aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
AWS::AmazonMQ::Broker Tags do not populate to ENI Resources
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::AmazonMQ::Broker
### Resource name
_No response_
### Description
When creating a Broker Resource, Tags specified within the Resource itself do not populate down to the ENI Resources that are created by the Broker Resource, despite the ENI Resource supporting tagging within CloudFormation [1].
If an admin desires to scope down the permissions of an IAM Policy to specifically target the ENI's created by the Broker Resource, it would require heavy custom logic from a Custom Resource, as the only item that links the ENIs and the Broker Resource is the Security Group specified within the CloudFormation Template.
You would need to filter a list of ENI's in a Custom Resource, find the ENI's with the desired Security Group, and then return the ENI Id's to the CloudFormation Stack within the Response Data of the Custom Resource. This is immensely heavy handed.
If an admin desires to scope down the permissions of an IAM Policy to specifically target the Tags within the ENI's that are created by the Broker Resource, since the ENI's are not populated with the Tags that the Broker Resource are created with, you would need to follow the same logic of leveraging the Security Group to find the ENI's and apply the Tags to the ENI's.
You are also unable to view the ENI's created by the Broker Resource in a describe-broker AWS CLI command.
The Ask:
Since the ENI Resources within CloudFormation support Tagging, and the MQ Resource also supports tagging, I would ask that the MQ Broker Resource Tags that are specified within the CloudFormation Template also be populated to the ENI Resources that are created as a result of the creation of the MQ Resource.
Or provide the ENI ID's within the describe-broker Response to allow the more straightforward use of a Custom Resource to push the tags onto the ENI Resources.
--------------------References--------------------
[1] AWS::EC2::NetworkInterface
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-networkinterface.html
### Other Details
_No response_
Contributor guide
Research direction
Start with the AWS::EC2::NetworkInterface reference linked in the issue and the AmazonMQ describe-broker AWS CLI response. Compare the tagging behavior and available broker details, then determine which requested outcome is appropriate: propagating broker tags to ENIs or exposing ENI IDs. Done means the chosen behavior is specified and supported by the relevant CloudFormation and AmazonMQ documentation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100