# Tagging Amazon OpenSearch Ingestion pipelines
<a name="tag-pipeline"></a>

Tags let you assign arbitrary information to an Amazon OpenSearch Ingestion pipeline so you can categorize and filter on that information. A *tag* is a metadata label that you assign or that Amazon assigns to an Amazon resource. Each tag consists of a *key* and a *value*. For tags that you assign, you define the key and value. For example, you might define the key as `stage` and the value for one resource as `test`.

Tags help you do the following:
+ Identify and organize your Amazon resources. Many Amazon services support tagging, so you can assign the same tag to resources from different services to indicate that the resources are related. For example, you could assign the same tag to an OpenSearch Ingestion pipeline that you assign to an Amazon OpenSearch Service domain.
+ Track your Amazon costs. You activate these tags on the Amazon Billing and Cost Management dashboard. Amazon uses the tags to categorize your costs and deliver a monthly cost allocation report to you. For more information, see [Use Cost Allocation Tags](https://docs.amazonaws.cn/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html) in the [Amazon Billing User Guide](https://docs.amazonaws.cn/awsaccountbilling/latest/aboutv2/).
+ Restrict access to pipelines using attribute based access control. For more information, see [Controlling access based on tag keys](https://docs.amazonaws.cn/IAM/latest/UserGuide/access_tags.html#access_tags_control-tag-keys) in the IAM User Guide.

In OpenSearch Ingestion, the primary resource is a pipeline. You can use the OpenSearch Service console, the Amazon CLI, OpenSearch Ingestion APIs, or the Amazon SDKs to add, manage, and remove tags from a pipeline.

**Topics**
+ [Permissions required](#pipeline-tag-permissions)
+ [Working with tags (console)](#tag-pipeline-console)
+ [Working with tags (Amazon CLI)](#tag-pipeline-cli)

## Permissions required
<a name="pipeline-tag-permissions"></a>

OpenSearch Ingestion uses the following Amazon Identity and Access Management Access Analyzer (IAM) permissions for tagging pipelines:
+ `osis:TagResource`
+ `osis:ListTagsForResource`
+ `osis:UntagResource`

For more information about each permission, see [Actions, resources, and condition keys for OpenSearch Ingestion](https://docs.amazonaws.cn/service-authorization/latest/reference/list_opensearchingestionservice.html) in the *Service Authorization Reference*.

## Working with tags (console)
<a name="tag-pipeline-console"></a>

The console is the simplest way to tag a pipeline.

****To create a tag****

1. Sign in to the Amazon OpenSearch Service console at [https://console.aws.amazon.com/aos/osis/home](https://console.aws.amazon.com/aos/osis/home#osis/ingestion-pipelines). You'll be on the Pipelines page.

1. Select the pipeline you want to add tags to and go to the **Tags** tab.

1. Choose **Manage** and **Add new tag**.

1. Enter a tag key and an optional value.

1. Choose **Save**.

To delete a tag, follow the same steps and choose **Remove** on the **Manage tags** page.

For more information about using the console to work with tags, see [Tag Editor](https://docs.aws.amazon.com/awsconsolehelpdocs/latest/gsg/tag-editor.html) in the *Amazon Management Console Getting Started Guide*.

## Working with tags (Amazon CLI)
<a name="tag-pipeline-cli"></a>

To tag a pipeline using the Amazon CLI, send a `TagResource` request: 

```
aws osis tag-resource
  --arn arn:aws:osis:us-east-1:123456789012:pipeline/my-pipeline 
  --tags Key=service,Value=osis Key=source,Value=otel
```

Remove tags from a pipeline using the `UntagResource` command:

```
aws osis untag-resource
  --arn arn:aws:osis:us-east-1:123456789012:pipeline/my-pipeline
  --tag-keys service
```

View the existing tags for a pipeline with the `ListTagsForResource` command:

```
aws osis list-tags-for-resource
  --arn arn:aws:osis:us-east-1:123456789012:pipeline/my-pipeline
```