aws-sso CfnPermissionSet: Stack-level tags applied through stack props do not apply to resource
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
There is currently an issue that I have been able to reproduce multiple times where stack-level tags being applied to the CfnPermissionSet resource will not apply if the stack-level tags are set through the stack props.
Tagging the resource individually through its 'tags' property works as expected.
Adding stack level tags using `Tags.of(ssoStack).add(...)` also works
Adding tags through the stack props does not work as the tags are not applied to the resource. They are being set as stack tags as the tags do show in the CFN console when viewing the stack and they are applied to other resources, just not the permission set resource.
### Expected Behavior
When adding tags to the stack in the stack props, they should be propagated to the CfnPermissionSet resource
### Current Behavior
The actual behavior is that is the tags are specified in the stack props, they do not get applied to this resource type.
### Reproduction Steps
Create a stack in CDK that creates a CfnPermissionSet resource, and add stack-level tags through the stack props. When the stack creates, the stack tags will show in the stack's info page in the CFN console, but will not show on the actual resource in the SSO console
Sample code:
In my cdk-sso-test/bin/cdk-sso-test.ts file:
```
import * as cdk from 'aws-cdk-lib';
import { CdkSsoTestStack } from '../lib/cdk-sso-test-stack';
const app = new cdk.App();
const ssoStack = new CdkSsoTestStack(app, 'CdkSsoTestStack', {
tags: {
'StackTag1': 'StackTag1'
}
});
```
And in my cdk-sso-test/lib/cdk-sso-test-stack.ts file:
```
import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as sso from 'aws-cdk-lib/aws-sso'
export class CdkSsoTestStack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);
const myInlinePolicy = {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": [
"iam:Create*",
"iam:Delete*",
"iam:Update*",
"iam:Put*",
"sts:Assume*"
],
"Resource": "*"
}
]
}
const cfnPermissionSet = new sso.CfnPermissionSet(this, 'Perms', {
instanceArn:
description: 'Test cdk permission set',
sessionDuration: 'PT2H',
name: 'CdkPermissionSet',
managedPolicies: ['arn:aws:iam::aws:policy/AdministratorAccess'],
inlinePolicy: myInlinePolicy,
});
```
### Possible Solution
Currently there is a workaround which is to use the `Tags.Of(...).add(...)` to add the stack-level tags instead.
For example, this works fine and tags are added:
In cdk-sso-test/bin/cdk-sso-test.ts file:
```
import * as cdk from 'aws-cdk-lib';
import { CdkSsoTestStack } from '../lib/cdk-sso-test-stack';
const app = new cdk.App();
const ssoStack = new CdkSsoTestStack(app, 'CdkSsoTestStack', {});
cdk.Tags.of(ssoStack).add('StackTag1', 'StackTag1');
```
As for the cause of this, I suspect that it may be related in some way to a similar issue I have opened on the CFN GitHub page [here](https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/1359).
Using the CFN console to instead create the stack, stack-level tags are also not applying to the AWS::SSO::PermissionSet resource type.
### Additional Information/Context
_No response_
### CDK CLI Version
2.44
### Framework Version
_No response_
### Node.js Version
16.17.1
### OS
MacOS 12.6
### Language
Typescript
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Start with bin/cdk-sso-test.ts and lib/cdk-sso-test-stack.ts, then inspect how CfnPermissionSet handles tags compared with Tags.of(ssoStack).add(...). Reproduce the stack-props case and compare it with the working workaround and CloudFormation behavior referenced in issue 1359. Done means stack-provided tags propagate to AWS::SSO::PermissionSet without breaking the existing tagging paths.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100