aws / aws/aws-cdk

(aws-backup): BackupResource with TagCondition is not intuitive

Open
#18,911 5 comments 19 reactions 0 assignees View on GitHub
@aws-cdk/aws-backup bug p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### What is the problem?

When using `BackupResource` the behaviour especially with `fromResource()` and a `TagCondition` is not intuitive. It produces results that are the union of the two conditions rather than results matching both conditions.

### Reproduction Steps

For example, the following code:

```javascript
myBackupPlan.addSelection('SomeVolumes', {
resources: [
new backup.BackupResource('arn:aws:ec2:*:*:volume/*', {
key: "aws:ResourceTag/aws-backup",
value: "1",
operation: backup.TagOperation.STRING_EQUALS
})
],
});
```

I would expect that to backup all EBS volumes that also have the tag `aws-backup` = `1` since the tag condition is actually included as part of the resource.

Instead, it actually produces the following in the backup selection:

```
"BackupSelection": {
"SelectionName": "SomeVolumes",
"IamRoleArn": "xxx",
"Resources": [
"arn:aws:ec2:*:*:volume/*"
],
"ListOfTags": [
{
"ConditionType": "STRINGEQUALS",
"ConditionKey": "aws:ResourceTag/aws-backup",
"ConditionValue": "1"
}
]
},
```

Which means it backs up all EBS volumes and all resources (EBS or not) with `aws-backup` = `1`. I would expect it to instead produce `Conditions` in the output and not `ListOfTags` at all.

If I wanted all volumes and all resources tagged `aws-backup` = `1` I would expect to use the following (which does work as expected):

```javascript
myBackupPlan.addSelection('SomeVolumes', {
resources: [
new backup.BackupResource.fromArn('arn:aws:ec2:*:*:volume/*'),
new backup.BackupResource.fromTag('aws-backup', '1')
],
});
```

In addition, it would also be very nice to have the ability to specify more than one TagCondition when using a `BackupSelection` since it seems otherwise there is no way to access `Conditions` at all without resorting to a `Cfn` level construct.

### What did you expect to happen?

`Conditions` to be used to ensure the resources meets **ALL** conditions not any condition.

### What actually happened?

Resources are selected based on any matching condition.

### CDK CLI Version

2.10.0 (build e5b301f)

### Framework Version

_No response_

### Node.js Version

v16.14.0

### OS

Ubuntu

### Language

Typescript

### Language Version

JavaScript

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by tracing how BackupResource and BackupSelection turn the reproduction into the generated backup selection, comparing ListOfTags with the requested Conditions behavior. Done means resource and tag criteria are combined as specified, and the requested support for multiple tag conditions is addressed or clearly scoped.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.