Workspace Tags
Tags let you classify and organize workspaces. They're also the basis for tag rule automation.
Tag Types
Source Tags
Source tags are imported from your cloud provider. They are read-only in Kostavo.
Source tag import is currently available for Azure workspaces only. Azure resource tags are synced automatically. AWS tag import is not yet supported.
Configure how source tags are imported in organization settings:
| Import Mode | Behavior |
|---|---|
| All | Import all cloud tags |
| Whitelist | Import only specified tag keys |
| None | Don't import cloud tags |
Source tags sync automatically and can also be manually refreshed from the workspace detail page.
Custom Tags
Custom tags are defined and managed within Kostavo. Your organization can create tag templates that standardize which tags are available:
| Template Field | Description |
|---|---|
| Key | Tag name (e.g., environment) |
| Description | Help text for users |
| Allowed Values | Dropdown options (e.g., dev, staging, prod). Leave empty for free text. |
Custom tags can be applied:
- During the onboarding wizard (applied to all selected workspaces)
- From the workspace detail page
- In bulk from the workspaces list
Using Tags for Automation
Tags become powerful when combined with tag rules. You can define rules like:
If
environment = production→ assign the Security Baseline profile
This means new workspaces tagged correctly get governed automatically, with no manual assignment needed.
Related
- Guide: Automate assignments with tags uses tags to automate governance for new workspaces
- Concept: Tag rules turns tags into automatic assignments
- Reference: Organization settings covers tag import modes and tag templates