aws / aws/aws-cdk

aws-sso CfnPermissionSet: Stack-level tags applied through stack props do not apply to resource

Open
#22,450 1 comment 1 reaction 0 assignees View on GitHub
@aws-cdk/aws-sso bug effort/small p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

There is currently an issue that I have been able to reproduce multiple times where stack-level tags being applied to the CfnPermissionSet resource will not apply if the stack-level tags are set through the stack props.

Tagging the resource individually through its 'tags' property works as expected.

Adding stack level tags using `Tags.of(ssoStack).add(...)` also works

Adding tags through the stack props does not work as the tags are not applied to the resource. They are being set as stack tags as the tags do show in the CFN console when viewing the stack and they are applied to other resources, just not the permission set resource.

### Expected Behavior

When adding tags to the stack in the stack props, they should be propagated to the CfnPermissionSet resource

### Current Behavior

The actual behavior is that is the tags are specified in the stack props, they do not get applied to this resource type.

### Reproduction Steps

Create a stack in CDK that creates a CfnPermissionSet resource, and add stack-level tags through the stack props. When the stack creates, the stack tags will show in the stack's info page in the CFN console, but will not show on the actual resource in the SSO console

Sample code:

In my cdk-sso-test/bin/cdk-sso-test.ts file:
```
import * as cdk from 'aws-cdk-lib';
import { CdkSsoTestStack } from '../lib/cdk-sso-test-stack';

const app = new cdk.App();
const ssoStack = new CdkSsoTestStack(app, 'CdkSsoTestStack', {
tags: {
'StackTag1': 'StackTag1'
}
});
```

And in my cdk-sso-test/lib/cdk-sso-test-stack.ts file:
```
import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as sso from 'aws-cdk-lib/aws-sso'

export class CdkSsoTestStack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);

const myInlinePolicy = {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": [
"iam:Create*",
"iam:Delete*",
"iam:Update*",
"iam:Put*",
"sts:Assume*"
],
"Resource": "*"
}
]
}

const cfnPermissionSet = new sso.CfnPermissionSet(this, 'Perms', {
instanceArn:
description: 'Test cdk permission set',
sessionDuration: 'PT2H',
name: 'CdkPermissionSet',
managedPolicies: ['arn:aws:iam::aws:policy/AdministratorAccess'],
inlinePolicy: myInlinePolicy,
});
```

### Possible Solution

Currently there is a workaround which is to use the `Tags.Of(...).add(...)` to add the stack-level tags instead.

For example, this works fine and tags are added:

In cdk-sso-test/bin/cdk-sso-test.ts file:
```
import * as cdk from 'aws-cdk-lib';
import { CdkSsoTestStack } from '../lib/cdk-sso-test-stack';

const app = new cdk.App();
const ssoStack = new CdkSsoTestStack(app, 'CdkSsoTestStack', {});
cdk.Tags.of(ssoStack).add('StackTag1', 'StackTag1');
```

As for the cause of this, I suspect that it may be related in some way to a similar issue I have opened on the CFN GitHub page [here](https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/1359).

Using the CFN console to instead create the stack, stack-level tags are also not applying to the AWS::SSO::PermissionSet resource type.

### Additional Information/Context

_No response_

### CDK CLI Version

2.44

### Framework Version

_No response_

### Node.js Version

16.17.1

### OS

MacOS 12.6

### Language

Typescript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with bin/cdk-sso-test.ts and lib/cdk-sso-test-stack.ts, then inspect how CfnPermissionSet handles tags compared with Tags.of(ssoStack).add(...). Reproduce the stack-props case and compare it with the working workaround and CloudFormation behavior referenced in issue 1359. Done means stack-provided tags propagate to AWS::SSO::PermissionSet without breaking the existing tagging paths.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.