(aws-iam): (stack tags are not set for awsiam.CfnManagedPolicy)
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 74
Description
### Describe the bug
Stack tags are not added to IAM policies, they are added to roles.
I add them to my stack like so:
```go
for tag, value := range cfg.Tags {
awscdk.Tags_Of(stack).Add(jsii.String(tag), jsii.String(value), &awscdk.TagProps{
ApplyToLaunchedInstances: jsii.Bool(true),
})
}
```
As a workaround, I tried explicitly adding them to policies like so, but, to no avail:
```go
for _, policy := range policies {
for tag, value := range cfg.Tags {
awscdk.Tags_Of(policy).Add(jsii.String(tag), jsii.String(value), &awscdk.TagProps{
ApplyToLaunchedInstances: jsii.Bool(true),
})
}
}
```
It seems like it may potentially be a gap or limit, I do not see tags available [here](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-managedpolicy.html#aws-resource-iam-managedpolicy--seealso) (although Tags can be set in the AWS console for Policies).
### Expected Behavior
Stack tags are applied to managed policies
### Current Behavior
Stack tags are not applied to managed policies
### Reproduction Steps
See above sample code
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CDK CLI Version
2.147.3 (build 32f0fdb)
### Framework Version
_No response_
### Node.js Version
v20.8.0
### OS
Ubuntu 22.04.4 LTS
### Language
Go
### Language Version
1.22
### Other information
I'm using these lib versions:
```
github.com/aws/aws-cdk-go/awscdk/v2 v2.129.0
github.com/aws/aws-sdk-go v1.48.1
github.com/aws/aws-sdk-go-v2 v1.23.1
```
Contributor guide
Research direction
Start at the awsiam.CfnManagedPolicy construct and compare its stack-tag behavior with IAM roles, using the reported Go reproduction and the CloudFormation AWS::IAM::ManagedPolicy documentation. Check whether the missing tags are a CDK propagation gap or a CloudFormation limitation; done means the behavior is corrected with coverage, or the limitation is clearly documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go, typescript
- Domain
- authorization, cloud, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100