From a0b47c5b530abe13b547d7263f437997148eb630 Mon Sep 17 00:00:00 2001
From: Otavio Macedo <288203+otaviomacedo@users.noreply.github.com>
Date: Sun, 17 Nov 2024 22:15:47 +0000
Subject: [PATCH] fix(cli): the LoadBalancerProvider doesn't match LBs when
 querying by a subset of tags (#32164)

There was a regression in the load balancer lookup, in which we started
requiring that the set of tags in the query is strictly the same as the
set of tags in the load balancer (rather than merely a subset of it).

Remove the length equality constraint and also simplify the code to make
the intent clearer.

Fixes https://github.com/aws/aws-cdk/issues/32161.

### Checklist
- [ ] My code adheres to the [CONTRIBUTING
GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and
[DESIGN
GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache-2.0 license*

Co-authored-by: Momo Kornher <kornherm@amazon.co.uk>
---
 .../lib/context-providers/load-balancers.ts   | 15 +++---
 .../context-providers/load-balancers.test.ts  | 46 +++++++++++++++++++
 2 files changed, 52 insertions(+), 9 deletions(-)

diff --git a/packages/aws-cdk/lib/context-providers/load-balancers.ts b/packages/aws-cdk/lib/context-providers/load-balancers.ts
index 5441a118fa210..f9f2e53089295 100644
--- a/packages/aws-cdk/lib/context-providers/load-balancers.ts
+++ b/packages/aws-cdk/lib/context-providers/load-balancers.ts
@@ -160,15 +160,12 @@ class LoadBalancerProvider {
     }
     return (await this.describeTags(loadBalancers.map((lb) => lb.LoadBalancerArn!)))
       .filter((tagDescription) => {
-        return (
-          tagDescription.Tags?.length === this.filter.loadBalancerTags?.length &&
-          tagDescription.Tags?.filter(
-            (tag) =>
-              !this.filter.loadBalancerTags!.some((filter) => {
-                return filter.key === tag.Key && filter.value === tag.Value;
-              }),
-          ).length === 0
-        );
+        // For every tag in the filter, there is some tag in the LB that matches it.
+        // In other words, the set of tags in the filter is a subset of the set of tags in the LB.
+        return this.filter.loadBalancerTags!.every((filter) => {
+          return tagDescription.Tags?.some((tag) =>
+            filter.key === tag.Key && filter.value === tag.Value);
+        });
       })
       .flatMap((tag) => loadBalancers.filter((loadBalancer) => tag.ResourceArn === loadBalancer.LoadBalancerArn));
   }
diff --git a/packages/aws-cdk/test/context-providers/load-balancers.test.ts b/packages/aws-cdk/test/context-providers/load-balancers.test.ts
index 7ccb952a75ee1..c3ffa75e8d7a3 100644
--- a/packages/aws-cdk/test/context-providers/load-balancers.test.ts
+++ b/packages/aws-cdk/test/context-providers/load-balancers.test.ts
@@ -199,6 +199,52 @@ describe('load balancer context provider plugin', () => {
     });
   });
 
+  test('looks up by tags - query by subset', async () => {
+    // GIVEN
+    mockElasticLoadBalancingV2Client
+      .on(DescribeLoadBalancersCommand)
+      .resolves({
+        LoadBalancers: [
+          {
+            IpAddressType: 'ipv4',
+            LoadBalancerArn: 'arn:load-balancer2',
+            DNSName: 'dns2.example.com',
+            CanonicalHostedZoneId: 'Z1234',
+            SecurityGroups: ['sg-1234'],
+            VpcId: 'vpc-1234',
+            Type: 'application',
+          },
+        ],
+      })
+      .on(DescribeTagsCommand)
+      .resolves({
+        TagDescriptions: [
+          {
+            ResourceArn: 'arn:load-balancer2',
+            Tags: [
+              // Load balancer has two tags...
+              { Key: 'some', Value: 'tag' },
+              { Key: 'second', Value: 'tag2' },
+            ],
+          },
+        ],
+      });
+    const provider = new LoadBalancerContextProviderPlugin(mockSDK);
+
+    // WHEN
+    const result = await provider.getValue({
+      account: '1234',
+      region: 'us-east-1',
+      loadBalancerType: LoadBalancerType.APPLICATION,
+      loadBalancerTags: [
+        // ...but we are querying for only one of them
+        { key: 'second', value: 'tag2' },
+      ],
+    });
+
+    expect(result.loadBalancerArn).toEqual('arn:load-balancer2');
+  });
+
   test('filters by type', async () => {
     // GIVEN
     mockElasticLoadBalancingV2Client