aws / aws/serverless-application-model

Implicit API: local PropagateTags: false is silently overridden by global PropagateTags: true

Open Beginner friendly
#3,977 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
9.6k
Forks
2.5k
Avg merge
1d 11h
Merged PRs (30d)
7

Description

### Describe the bug

`ImplicitApiPlugin._add_tags_to_implicit_api_if_necessary()` decides whether to copy a resource's `Tags` onto its generated implicit `AWS::Serverless::Api`/`HttpApi` resource using:

```python
should_propagate_tags = resource.properties.get("PropagateTags") or globals_var.get("PropagateTags")
```

`PropagateTags` is documented as `bool | None` (see `samtranslator/internal/schema_source/aws_serverless_function.py`), where `None` means "not set" and `False` is a meaningful, explicit opt-out. Using `or` means a local `PropagateTags: false` is indistinguishable from "not set" — it silently falls through to the global value.

### Reproduction

```yaml
Globals:
Function:
PropagateTags: true
Tags:
Team: Data

Resources:
MyFunction:
Type: AWS::Serverless::Function
Properties:
PropagateTags: false # explicit opt-out
Runtime: python3.12
Handler: index.handler
CodeUri: s3://bucket/key
Events:
Api:
Type: Api
Properties:
Path: /hello
Method: get
```

### Expected behavior

The function explicitly disables `PropagateTags`, so the generated implicit `AWS::Serverless::Api` should NOT receive the `Team: Data` tag.

### Actual behavior

`resource.properties.get("PropagateTags")` returns `False` (falsy), so `or` evaluates the global value (`True`) instead, and the tag is propagated to the implicit API anyway — silently ignoring the resource-level override.

This is inconsistent with the standard Globals merge logic (`GlobalProperties._prefer_local` in `samtranslator/plugins/globals/globals.py`), which always prefers the local value when the key is present locally, regardless of its truthiness.

### Fix

PR incoming.

Contributor guide

Open the contributing guide

Research direction

The behavior is in ImplicitApiPlugin._add_tags_to_implicit_api_if_necessary(); read that entry point and compare its local/global selection with GlobalProperties._prefer_local in samtranslator/plugins/globals/globals.py. Done means an explicit false prevents tags from reaching generated implicit AWS::Serverless::Api or HttpApi resources, while an unset value still follows the global setting.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
api, tooling
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.