(aws-backup): BackupResource with TagCondition is not intuitive
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### What is the problem?
When using `BackupResource` the behaviour especially with `fromResource()` and a `TagCondition` is not intuitive. It produces results that are the union of the two conditions rather than results matching both conditions.
### Reproduction Steps
For example, the following code:
```javascript
myBackupPlan.addSelection('SomeVolumes', {
resources: [
new backup.BackupResource('arn:aws:ec2:*:*:volume/*', {
key: "aws:ResourceTag/aws-backup",
value: "1",
operation: backup.TagOperation.STRING_EQUALS
})
],
});
```
I would expect that to backup all EBS volumes that also have the tag `aws-backup` = `1` since the tag condition is actually included as part of the resource.
Instead, it actually produces the following in the backup selection:
```
"BackupSelection": {
"SelectionName": "SomeVolumes",
"IamRoleArn": "xxx",
"Resources": [
"arn:aws:ec2:*:*:volume/*"
],
"ListOfTags": [
{
"ConditionType": "STRINGEQUALS",
"ConditionKey": "aws:ResourceTag/aws-backup",
"ConditionValue": "1"
}
]
},
```
Which means it backs up all EBS volumes and all resources (EBS or not) with `aws-backup` = `1`. I would expect it to instead produce `Conditions` in the output and not `ListOfTags` at all.
If I wanted all volumes and all resources tagged `aws-backup` = `1` I would expect to use the following (which does work as expected):
```javascript
myBackupPlan.addSelection('SomeVolumes', {
resources: [
new backup.BackupResource.fromArn('arn:aws:ec2:*:*:volume/*'),
new backup.BackupResource.fromTag('aws-backup', '1')
],
});
```
In addition, it would also be very nice to have the ability to specify more than one TagCondition when using a `BackupSelection` since it seems otherwise there is no way to access `Conditions` at all without resorting to a `Cfn` level construct.
### What did you expect to happen?
`Conditions` to be used to ensure the resources meets **ALL** conditions not any condition.
### What actually happened?
Resources are selected based on any matching condition.
### CDK CLI Version
2.10.0 (build e5b301f)
### Framework Version
_No response_
### Node.js Version
v16.14.0
### OS
Ubuntu
### Language
Typescript
### Language Version
JavaScript
### Other information
_No response_
Contributor guide
Research direction
Start by tracing how BackupResource and BackupSelection turn the reproduction into the generated backup selection, comparing ListOfTags with the requested Conditions behavior. Done means resource and tag criteria are combined as specified, and the requested support for multiple tag conditions is addressed or clearly scoped.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100