aws / aws/aws-cdk

(aws-iam): (stack tags are not set for awsiam.CfnManagedPolicy)

Open
#30,982 6 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-iam bug effort/medium needs-cfn p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
1d 19h
Merged PRs (30d)
74

Description

### Describe the bug

Stack tags are not added to IAM policies, they are added to roles.

I add them to my stack like so:
```go
for tag, value := range cfg.Tags {
awscdk.Tags_Of(stack).Add(jsii.String(tag), jsii.String(value), &awscdk.TagProps{
ApplyToLaunchedInstances: jsii.Bool(true),
})
}
```

As a workaround, I tried explicitly adding them to policies like so, but, to no avail:
```go
for _, policy := range policies {
for tag, value := range cfg.Tags {
awscdk.Tags_Of(policy).Add(jsii.String(tag), jsii.String(value), &awscdk.TagProps{
ApplyToLaunchedInstances: jsii.Bool(true),
})
}
}
```

It seems like it may potentially be a gap or limit, I do not see tags available [here](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-managedpolicy.html#aws-resource-iam-managedpolicy--seealso) (although Tags can be set in the AWS console for Policies).

### Expected Behavior

Stack tags are applied to managed policies

### Current Behavior

Stack tags are not applied to managed policies

### Reproduction Steps

See above sample code

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.147.3 (build 32f0fdb)

### Framework Version

_No response_

### Node.js Version

v20.8.0

### OS

Ubuntu 22.04.4 LTS

### Language

Go

### Language Version

1.22

### Other information

I'm using these lib versions:
```
github.com/aws/aws-cdk-go/awscdk/v2 v2.129.0
github.com/aws/aws-sdk-go v1.48.1
github.com/aws/aws-sdk-go-v2 v1.23.1
```

Contributor guide

Open the contributing guide

Research direction

Start at the awsiam.CfnManagedPolicy construct and compare its stack-tag behavior with IAM roles, using the reported Go reproduction and the CloudFormation AWS::IAM::ManagedPolicy documentation. Check whether the missing tags are a CDK propagation gap or a CloudFormation limitation; done means the behavior is corrected with coverage, or the limitation is clearly documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, go, typescript
Domain
authorization, cloud, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.