aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

CloudFormation does not automatically create the automatic stack-level tags for IAM resources

Open
#1,966 3 comments 4 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

Other

### Resource Name

AWS::IAM:*

### Issue Description

CloudFormation does not automatically create the following stack-level tags for IAM resources, as stated in this doc https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html :
- aws:cloudformation:logical-id
- aws:cloudformation:stack-id
- aws:cloudformation:stack-name

### Expected Behavior

IAM resources created with CloudFormation should have the following stack-level tags automatically added, according to the doc:
- aws:cloudformation:logical-id
- aws:cloudformation:stack-id
- aws:cloudformation:stack-name

### Observed Behavior

IAM resources created with CloudFormation only have custom Tags created by the user, and the stack-level tags are not present

### Test Cases

You can test with any IAM resources (users, roles, groups...) we have the same problem. In the following test template, I tested with an IAM user. Only the custom "Cost Center" tag appears on the "ExampleUser" resource, and the following stack-level tags are not added, despite what is written in the [doc](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html):
- aws:cloudformation:logical-id
- aws:cloudformation:stack-id
- aws:cloudformation:stack-name

```
AWSTemplateFormatVersion: 2010-09-09

Resources:

IamUser:

Type: AWS::IAM::User

Properties:

UserName: ExampleUser

Tags:

- Key: CostCenter

Value: CC111
```

### Other Details

N/A

Contributor guide

Open the contributing guide

Research direction

Start with the issue's CloudFormation template and reproduce the behavior using an AWS::IAM::User resource, then compare the resulting tags with the linked AWS documentation. The issue provides no repository file or test entry point; done would mean confirming whether the documented stack-level tags appear on IAM resources or documenting the remaining service gap.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
authorization, cloud, security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.