diff --git a/tencentcloud/resource_tc_key_pair.go b/tencentcloud/resource_tc_key_pair.go
index 5c78701449..a93127e089 100644
--- a/tencentcloud/resource_tc_key_pair.go
+++ b/tencentcloud/resource_tc_key_pair.go
@@ -24,6 +24,8 @@ import (
 	"context"
 	"strings"
 
+	"github.com/tencentcloudstack/terraform-provider-tencentcloud/tencentcloud/internal/helper"
+
 	"github.com/hashicorp/terraform-plugin-sdk/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
 	"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common/errors"
@@ -95,9 +97,14 @@ func resourceTencentCloudKeyPairCreate(d *schema.ResourceData, meta interface{})
 	publicKey := d.Get("public_key").(string)
 	projectId := d.Get("project_id").(int)
 
+	var tags map[string]string
+	if temp := helper.GetTags(d, "tags"); len(temp) > 0 {
+		tags = temp
+	}
+
 	keyId := ""
 	err := resource.Retry(writeRetryTimeout, func() *resource.RetryError {
-		id, err := cvmService.CreateKeyPair(ctx, keyName, publicKey, int64(projectId))
+		id, err := cvmService.CreateKeyPair(ctx, keyName, publicKey, int64(projectId), tags)
 		if err != nil {
 			return retryError(err)
 		}
@@ -109,6 +116,16 @@ func resourceTencentCloudKeyPairCreate(d *schema.ResourceData, meta interface{})
 	}
 	d.SetId(keyId)
 
+	if tags := helper.GetTags(d, "tags"); len(tags) > 0 {
+		tcClient := meta.(*TencentCloudClient).apiV3Conn
+		tagService := &TagService{client: tcClient}
+		resourceName := BuildTagResourceName("cvm", "keypair", tcClient.Region, keyId)
+		if err := tagService.ModifyTags(ctx, resourceName, tags, nil); err != nil {
+			// If tags attachment failed, the user will be notified, then plan/apply/update with terraform.
+			return err
+		}
+	}
+
 	return resourceTencentCloudKeyPairRead(d, meta)
 }
 
@@ -151,6 +168,15 @@ func resourceTencentCloudKeyPairRead(d *schema.ResourceData, meta interface{}) e
 		_ = d.Set("public_key", publicKey)
 	}
 
+	client := meta.(*TencentCloudClient).apiV3Conn
+	tagService := TagService{client}
+
+	tags, err := tagService.DescribeResourceTags(ctx, "cvm", "keypair", client.Region, d.Id())
+	if err != nil {
+		return err
+	}
+	_ = d.Set("tags", tags)
+
 	return nil
 }
 
@@ -173,6 +199,20 @@ func resourceTencentCloudKeyPairUpdate(d *schema.ResourceData, meta interface{})
 		}
 	}
 
+	if d.HasChange("tags") {
+		oldInterface, newInterface := d.GetChange("tags")
+		replaceTags, deleteTags := diffTags(oldInterface.(map[string]interface{}), newInterface.(map[string]interface{}))
+		tagService := TagService{
+			client: meta.(*TencentCloudClient).apiV3Conn,
+		}
+		region := meta.(*TencentCloudClient).apiV3Conn.Region
+		resourceName := BuildTagResourceName("cvm", "keypair", region, keyId)
+		err := tagService.ModifyTags(ctx, resourceName, replaceTags, deleteTags)
+		if err != nil {
+			return err
+		}
+	}
+
 	return resourceTencentCloudKeyPairRead(d, meta)
 }
 
diff --git a/tencentcloud/service_tencentcloud_cvm.go b/tencentcloud/service_tencentcloud_cvm.go
index b1d1c1d04e..5f2b01bc30 100644
--- a/tencentcloud/service_tencentcloud_cvm.go
+++ b/tencentcloud/service_tencentcloud_cvm.go
@@ -615,13 +615,29 @@ func (me *CvmService) DescribeKeyPairByFilter(ctx context.Context, id, name stri
 	return
 }
 
-func (me *CvmService) CreateKeyPair(ctx context.Context, keyName, publicKey string, projectId int64) (keyId string, errRet error) {
+func (me *CvmService) CreateKeyPair(ctx context.Context, keyName, publicKey string, projectId int64, tags map[string]string) (keyId string, errRet error) {
 	logId := getLogId(ctx)
 	request := cvm.NewImportKeyPairRequest()
 	request.KeyName = &keyName
 	request.ProjectId = &projectId
 	request.PublicKey = &publicKey
 
+	if len(tags) > 0 {
+		tagsSpec := make([]*cvm.Tag, 0)
+		for tagKey, tagValue := range tags {
+			tag := cvm.Tag{
+				Key:   helper.String(tagKey),
+				Value: helper.String(tagValue),
+			}
+			tagsSpec = append(tagsSpec, &tag)
+		}
+		tagSpecification := cvm.TagSpecification{
+			ResourceType: helper.String("keypair"),
+			Tags:         tagsSpec,
+		}
+		request.TagSpecification = append(request.TagSpecification, &tagSpecification)
+	}
+
 	ratelimit.Check(request.GetAction())
 	response, err := me.client.UseCvmClient().ImportKeyPair(request)
 	if err != nil {