# Tag a report group in AWS CodeBuild
<a name="how-to-tag-report-group"></a>

A *tag* is a custom attribute label that you or AWS assigns to an AWS resource. Each AWS tag has two parts:
+ A *tag key* (for example, `CostCenter`, `Environment`, `Project`, or `Secret`). Tag keys are case sensitive.
+ An optional field known as a *tag value* (for example, `111122223333`, `Production`, or a team name). Omitting the tag value is the same as using an empty string. Like tag keys, tag values are case sensitive.

Together these are known as key-value pairs. For limits on the number of tags you can have on a report group and restrictions on tag keys and values, see [Tags](limits.md#tag-limits).

Tags help you identify and organize your AWS resources. Many AWS services support tagging, so you can assign the same tag to resources from different services to indicate that the resources are related. For example, you can assign the same tag to a CodeBuild report group that you assign to an Amazon S3 bucket. For more information about using tags, see the [Tagging best practices](https://d1.awsstatic.com/whitepapers/aws-tagging-best-practices.pdf) whitepaper. 

In CodeBuild, the primary resources are the report group and the project. You can use the CodeBuild console, the AWS CLI, CodeBuild APIs, or AWS SDKs to add, manage, and remove tags for a report group. In addition to identifying, organizing, and tracking your report group with tags, you can use tags in IAM policies to help control who can view and interact with your report group. For examples of tag-based access policies, see [Using tags to control access to AWS CodeBuild resources](auth-and-access-control-using-tags.md).

**Topics**
+ [

# Add tags to a report group
](how-to-tag-report-group-add.md)
+ [

# View tags for a report group
](how-to-tag-report-group-list.md)
+ [

# Edit tags for a report group
](how-to-tag-report-group-update.md)
+ [

# Remove tags from a report group
](how-to-tag-report-group-delete.md)

# Add tags to a report group
<a name="how-to-tag-report-group-add"></a>

Adding tags to a report group can help you identify and organize your AWS resources and manage access to them. First, you add one or more tags (key-value pairs) to a report group. Keep in mind that there are limits on the number of tags you can have on a report group. There are restrictions on the characters you can use in the key and value fields. For more information, see [Tags](limits.md#tag-limits). After you have tags, you can create IAM policies to manage access to the report group based on these tags. You can use the CodeBuild console or the AWS CLI to add tags to a report group. 

**Important**  
Adding tags to a report group can impact access to that report group. Before you add a tag to a report group, make sure to review any IAM policies that might use tags to control access to resources such as report groups. For examples of tag-based access policies, see [Using tags to control access to AWS CodeBuild resources](auth-and-access-control-using-tags.md).

For more information about adding tags to a report group when you create it, see [Create a report group (console)](report-group-create.md#test-report-group-create-console).

**Topics**
+ [

## Add a tag to a report group (console)
](#how-to-tag-report-group-add-console)
+ [

## Add a tag to a report group (AWS CLI)
](#how-to-tag-report-group-add-cli)

## Add a tag to a report group (console)
<a name="how-to-tag-report-group-add-console"></a>

You can use the CodeBuild console to add one or more tags to a CodeBuild report group. 

1. Open the CodeBuild console at [https://console.aws.amazon.com/codebuild/](https://console.aws.amazon.com/codebuild/).

1. In **Report groups**, choose the name of the report group where you want to add tags.

1. In the navigation pane, choose **Settings**.

1. If no tags have been added to the report group, choose **Add tag**. You can also choose **Edit**, and then choose **Add tag**.

1. In **Key**, enter a name for the tag. You can add an optional value for the tag in **Value**. 

1. (Optional) To add another tag, choose **Add tag** again.

1. When you have finished adding tags, choose **Submit**.

## Add a tag to a report group (AWS CLI)
<a name="how-to-tag-report-group-add-cli"></a>

To add a tag to a report group when you create it, see [Create a report group (CLI)](report-group-create.md#test-report-group-create-cli). In `CreateReportGroup.json`, add your tags.

 To add tags to an existing report group, see [Update a report group (CLI)](report-group-export-settings.md#update-report-group-cli) and add your tags in `UpdateReportGroupInput.json`. 

In these steps, we assume that you have already installed a recent version of the AWS CLI or updated to the current version. For more information, see [Installing the AWS Command Line Interface](https://docs.aws.amazon.com/cli/latest/userguide/installing.html).

# View tags for a report group
<a name="how-to-tag-report-group-list"></a>

Tags can help you identify and organize your AWS resources and manage access to them. For more information about using tags, see the [Tagging best practices](https://d1.awsstatic.com/whitepapers/aws-tagging-best-practices.pdf) whitepaper. For examples of tag-based access policies, see [Deny or allow actions on report groups based on resource tags](auth-and-access-control-using-tags.md#report-group-tag-policy-example).

## View tags for a report group (console)
<a name="how-to-tag-report-group-list-console"></a>

You can use the CodeBuild console to view the tags associated with a CodeBuild report group. 

1. Open the CodeBuild console at [https://console.aws.amazon.com/codebuild/](https://console.aws.amazon.com/codebuild/).

1. In **Report groups**, choose the name of the report group where you want to view tags.

1. In the navigation pane, choose **Settings**.

## View tags for a report group (AWS CLI)
<a name="how-to-tag-report-group-list-cli"></a>

Follow these steps to use the AWS CLI to view the AWS tags for a report group. If no tags have been added, the returned tags list is empty.

1.  Use the console or the AWS CLI to locate the ARN of your report group. Make a note of it. 

------
#### [ AWS CLI ]

    Run the following command. 

   ```
   aws list-report-groups
   ```

    This command returns JSON-formatted information similar to the following: 

   ```
   {
       "reportGroups": [
           "arn:aws:codebuild:region:123456789012:report-group/report-group-1",
           "arn:aws:codebuild:region:123456789012:report-group/report-group-2",
           "arn:aws:codebuild:region:123456789012:report-group/report-group-3"
       ]
   }
   ```

   A report group ARN ends with its name, which you can use to identify the ARN for your report group.

------
#### [ Console ]

   1. Open the CodeBuild console at [https://console.aws.amazon.com/codebuild/](https://console.aws.amazon.com/codebuild/).

   1. In **Report groups**, choose the name of your report group with the tags you want to view.

   1.  In **Configuration** locate your report group's ARN. 

------

1.  Run the following command. Use the ARN you made a note of for the `--report-group-arns` parameter. 

   ```
   aws codebuild batch-get-report-groups --report-group-arns arn:aws:codebuild:region:123456789012:report-group/report-group-name
   ```

    If successful, this command returns JSON-formatted information that contains a `tags` section similar to the following: 

   ```
   {
       ...                        
       "tags": {
           "Status": "Secret",
           "Project": "TestBuild"
       }
       ...
   }
   ```

# Edit tags for a report group
<a name="how-to-tag-report-group-update"></a>

You can change the value for a tag associated with a report group. You can also change the name of the key, which is equivalent to removing the current tag and adding a different one with the new name and the same value as the other key. Keep in mind that there are restrictions on the characters you can use in the key and value fields. For more information, see [Tags](limits.md#tag-limits).

**Important**  
Editing tags for a report group can impact access to that report group. Before you edit the name (key) or value of a tag for a report group, make sure to review any IAM policies that might use the key or value for a tag to control access to resources such as report groups. For examples of tag-based access policies, see [Deny or allow actions on report groups based on resource tags](auth-and-access-control-using-tags.md#report-group-tag-policy-example).

## Edit a tag for a report group (console)
<a name="how-to-tag-report-group-update-console"></a>

You can use the CodeBuild console to edit the tags associated with a CodeBuild report group. 

1. Open the CodeBuild console at [https://console.aws.amazon.com/codebuild/](https://console.aws.amazon.com/codebuild/).

1. In **Report groups**, choose the name of the report group where you want to edit tags.

1. In the navigation pane, choose **Settings**.

1. Choose **Edit**.

1. Do one of the following:
   + To change the tag, enter a new name in **Key**. Changing the name of the tag is the equivalent of removing a tag and adding a new tag with the new key name.
   + To change the value of a tag, enter a new value. If you want to change the value to nothing, delete the current value and leave the field blank.

1. When you have finished editing tags, choose **Submit**.

## Edit tags for a report group (AWS CLI)
<a name="how-to-tag-report-group-update-cli"></a>

 To add, change, or delete tags from a report group, see [Update a report group (CLI)](report-group-export-settings.md#update-report-group-cli). Update the tags in `UpdateReportGroupInput.json`. 

# Remove tags from a report group
<a name="how-to-tag-report-group-delete"></a>

You can remove one or more tags associated with a report group. Removing a tag does not delete the tag from other AWS resources that are associated with that tag.

**Important**  
Removing tags for a report group can impact access to that report group. Before you remove a tag from a report group, make sure to review any IAM policies that might use the key or value for a tag to control access to resources such as report groups. For examples of tag-based access policies, see [Using tags to control access to AWS CodeBuild resources](auth-and-access-control-using-tags.md).

## Remove a tag from a report group (console)
<a name="how-to-tag-report-group-delete-console"></a>

You can use the CodeBuild console to remove the association between a tag and a CodeBuild report group. 

1. Open the CodeBuild console at [https://console.aws.amazon.com/codebuild/](https://console.aws.amazon.com/codebuild/).

1. In **Report groups**, choose the name of the report group where you want to remove tags.

1. In the navigation pane, choose **Settings**.

1. Choose **Edit**.

1. Find the tag you want to remove, and then choose **Remove tag**.

1. When you have finished removing tags, choose **Submit**.

## Remove a tag from a report group (AWS CLI)
<a name="how-to-tag-report-group-delete-cli"></a>

Follow these steps to use the AWS CLI to remove a tag from a CodeBuild report group. Removing a tag does not delete it, but simply removes the association between the tag and the report group. 

**Note**  
If you delete a CodeBuild report group, all tag associations are removed from the deleted report group. You do not have to remove tags before you delete a report group.

 To delete one or more tags from a report group, see [Edit tags for a report group (AWS CLI)](how-to-tag-report-group-update.md#how-to-tag-report-group-update-cli). Update the `tags` section in the JSON-formatted data with an updated list of tags that does not contain the ones you want to delete. If you want to delete all tags, update the `tags` section to:

```
"tags: []"
```