AWS PRM documentation change
Summary
Updated automated tagging guide with expanded content including new API/SDK bulk tagging section, detailed examples for CloudFormation, CDK, and Terraform tagging approaches, and clarifications on stack-level vs per-resource tagging
Security assessment
The changes are documentation improvements for partner resource management tagging procedures. No security vulnerabilities, incidents, or security weaknesses are mentioned. The content focuses on operational best practices for resource attribution and management, not security controls or features. The changes include technical implementation details for tagging resources with partner codes, which is an operational requirement rather than a security measure.
Diff
diff --git a/PRM/latest/aws-prm-onboarding-guide/automated-tagging.md b/PRM/latest/aws-prm-onboarding-guide/automated-tagging.md index 7da3df1ef..dd13bb66a 100644 --- a//PRM/latest/aws-prm-onboarding-guide/automated-tagging.md +++ b//PRM/latest/aws-prm-onboarding-guide/automated-tagging.md @@ -5 +5 @@ -AWS CloudFormationAWS Cloud Development Kit (AWS CDK)TerraformAWS Tag EditorAWS CLI +AWS CloudFormationAWS Cloud Development Kit (AWS CDK)TerraformAWS Tag EditorAWS CLIAPI/SDK Bulk Tagging @@ -17 +17,5 @@ Only tag resources that are directly used or influenced by your partner solution -AWS CloudFormation enables you to create and provision AWS infrastructure deployments predictably and repeatedly. It helps you leverage AWS services such as Amazon EC2, Amazon Elastic Block Store (EBS), Amazon SNS, Elastic Load Balancing, and Application Auto Scaling to build highly reliable, highly scalable, cost-effective applications in the cloud without worrying about creating and configuring the underlying AWS infrastructure. AWS CloudFormation enables you to use a template file to create and delete a collection of resources together as a single unit (a stack). +**Stack-level propagation (recommended):** Tags applied at the stack level propagate automatically to all resources in the stack that support tagging. This is the simplest approach when your entire stack belongs to your partner solution. + +###### Note + +Replace `5ugbbrmu7ud3u5hsipfzug61p` with your product code in the following examples. @@ -19 +23,4 @@ AWS CloudFormation enables you to create and provision AWS infrastructure deploy -You can use the Resource Tags property to apply tags to resources, which can help you identify and categorize those resources. You can only tag AWS CloudFormation supported resources. For information about which resources you can tag with CloudFormation, see the [AWS resources and property types reference](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-template-resource-type-ref.html) in the AWS CloudFormation user guide. For more information on how to use CloudFormation, see the [Resource tag](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html) in the AWS CloudFormation user guide. + + aws cloudformation create-stack --stack-name my-stack \ + --template-body file://template.yaml \ + --tags Key=aws-apn-id,Value=pc:5ugbbrmu7ud3u5hsipfzug61p @@ -23 +30,3 @@ You can use the Resource Tags property to apply tags to resources, which can hel -Replace `5ugbbrmu7ud3u5hsipfzug61p` with your product code in the following example. +Most common resource types (EC2, S3, RDS, Lambda, ECS, etc.) support stack-level tag propagation. However, some resources do not — for example, EBS volumes created from block device mappings. Use per-resource tagging as a fallback for those specific resources. + +**Per-resource tagging:** Add the tag directly to individual resource definitions when you need to tag only specific resources within a stack, or when different resources need different attribution. @@ -33,0 +43,2 @@ Replace `5ugbbrmu7ud3u5hsipfzug61p` with your product code in the following exam +For information about which resources you can tag with CloudFormation, see the [AWS resources and property types reference](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-template-resource-type-ref.html) in the AWS CloudFormation user guide. + @@ -36 +47,3 @@ Replace `5ugbbrmu7ud3u5hsipfzug61p` with your product code in the following exam -The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define your cloud application resources using familiar programming languages. A tag in AWS CDK is applied to a given construct that also applies to all of its taggable children. These tags are included in the AWS CloudFormation template synthesized from your application and are applied to the AWS resources it deploys. For more information about AWS CDK tagging, see [Tagging](https://docs.aws.amazon.com/cdk/v2/guide/tagging.html) in the AWS Cloud Development Kit (AWS CDK) v2 developer guide. +A tag in AWS CDK is applied to a given construct and all of its taggable children. For more information, see [Tagging](https://docs.aws.amazon.com/cdk/v2/guide/tagging.html) in the AWS CDK v2 developer guide. + +**Stack-level propagation (recommended):** Tag the stack to propagate to all resources. @@ -40 +53,6 @@ The AWS Cloud Development Kit (AWS CDK) is an open-source software development f -Replace `5ugbbrmu7ud3u5hsipfzug61p` with your product code in the following example. +Replace `5ugbbrmu7ud3u5hsipfzug61p` with your product code in the following examples. + + + Tags.of(stack).add('aws-apn-id', 'pc:5ugbbrmu7ud3u5hsipfzug61p'); + +**Per-resource tagging:** @@ -49,0 +68,2 @@ Replace `5ugbbrmu7ud3u5hsipfzug61p` with your product code in the following exam +**Provider-level default tags (recommended):** The `default_tags` block applies the tag to every resource Terraform creates or manages through that provider. + @@ -52 +72,16 @@ Replace `5ugbbrmu7ud3u5hsipfzug61p` with your product code in the following exam -Replace `5ugbbrmu7ud3u5hsipfzug61p` with your product code in the following example. +Replace `5ugbbrmu7ud3u5hsipfzug61p` with your product code in the following examples. + + + provider "aws" { + default_tags { + tags = { + aws-apn-id = "pc:5ugbbrmu7ud3u5hsipfzug61p" + } + } + } + +###### Note + +Some Terraform resource types do not support `default_tags` (e.g., `aws_autoscaling_group`). If you also define the same tag key in a resource's `tags` block, Terraform raises a conflict. Use either `default_tags` or per-resource tags for the `aws-apn-id` tag, not both on the same resource. + +**Per-resource tagging:** Add the tag to individual resource blocks when you need to tag only specific resources. @@ -116,0 +152,24 @@ Replace `5ugbbrmu7ud3u5hsipfzug61p` with your product code in the following exam +## API/SDK Bulk Tagging + +Use the Resource Groups Tagging API to tag multiple resources across different service types in a single call. This is the most efficient approach for large-scale tagging. + +###### Note + +Replace `5ugbbrmu7ud3u5hsipfzug61p` with your product code in the following example. + + + import boto3 + + tagging = boto3.client('resourcegroupstaggingapi') + tagging.tag_resources( + ResourceARNList=[ + 'arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0', + 'arn:aws:s3:::my-bucket' + ], + Tags={'aws-apn-id': 'pc:5ugbbrmu7ud3u5hsipfzug61p'} + ) + +###### Important + +For resources managed by infrastructure as code (CloudFormation, CDK, Terraform), always apply tags through the IaC tool instead. SDK/CLI tagging of IaC-managed resources causes drift detection on the next IaC run. + @@ -123 +182 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Automation +Manual Implementation @@ -125 +184 @@ Automation -Included AWS services +Included AWS Services