Label (Tag) Synchronization for Owned By in GCP

Labels in GCP are the logical equivalent to Tags in AWS and Azure.

The use of “labels (tags)” throughout our documentation is to provide similarity to the CI Sync feature across multiple of our connectors.

For certainty though, this content is referring to GCP Labels as distinct from GCP Security Tags.

Connector Applicability

Applies to Source Connectors	GCP
Applies to Destination Connectors	All

Assumptions

These instructions assume you have already setup a source connection in CI Sync for GCP using the CI Sync instructions here: Add GCP to SaaS Agent.

Pre-Read

Syncfish recommend customers read the following documentation before changing the Connection Setting/s described below.

Locating and Amending the Connection Setting in the CI Sync UI

Navigate to the Settings page
Under the Source Connections heading (list), locate your GCP connection.
Click the Update link on the right hand side of the GCP connection.
Scroll down and locate the Section Heading and view the Individual Settings.

CleanShot 2025-09-18 at 14.44.38@2x-20250918-044519.png

The screen shot is provided only as sample to assist when reading this page. The state of your own CI Sync UI will depend on whether you are starting from the CI Sync default position or if you have already amended one/more of the settings.

Tick the Override default box/boxes and then use the sliders related to the individual settings. The following table elaborates any further information about these particular settings.

Setting	Type	Additional Notes
Enable for Owned By	Slider	If enabled, defined Labels (Tags) will be synchronized to the owned_by field against CIs in the CMDB. When enabled, the Owned By Label RegEx field will be exposed (see below).
Owned By Label RegEx	RegEx	Enter a Regular Expression that matches one or more label (tag) names in GCP (i.e. one or more labels (tags) that represent the Owned By associated with the GCP resource). Example RegEx /^Owner$\|^OwnerTag$\|^Owner 1$\|^Owner 2$\|^Owner1$\|^Owner2$/ RegEx Explained This RegEx will identify labels (tags) named “Owner”, “OwnerTag”, “Owner 1”, “Owner 2”, “Owner1” or “Owner2” (i.e. six variations) and sync’d the associated values into ServiceNow. Sync Behaviour and ServiceNow Data Explained If there are multiple labels (tags) that match the defined regEx for a field, the value within each label (tag) will be searched against the ServiceNow sys_user table. The CI Sync lookup ranks the results to return active users first. If there are multiple values within a label (tag) (including multiple labels (tags)), either comma or semi-colon separated, the individual values will be extracted and searched individually against the ServiceNow sys_user table with the first matching value returned. Once a match is returned, CI Sync will store the matching sys_user value against the owned_by field on the CI. If not match is found, the owned_by attribute on the CI will be blank. Regardless of whether a match is found (or not), CI Sync will also populate the ServiceNow cmdb_key_value table with the raw label (tag) data (i.e. an entry will be created in cmdb_key_value for each label (tag) and it’s raw value). By populating both the specific field on the CI (e.g. the cost_center attribute, the environrment attribute or the owned_by attribute) and the cmdb_key_value table (i.e. the related list against the CI), customers can identify CIs where the specific field is not populated but the related list of tags contains a near match. This approach allows customers to identify data quality issues in the source system using simple reports, dashboards or workflows within ServiceNow.
Owned By Lookups	Choicelist	Select one of the available choicelist items which control sys_user attribute/s CI Sync searches using the value/s in the label (tag). See below for the available choices.
e-Mail Suffixes	String	As GCP is restrictive as to the values allowed in labels (tags), CI Sync provides support for transforming GCP labels (tags) into user email addresses. For email addresses: the user component of the email address can be entered into the GCP label, and define one, or more, email address suffixes. CI Sync will then search the ServiceNow sys_user.email address field by combining the GCP label (tag) property with each of the entered email address suffixes.
Name Replacement Token	Choicelist	As GCP is restrictive as to the values allowed in Labels, CI Sync provides support for transforming GCP labels (tags) into user names. For user names: as GCP does not allow for the entry of space characters in label (tag) values, CI Sync provides for the substitution of either “-” or “_” with a space character when searching the sys_user.name field. See below for the available choices.

After modify the settings, scroll to the bottom of the page, tick the “I consent…” checkbox and finally click the Save connection button.
You can now run a sync job and the amended settings will be applied causing the CI Sync Data Sync rules to be modified accordingly.

Importantly

Make sure you consciously override the setting against either your TEST or PROD environment (i.e. your TEST vs PROD sync jobs).

For more information on how to use TEST vs PROD Connection Settings please read Understanding the use of CI Sync Connection Settings.

Syncfish strongly recommend making changes for TEST environment/sync jobs first. Only modify PROD related settings after thoroughly validating the intended results in TEST.