1. A computer implemented method for using tags to control access to resources, said method comprising: under the control of one or more computer systems configured with executable instructions, providing one or more computing resources by a service provider, the one or more computing resources provided to a customer in a multitenant environment; associating an access control policy with a user of an account, the access control policy specifying metadata as part of a condition for controlling access to the one or more computing resources; receiving, from the user, an application programming interface (API) call to perform an operation on the one or more computing resources; evaluating, in response to the API call, the access control policy including the metadata specified in the access control policy; and authorizing the API call to perform the operation on the one or more computing resources based at least in part on the metadata specified in the access control policy.