups namespace.
1. Open the Amazon Managed Service for Prometheus console at [https://console.aws.amazon.com/prometheus/](https://console.aws.amazon.com/prometheus/home).
1. In the navigation pane, choose the menu icon.
1. Choose **All workspaces**.
1. Choose the workspace ID of the workspace that you want to manage.
1. Choose the **Rules management** tab.
1. Choose the namespace name.
## View tags for an Amazon Managed Service for Prometheus workspace (AWS CLI)
Follow these steps to use the AWS CLI to view the AWS tags for a rule groups namespace. If no tags have been added, the returned list is empty.
At the terminal or command line, run the **list-tags-for-resource** command. For example, to view a list of tag keys and tag values for a rule groups namespace:
```
aws amp list-tags-for-resource --resource-arn rn:aws:aps:us-west-2:123456789012:rulegroupsnamespace/IDstring/namespace_name
```
If successful, this command returns information similar to the following:
```
{
"tags": {
"Status": "Secret",
"Team": "My-Team"
}
}
```
# Edit tags for a rule groups namespace
You can change the value for a tag associated with a rule groups namespace. You can also change the name of the key, which is equivalent to removing the current tag and adding a different one with the new name and the same value as the other key.
**Important**
Editing tags for an rule groups namespace can impact access to it. Before you edit the name (key) or value of a tag for a resource, make sure to review any IAM policies that might use the key or value for a tag to control access to resources.
## Edit a tag for an Amazon Managed Service for Prometheus rule groups namespace (console)
You can use the console to edit the tags associated with a Amazon Managed Service for Prometheus rule groups namespace.
1. Open the Amazon Managed Service for Prometheus console at [https://console.aws.amazon.com/prometheus/](https://console.aws.amazon.com/prometheus/home).
1. In the navigation pane, choose the menu icon.
1. Choose **All workspaces**.
1. Choose the workspace ID of the workspace that you want to manage.
1. Choose the **Rules management** tab.
1. Choose the name of the namespace.
1. Choose **Manage tags**, **Add new tag**.
1. To change the value of an existing tag, enter the new value for **Value**.
1. o add an additional tag, choose **Add new tag**.
1. When you have finished adding and editing tags, choose **Save changes**.
## Edit tags for an Amazon Managed Service for Prometheus rule groups namespace (AWS CLI)
Follow these steps to use the AWS CLI to update a tag for a rule groups namespace. You can change the value for an existing key, or add another key.
At the terminal or command line, run the **tag-resource** command, specifying the Amazon Resource Name (ARN) of the resource where you want to update a tag and specify the tag key and tag value:
```
aws amp tag-resource --resource-arn rn:aws:aps:us-west-2:123456789012:rulegroupsnamespace/IDstring/namespace_name --tags Team=New-Team
```
# Remove a tag from a rule groups namespace
You can remove one or more tags associated with a rule groups namespace. Removing a tag does not delete the tag from other AWS resources that are associated with that tag.
**Important**
Removing tags for a resource can impact access to that resource. Before you remove a tag from a resource, make sure to review any IAM policies that might use the key or value for a tag to control access to resources such as repositories.
## Remove a tag from an Amazon Managed Service for Prometheus rule groups namespace (console)
You can use the console to remove the association between a tag and a rule groups namespace.
1. Open the Amazon Managed Service for Prometheus console at [https://console.aws.amazon.com/prometheus/](https://console.aws.amazon.com/prometheus/home).
1. In the navigation pane, choose the menu icon.
1. Choose **All workspaces**.
1. Choose the workspace ID of the workspace that you want to manage.
1. Choose the **Rules management** tab.
1. Choose the name of the namespace.
1. Choose **Manage tags**.
1. Next to the tag you want to delete, choose **Remove**.
1. When you have finished, choose **Save changes**.
## Remove a tag from an Amazon Managed Service for Prometheus rule groups namespace (AWS CLI)
Follow these steps to use the AWS CLI to remove a tag from an rule groups namespace. Removing a tag does not delete it, but simply removes the association between the tag and the rule groups namespace.
**Note**
If you delete an Amazon Managed Service for Prometheus rule groups namespace, all tag associations are removed from the deleted nnamespace. You do not have to remove tags before you delete a namespace.
At the terminal or command line, run the **untag-resource** command, specifying the Amazon Resource Name (ARN) of the rule groups namespace where you want to remove tags and the tag key of the tag you want to remove. For example, to remove a tag on a workspace named **My-Workspace** with the tag key *Status*:
```
aws amp untag-resource --resource-arn rn:aws:aps:us-west-2:123456789012:rulegroupsnamespace/IDstring/namespace_name --tag-keys Status
```
If successful, this command returns nothing. To verify the tags associated with the resource, run the **list-tags-for-resource** command.