Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Fix the example for resources that do not support the Tags property #285

Open
wants to merge 9 commits into
base: main
Choose a base branch
from

Conversation

scottschreckengaust
Copy link

Issue #, if available:
Tests "FAIL" for CloudFormation resources that do not support the Tags property.

Description of changes:
Add resources that do not support the Tag property as an exclusion. Also, remove the example from other examples.

Each region's CloudFormation resource specification can be found at https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-resource-specification.html.

Example of resources in us-east-1 that do not support the Tags property:

curl https://d1uauaxba7bl26.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json|gunzip | jq -r '.ResourceTypes | keys_unsorted[] as $resourceKey | { "name": "\($resourceKey)", "tags": ."\($resourceKey)".Properties.Tags } | select( ."tags" == null)|.name' | sort -u

Any resource in any region that did not support the Tags property has been added.


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

* AWS::KMS::Alias
* AWS::SageMaker::NotebookInstanceLifecycleConfig
* AWS::Lambda::Permission
* AWS::Athena::NamedQuery
* AWS::Athena::PreparedStatement
* AWS::S3::BucketPolicy
Not all resources have a Tags property, this guard belongs in a
separate rule unrelated to encryption for Dynamo.
There are four regions without Tags property for IoT::TopicRule
There are four regions without Tags property for Logs::LogGroup
@scottschreckengaust
Copy link
Author

FYI: List was generated by this script:

#!/bin/sh

set -e

# The locations are derived from https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-resource-specification.html
curl https://dnwj8swjjbsbt.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json                                                       | gunzip  > CloudFormationResourceSpecification.njson;
curl https://d1uauaxba7bl26.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json                                                      | gunzip >> CloudFormationResourceSpecification.njson;
curl https://d68hl49wbnanq.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json                                                       | gunzip >> CloudFormationResourceSpecification.njson;
curl https://d201a2mn26r7lk.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json                                                      | gunzip >> CloudFormationResourceSpecification.njson;
curl https://cfn-resource-specifications-af-south-1-prod.s3.af-south-1.amazonaws.com/latest/gzip/CloudFormationResourceSpecification.json            | gunzip >> CloudFormationResourceSpecification.njson;
curl https://cfn-resource-specifications-ap-east-1-prod.s3.ap-east-1.amazonaws.com/latest/gzip/CloudFormationResourceSpecification.json              | gunzip >> CloudFormationResourceSpecification.njson;
curl https://cfn-resource-specifications-ap-southeast-3-prod.s3.ap-southeast-3.amazonaws.com/latest/CloudFormationResourceSpecification.json                  >> CloudFormationResourceSpecification.njson;
curl https://d2senuesg1djtx.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json                                                      | gunzip >> CloudFormationResourceSpecification.njson;
curl https://d2zq80gdmjim8k.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json                                                      | gunzip >> CloudFormationResourceSpecification.njson;
curl https://d1ane3fvebulky.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json                                                      | gunzip >> CloudFormationResourceSpecification.njson;
curl https://doigdx0kgq9el.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json                                                       | gunzip >> CloudFormationResourceSpecification.njson;
curl https://d2stg8d246z9di.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json                                                      | gunzip >> CloudFormationResourceSpecification.njson;
curl https://d33vqc0rt9ld30.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json                                                      | gunzip >> CloudFormationResourceSpecification.njson;
curl https://d2s8ygphhesbe7.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json                                                      | gunzip >> CloudFormationResourceSpecification.njson;
curl https://cfn-resource-specifications-cn-north-1-prod.s3.cn-north-1.amazonaws.com.cn/latest/gzip/CloudFormationResourceSpecification.json         | gunzip >> CloudFormationResourceSpecification.njson;
curl https://cfn-resource-specifications-cn-northwest-1-prod.s3.cn-northwest-1.amazonaws.com.cn/latest/gzip/CloudFormationResourceSpecification.json | gunzip >> CloudFormationResourceSpecification.njson;
curl https://d1mta8qj7i28i2.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json                                                      | gunzip >> CloudFormationResourceSpecification.njson;
curl https://d3teyb21fexa9r.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json                                                      | gunzip >> CloudFormationResourceSpecification.njson;
curl https://d1742qcu2c1ncx.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json                                                      | gunzip >> CloudFormationResourceSpecification.njson;
curl https://d2d0mfegowb3wk.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json                                                      | gunzip >> CloudFormationResourceSpecification.njson;
curl https://diy8iv58sj6ba.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json                                                       | gunzip >> CloudFormationResourceSpecification.njson;
curl https://cfn-resource-specifications-eu-south-1-prod.s3.eu-south-1.amazonaws.com/latest/gzip/CloudFormationResourceSpecification.json            | gunzip >> CloudFormationResourceSpecification.njson;
curl https://cfn-resource-specifications-me-south-1-prod.s3.me-south-1.amazonaws.com/latest/gzip/CloudFormationResourceSpecification.json            | gunzip >> CloudFormationResourceSpecification.njson;
curl https://d3c9jyj3w509b0.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json                                                      | gunzip >> CloudFormationResourceSpecification.njson;
curl https://s3.us-gov-east-1.amazonaws.com/cfn-resource-specifications-us-gov-east-1-prod/latest/CloudFormationResourceSpecification.json                    >> CloudFormationResourceSpecification.njson;
curl https://s3.us-gov-west-1.amazonaws.com/cfn-resource-specifications-us-gov-west-1-prod/latest/CloudFormationResourceSpecification.json                    >> CloudFormationResourceSpecification.njson;

cat CloudFormationResourceSpecification.njson | jq -r '.ResourceTypes | keys_unsorted[] as $resourceKey | { "name": "\($resourceKey)", "tags": ."\($resourceKey)".Properties.Tags } | select( ."tags" == null)|.name' | sort -u;

@scottschreckengaust
Copy link
Author

scottschreckengaust commented Oct 24, 2024

Updated script for eight more regions and storing output individually for deeper inspection and troubleshooting:

#!/bin/sh

## The locations are derived from https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-resource-specification.html
curl "https://dnwj8swjjbsbt.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_us-east-2.json" 
curl "https://d1uauaxba7bl26.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_us-east-1.json" 
curl "https://d68hl49wbnanq.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_us-west-1.json" 
curl "https://d201a2mn26r7lk.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_us-west-2.json" 
curl "https://cfn-resource-specifications-af-south-1-prod.s3.af-south-1.amazonaws.com/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_af-south-1.json" 
curl "https://cfn-resource-specifications-ap-east-1-prod.s3.ap-east-1.amazonaws.com/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_ap-east-1.json" 
curl "https://cfn-resource-specifications-ap-south-2-prod.s3.ap-south-2.amazonaws.com/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_ap-south-2.json" 
curl "https://cfn-resource-specifications-ap-southeast-3-prod.s3.ap-southeast-3.amazonaws.com/latest/CloudFormationResourceSpecification.json"  > "CloudFormationResourceSpecification_ap-southeast-3.json" 
curl "https://cfn-resource-specifications-ap-southeast-5-prod.s3.ap-southeast-5.amazonaws.com/latest/CloudFormationResourceSpecification.json"  > "CloudFormationResourceSpecification_ap-southeast-5.json" 
curl "https://cfn-resource-specifications-ap-southeast-4-prod.s3.ap-southeast-4.amazonaws.com/latest/CloudFormationResourceSpecification.json"  > "CloudFormationResourceSpecification_ap-southeast-4.json" 
curl "https://d2senuesg1djtx.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_ap-south-1.json" 
curl "https://d2zq80gdmjim8k.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_ap-northeast-3.json" 
curl "https://d1ane3fvebulky.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_ap-northeast-2.json" 
curl "https://doigdx0kgq9el.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_ap-southeast-1.json" 
curl "https://d2stg8d246z9di.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_ap-southeast-2.json" 
curl "https://d33vqc0rt9ld30.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_ap-northeast-1.json" 
curl "https://d2s8ygphhesbe7.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_ca-central-1.json" 
curl "https://cfn-resource-specifications-ca-west-1-prod.s3.ca-west-1.amazonaws.com/latest/CloudFormationResourceSpecification.json"  > "CloudFormationResourceSpecification_ca-west-1.json" 
curl "https://cfn-resource-specifications-cn-north-1-prod.s3.cn-north-1.amazonaws.com.cn/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_cn-north-1.json" 
curl "https://cfn-resource-specifications-cn-northwest-1-prod.s3.cn-northwest-1.amazonaws.com.cn/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_cn-northwest-1.json" 
curl "https://d1mta8qj7i28i2.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_eu-central-1.json" 
curl "https://d3teyb21fexa9r.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_eu-west-1.json" 
curl "https://d1742qcu2c1ncx.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_eu-west-2.json" 
curl "https://cfn-resource-specifications-eu-south-1-prod.s3.eu-south-1.amazonaws.com/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_eu-south-1.json" 
curl "https://d2d0mfegowb3wk.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_eu-west-3.json" 
curl "https://cfn-resource-specifications-eu-south-2-prod.s3.eu-south-2.amazonaws.com/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_eu-south-2.json" 
curl "https://diy8iv58sj6ba.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_eu-north-1.json" 
curl "https://cfn-resource-specifications-eu-central-2-prod.s3.eu-central-2.amazonaws.com/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_eu-central-2.json" 
curl "https://cfn-resource-specifications-il-central-1-prod.s3.il-central-1.amazonaws.com/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_il-central-1.json" 
curl "https://cfn-resource-specifications-me-south-1-prod.s3.me-south-1.amazonaws.com/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_me-south-1.json" 
curl "https://cfn-resource-specifications-me-central-1-prod.s3.me-central-1.amazonaws.com/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_me-central-1.json" 
curl "https://d3c9jyj3w509b0.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json" | gunzip > "CloudFormationResourceSpecification_sa-east-1.json" 
curl "https://s3.us-gov-east-1.amazonaws.com/cfn-resource-specifications-us-gov-east-1-prod/latest/CloudFormationResourceSpecification.json"  > "CloudFormationResourceSpecification_us-gov-east-1.json" 
curl "https://s3.us-gov-west-1.amazonaws.com/cfn-resource-specifications-us-gov-west-1-prod/latest/CloudFormationResourceSpecification.json"  > "CloudFormationResourceSpecification_us-gov-west-1.json" 

## Get all Resource and if there are Tags defined with their Region
find . -name "CloudFormationResourceSpecification_*-*.json" -print0 | xargs -0 -I{} jq -r '.ResourceTypes | keys_unsorted[] as $resourceKey | { "name": "\($resourceKey)", "tags": ."\($resourceKey)".Properties.Tags } | {"name": .name, "tags": (.tags == null), "region": (input_filename |match(".*\\/(.*)\\.json") | .captures[0].string)}' {} | jq --slurp > ResourceTagsByRegion.json

## Print all resources that have no tags defined in a format for https://github.com/aws-cloudformation/cloudformation-guard exclusions
jq -r '.[]|select(."tags" == false)|.name' ResourceTagsByRegion.json | sort -u | sed -e 's/^/    \//g' | sed -e 's/$/\/,/g'

Based on October 24, 2024 review
Not ALL resources must have tags, just the DynamoDB Tables.
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant