aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::ElasticLoadBalancingV2::LoadBalancer] - [Enhancement] - Propagate LoadBalancer tags to service-managed ENIs

Open
#2,476 2 comments 12 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::ElasticLoadBalancingV2::LoadBalancer

### Resource name

_No response_

### Description

When an Application Load Balancer (ALB) is created via `AWS::ElasticLoadBalancingV2::LoadBalancer`, the service automatically provisions Elastic Network Interfaces (ENIs) in the specified subnets. These **service-managed ENIs do not inherit the tags** defined on the LoadBalancer resource.

This is a **service-level limitation**: there is no mechanism - neither in CloudFormation nor via the ELBv2 API - to control the tags on ENIs created and managed by the ALB service.

While the `Tags` property on `AWS::ElasticLoadBalancingV2::LoadBalancer` works correctly for the ALB resource itself, the tags are **not propagated** to the underlying ENIs that the ALB creates and manages throughout its lifecycle.

### Problem

- ALBs create ENIs with descriptions like `ELB app//` in each configured subnet.
- These ENIs are **created, replaced, and deleted** autonomously by the ELB service (e.g., during scaling events, AZ changes, or internal maintenance).
- The ENIs have **no tags at all** - not even a reference back to the owning ALB.
- There is **no `TagSpecifications`-style mechanism** (as exists for EC2 Launch Templates) to define tags for these ENIs.

### Impact

Organizations that enforce **mandatory tagging policies** (e.g., via AWS Config rules, SCPs, or third-party compliance tools) face significant operational challenges:

- **Cost allocation**: Untagged ENIs cannot be attributed to a cost center, project, or team.
- **Compliance violations**: AWS Config rules like `required-tags` flag these ENIs as non-compliant — despite the resources being fully managed by AWS.
- **Operational overhead**: Workarounds require building and maintaining event-driven Lambda functions (via CloudTrail + EventBridge) to retroactively tag ENIs. These ENIs can be replaced at any time, creating a constant race condition.
- **Scale**: Organizations with many ALBs (50+) see hundreds of untagged ENIs, making VPC-level resource management and security auditing difficult.

### Expected Behavior

Tags defined on `AWS::ElasticLoadBalancingV2::LoadBalancer` should be **automatically propagated** to all ENIs created and managed by the ALB. When ENIs are replaced during the ALB lifecycle, the new ENIs should also receive the current tags from the parent LoadBalancer.

Alternatively, a new property like `EniTags` or `NetworkInterfaceTagSpecifications` could be introduced to allow explicit control over ENI tagging.

### Other Details

### Reproduction

1. Create an ALB via CloudFormation with tags:
```yaml
MyALB:
Type: AWS::ElasticLoadBalancingV2::LoadBalancer
Properties:
Subnets: [subnet-aaa, subnet-bbb]
Tags:
- Key: Environment
Value: production
- Key: CostCenter
Value: 12345
```
2. After deployment, list the ENIs in the VPC:
```bash
aws ec2 describe-network-interfaces \
--filters "Name=description,Values=ELB app/*" \
--query "NetworkInterfaces[].{ID:NetworkInterfaceId,Desc:Description,Tags:TagSet}"
```
3. Observe: `TagSet` is **empty** on all ALB-managed ENIs.

Contributor guide

Open the contributing guide

Research direction

No repository file, test, or implementation entry point is named. Start by reproducing the behavior with the provided CloudFormation ALB template, then run the AWS CLI network-interface query and determine whether tag propagation or an explicit ENI tag property can be supported; done means replacement ENIs receive the intended tags.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.