aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
Feature Request for [AWS::EC2::Instance] to pass the tag for "resourceType": "network-interface" to the RunInstances API request
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::EC2::Instance
### Resource name
_No response_
### Description
Currently CloudFormation does not have the ability pass the tag for `"resourceType": "network-interface"` to the [RunInstances](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html) API request when an `AWS::EC2::Instance` resource is created.
It is also not passed even if we use a `AWS::EC2::LaunchTemplate` by specifying the [LaunchTemplateTagSpecification](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-launchtemplate-tagspecification.html) property with `ResourceType: network-interface`.
However, it is possible from EC2 console or CLI to pass the tag `"resourceType": "network-interface"` while launching the instance as referenced in this EC2 documentation [Add a tag when you launch an instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#instance-details-tags). This includes the tag in the `RunInstances` API request.
### Other Details
One of the use cases of this feature is to ensure that all EC2 instances created from CloudFormation and it's associated resources are tagged properly. If there is an SCP in place that denies `ec2:RunInstances` on resource `arn:aws:ec2:*:*:network-interface/*` based on a tag condition, it always fails because the tag is not passed from CloudFormation. However, it works from EC2 console or CLI.
Contributor guide
Research direction
Start by reviewing the AWS::EC2::Instance and AWS::EC2::LaunchTemplate behavior described in the issue, then compare the RunInstances API request with the console and CLI behavior. Pay particular attention to LaunchTemplateTagSpecification with ResourceType: network-interface and the tag condition on network-interface resources. Done means CloudFormation passes the requested network-interface tag when creating the instance.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100