serverless-tag-resources 3.0.0 → 3.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "serverless-tag-resources",
-  "version": "3.0.0",
+  "version": "3.1.0",
   "description": "Datamart: Tag all AWS resources with dual legacy + datamart:* tag support",
   "main": "index.js",
   "files": [
@@ -14,7 +14,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+ssh://git@bitbucket.org:datamartcl/dm-serverless-tag-resources-plugin.git"
+    "url": "git+ssh://git@bitbucket.org/datamartcl/dm-serverless-tag-resources-plugin.git"
   },
   "keywords": [
     "serverless",

package/src/post-deploy/untag.js

@@ -0,0 +1,97 @@
+"use strict";
+
+const {
+  ResourceGroupsTaggingAPIClient,
+  UntagResourcesCommand,
+} = require("@aws-sdk/client-resource-groups-tagging-api");
+const { getClient } = require("../aws-clients");
+
+/**
+ * Remove specific tags from all resources in a CloudFormation stack.
+ * Uses Resource Groups Tagging API for broad coverage across resource types.
+ *
+ * This is used to clean up tags injected by Serverless Framework (e.g., STAGE)
+ * that conflict with the datamart:* tagging policy.
+ */
+async function removeTagsFromStackResources(config, stackResources, tagKeysToRemove, partition, region, log) {
+  const taggingClient = getClient(ResourceGroupsTaggingAPIClient, config);
+
+  // Collect ARNs of all stack resources
+  const arns = [];
+  for (const resource of stackResources) {
+    const arn = buildArn(resource, partition, region);
+    if (arn) arns.push(arn);
+  }
+
+  if (arns.length === 0) {
+    log("TAGGING: No resources with ARNs to untag");
+    return;
+  }
+
+  // UntagResources accepts max 20 ARNs per call
+  const batchSize = 20;
+  let untagged = 0;
+
+  for (let i = 0; i < arns.length; i += batchSize) {
+    const batch = arns.slice(i, i + batchSize);
+    try {
+      await taggingClient.send(
+        new UntagResourcesCommand({
+          ResourceARNList: batch,
+          TagKeys: tagKeysToRemove,
+        })
+      );
+      untagged += batch.length;
+    } catch (err) {
+      // Some resource types don't support tagging API — skip gracefully
+      log(`TAGGING: WARN untag batch ${i}-${i + batch.length}: ${err.message}`);
+    }
+  }
+
+  log(`TAGGING: Removed [${tagKeysToRemove.join(", ")}] from ${untagged} resources`);
+}
+
+/**
+ * Build ARN from CloudFormation StackResource.
+ * Uses PhysicalResourceId which is usually the ARN or resource ID.
+ */
+function buildArn(resource, partition, region) {
+  const physicalId = resource.PhysicalResourceId;
+  if (!physicalId) return null;
+
+  // If it's already an ARN, use it directly
+  if (physicalId.startsWith("arn:")) return physicalId;
+
+  // For some resource types, we can construct the ARN
+  const accountId = extractAccountId(resource);
+  const type = resource.ResourceType;
+
+  const arnBuilders = {
+    "AWS::Lambda::Function": () =>
+      `arn:${partition}:lambda:${region}:${accountId}:function:${physicalId}`,
+    "AWS::SNS::Topic": () =>
+      `arn:${partition}:sns:${region}:${accountId}:${physicalId}`,
+    "AWS::SQS::Queue": () => null, // Queue URL, not name — skip
+    "AWS::Events::EventBus": () =>
+      `arn:${partition}:events:${region}:${accountId}:event-bus/${physicalId}`,
+    "AWS::Events::Rule": () => null, // Complex ARN — skip
+    "AWS::ApiGateway::RestApi": () =>
+      `arn:${partition}:apigateway:${region}::/restapis/${physicalId}`,
+    "AWS::Logs::LogGroup": () =>
+      `arn:${partition}:logs:${region}:${accountId}:log-group:${physicalId}`,
+  };
+
+  const builder = arnBuilders[type];
+  if (builder) return builder();
+
+  return null;
+}
+
+function extractAccountId(resource) {
+  // StackId contains the account ID
+  const stackId = resource.StackId || "";
+  const parts = stackId.split(":");
+  return parts.length >= 5 ? parts[4] : "";
+}
+
+module.exports = { removeTagsFromStackResources };

package/src/post-deploy-tagger.js

@@ -5,8 +5,9 @@ const {
   DescribeStackResourcesCommand,
 } = require("@aws-sdk/client-cloudformation");
 const { getClient } = require("./aws-clients");
-const { buildListTags, buildDictTags } = require("./tags");
+const { buildListTags, buildDictTags, TAGS_TO_REMOVE } = require("./tags");
 const { needsPostDeployTagging, DICT_BASED_TYPES, API_ONLY_TYPES, RELATED_TYPES } = require("./resource-classifier");
+const { removeTagsFromStackResources } = require("./post-deploy/untag");
 
 const { tagSSMParameter } = require("./post-deploy/ssm");
 const { tagPinpointApp } = require("./post-deploy/pinpoint");
@@ -90,6 +91,12 @@ async function updateTagsPostDeploy(config, stackName, stackTags, stage, partiti
       log(`TAGGING: ERROR post-deploy ${type} ${logicalId}: ${err.message}`);
     }
   }
+
+  // Remove unwanted tags injected by SFW (STAGE)
+  if (TAGS_TO_REMOVE.length > 0) {
+    log(`TAGGING: Removing unwanted tags: ${TAGS_TO_REMOVE.join(", ")}`);
+    await removeTagsFromStackResources(config, allResources, TAGS_TO_REMOVE, partition, region, log);
+  }
 }
 
 module.exports = { updateTagsPostDeploy };

package/src/tags.js

@@ -3,15 +3,19 @@
 /**
  * Tag building module.
  *
- * Produces both legacy (PascalCase) and new datamart:* tags
- * during the transition period. Auto-generates:
- *   - Stage / datamart:environment  (from deployment stage)
- *   - Resource / datamart:resource  (from CloudFormation LogicalID)
+ * Auto-generates datamart:* tags only (no legacy PascalCase):
+ *   - datamart:environment  (from deployment stage)
+ *   - datamart:resource     (from CloudFormation LogicalID)
+ *
+ * Legacy tags (Stage, Resource) removed in v3.1.0 per tagging policy v2.1.
  */
 
+// Tags injected by SFW that should be removed post-deploy
+const TAGS_TO_REMOVE = ["STAGE"];
+
 /**
  * Build list-based tags [{Key, Value}] for CloudFormation resources.
- * Merges stackTags + auto-generated tags. Does not overwrite existing keys.
+ * Merges stackTags + auto-generated datamart:* tags.
  */
 function buildListTags(stackTags, stage, logicalId) {
   const tags = [];
@@ -25,11 +29,9 @@ function buildListTags(stackTags, stage, logicalId) {
     }
   }
 
-  // Auto-generated pairs (legacy + datamart)
+  // Auto-generated datamart:* tags only
   const autoTags = [
-    { Key: "Stage", Value: stage },
     { Key: "datamart:environment", Value: stage },
-    { Key: "Resource", Value: logicalId },
     { Key: "datamart:resource", Value: logicalId },
   ];
 
@@ -57,10 +59,8 @@ function buildDictTags(stackTags, stage, logicalId) {
     }
   }
 
-  // Auto-generated pairs (legacy + datamart) — don't overwrite user-provided
-  if (!tags["Stage"]) tags["Stage"] = stage;
+  // Auto-generated datamart:* tags only — don't overwrite user-provided
   if (!tags["datamart:environment"]) tags["datamart:environment"] = stage;
-  if (!tags["Resource"]) tags["Resource"] = logicalId;
   if (!tags["datamart:resource"]) tags["datamart:resource"] = logicalId;
 
   return tags;
@@ -75,4 +75,4 @@ function excludeAwsTags(tags) {
   );
 }
 
-module.exports = { buildListTags, buildDictTags, excludeAwsTags };
+module.exports = { buildListTags, buildDictTags, excludeAwsTags, TAGS_TO_REMOVE };