1. A computer implemented method, comprising: receiving a request to associate a tag with a computing resource, wherein the tag comprises a key and an associated value; associating the tag with a computing resource in a multitenant environment operated by a service provider, the tag including a freeform character string specifying the key and the associated value; determining restrictions for accessing the computing resource based on a combination of the key and the associated value of the tag, the tag being associated with an access control policy; receiving a request to perform an operation on the computing resource; determining that the tag is associated with the computing resource; evaluating the access control policy, the access control policy referencing the tag as a condition for using the computing resource, referencing a user having an account with the service provider, and identifying an operation permitted to be executed by the user if the tag is associated with computing resource; determining that the user is permitted to authorize the operation based at least in part on evaluating the access control policy; and resolving the request to perform the operation.