aws / aws/aws-cdk

Tags: should error for duplicate tag keys

Open
#26,253 19 comments 1 reaction 0 assignees View on GitHub
@aws-cdk/aws-iam bug effort/medium needs-cfn p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

"Please note that Tag keys are case insensitive." We have developers who discovered the inconsistency around tag key case insensitivity the hard way.

### Expected Behavior

Cdk should have error out and refused in cases where tag names are only differentiated by case. Cfn should probably do this, too, but... protecting the user from the stupidity of Cfn is basically why Cdk exists.

### Current Behavior

CDK will happily put tags all over the place. Your Cfn run will do different things depending on the resources involved. So you'll go and remove the duplicate tags, and Cdk will happily build the Cfn and then blammo, you don't have a tag. Hope you weren't doing ABAC or anything...

### Reproduction Steps

https://github.com/ahammond/repro-tag-collision-cdk

```
import { App, Stack, StackProps, Tags } from 'aws-cdk-lib';
import { AnyPrincipal, Role } from 'aws-cdk-lib/aws-iam';
import { Construct } from 'constructs';

import { name } from './helpers';

const app = new App();

class Repro extends Stack {
constructor(scope: Construct, props?: StackProps) {
super(scope, name.pascal, props);
const role = new Role(this, 'Role', { assumedBy: new AnyPrincipal() });

Tags.of(role).add('Foo', 'bar');
// 1 - Deploy once with the following `foo` (note lower case) tag commented out.
// 2 - Deploy 2nd time with the following line uncommented. Should have errored at CDK level.
// Cfn should have errored (on some resources it gives a "Please note that Tag keys are case insensitive.")
// INSTEAD what it does is change the `Foo` tag's name to `foo`.
//Tags.of(role).add('foo', 'bar');
// 3- Comment out and deploy a 3rd time. Note that your role now doesn't have either the `foo` or the `Foo` tag.
// Cfn has happily cleaned up your mess and broken you.
// As a bonus, you have also achieved an inconsistent stack state.
}
}

new Repro(app);

app.synth();
```

### Possible Solution

Error when name collisions are detected.

### Additional Information/Context

_No response_

### CDK CLI Version

2.86.0 (build 1130fab)

### Framework Version

same

### Node.js Version

v16.20.0

### OS

MacOS

### Language

Typescript

### Language Version

4.9.5

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the supplied TypeScript reproduction, especially Tags.of(role).add and app.synth, to observe the duplicate-key behavior. Trace tag handling from those entry points and determine how to detect case-insensitive collisions; done means CDK rejects the conflicting tags with an error before producing the inconsistent CloudFormation result.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.