serverless-tag-resources 3.0.0 → 3.1.1

package/index.js

@@ -2,8 +2,10 @@
 
 const { tagResources } = require("./src/template-tagger");
 const { updateTagsPostDeploy } = require("./src/post-deploy-tagger");
+const { removeUnwantedTags } = require("./src/post-deploy/untag");
 const { validateTags } = require("./src/validation");
 const { configFromProvider } = require("./src/aws-clients");
+const { TAGS_TO_REMOVE } = require("./src/tags");
 
 class TagResourcesServerlessPlugin {
   constructor(serverless, options) {
@@ -77,6 +79,7 @@ class TagResourcesServerlessPlugin {
     const awsProvider = this.serverless.getProvider("aws");
     const stackName = awsProvider.naming.getStackName();
 
+    // Phase 1: Tag resources that CF doesn't cover natively
     await updateTagsPostDeploy(
       this.awsConfig,
       stackName,
@@ -87,6 +90,16 @@ class TagResourcesServerlessPlugin {
       this._log.bind(this)
     );
 
+    // Phase 2: Remove unwanted tags (STAGE injected by SFW)
+    if (TAGS_TO_REMOVE.length > 0) {
+      await removeUnwantedTags(
+        this.awsConfig,
+        stackName,
+        TAGS_TO_REMOVE,
+        this._log.bind(this)
+      );
+    }
+
     this._log("TAGGING: Post-deploy tagging complete");
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "serverless-tag-resources",
-  "version": "3.0.0",
+  "version": "3.1.1",
   "description": "Datamart: Tag all AWS resources with dual legacy + datamart:* tag support",
   "main": "index.js",
   "files": [
@@ -14,7 +14,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+ssh://git@bitbucket.org:datamartcl/dm-serverless-tag-resources-plugin.git"
+    "url": "git+ssh://git@bitbucket.org/datamartcl/dm-serverless-tag-resources-plugin.git"
   },
   "keywords": [
     "serverless",
@@ -35,7 +35,8 @@
     "@aws-sdk/client-firehose": "^3.700.0",
     "@aws-sdk/client-pinpoint": "^3.700.0",
     "@aws-sdk/client-rds": "^3.700.0",
-    "@aws-sdk/client-ssm": "^3.700.0"
+    "@aws-sdk/client-ssm": "^3.700.0",
+    "@aws-sdk/client-resource-groups-tagging-api": "^3.700.0"
   },
   "devDependencies": {
     "jest": "^30.3.0"

package/src/post-deploy/untag.js

@@ -0,0 +1,122 @@
+"use strict";
+
+const {
+  ResourceGroupsTaggingAPIClient,
+  UntagResourcesCommand,
+} = require("@aws-sdk/client-resource-groups-tagging-api");
+const {
+  CloudFormationClient,
+  DescribeStacksCommand,
+  DescribeStackResourcesCommand,
+} = require("@aws-sdk/client-cloudformation");
+const { getClient } = require("../aws-clients");
+
+/**
+ * Remove unwanted tags from the stack itself and all its resources.
+ * Uses Resource Groups Tagging API (UntagResources) which works on
+ * both CF stacks and individual resources.
+ *
+ * This runs post-deploy to clean up tags injected by SFW (e.g., STAGE)
+ * that we cannot prevent at template/deploy time.
+ */
+async function removeUnwantedTags(config, stackName, tagKeysToRemove, log) {
+  const cfnClient = getClient(CloudFormationClient, config);
+  const taggingClient = getClient(ResourceGroupsTaggingAPIClient, config);
+
+  // Collect ARNs: stack + all resources
+  const arns = [];
+
+  // 1. Get stack ARN
+  const stackResult = await cfnClient.send(
+    new DescribeStacksCommand({ StackName: stackName })
+  );
+  const stackArn = stackResult.Stacks?.[0]?.StackId;
+  if (stackArn) arns.push(stackArn);
+
+  // 2. Get all resource ARNs
+  const resourceResult = await cfnClient.send(
+    new DescribeStackResourcesCommand({ StackName: stackName })
+  );
+  for (const resource of resourceResult.StackResources || []) {
+    const arn = resolveArn(resource);
+    if (arn) arns.push(arn);
+  }
+
+  if (arns.length === 0) return;
+
+  // UntagResources accepts max 20 ARNs per call
+  const batchSize = 20;
+  let untagged = 0;
+  let failed = 0;
+
+  for (let i = 0; i < arns.length; i += batchSize) {
+    const batch = arns.slice(i, i + batchSize);
+    try {
+      const result = await taggingClient.send(
+        new UntagResourcesCommand({
+          ResourceARNList: batch,
+          TagKeys: tagKeysToRemove,
+        })
+      );
+      const failures = Object.keys(result.FailedResourcesMap || {}).length;
+      untagged += batch.length - failures;
+      failed += failures;
+    } catch (err) {
+      // Some resource types don't support tagging API — skip
+      failed += batch.length;
+    }
+  }
+
+  log(`TAGGING: Removed [${tagKeysToRemove.join(", ")}] from ${untagged} resources (${failed} skipped)`);
+}
+
+/**
+ * Resolve the ARN of a stack resource.
+ * PhysicalResourceId is sometimes the ARN, sometimes just the name/ID.
+ */
+function resolveArn(resource) {
+  const physicalId = resource.PhysicalResourceId;
+  if (!physicalId) return null;
+
+  // Already an ARN
+  if (physicalId.startsWith("arn:")) return physicalId;
+
+  // Extract account from stack ARN
+  const stackId = resource.StackId || "";
+  const parts = stackId.split(":");
+  if (parts.length < 5) return null;
+  const partition = parts[1];
+  const region = parts[3];
+  const account = parts[4];
+
+  // Build ARN by resource type
+  const type = resource.ResourceType;
+  const builders = {
+    "AWS::Lambda::Function": () =>
+      `arn:${partition}:lambda:${region}:${account}:function:${physicalId}`,
+    "AWS::SNS::Topic": () =>
+      `arn:${partition}:sns:${region}:${account}:${physicalId}`,
+    "AWS::Events::EventBus": () =>
+      `arn:${partition}:events:${region}:${account}:event-bus/${physicalId}`,
+    "AWS::Logs::LogGroup": () =>
+      `arn:${partition}:logs:${region}:${account}:log-group:${physicalId}`,
+    "AWS::IAM::Role": () =>
+      `arn:${partition}:iam::${account}:role/${physicalId}`,
+    "AWS::IAM::ManagedPolicy": () =>
+      `arn:${partition}:iam::${account}:policy/${physicalId}`,
+    "AWS::S3::Bucket": () =>
+      `arn:${partition}:s3:::${physicalId}`,
+    "AWS::SSM::Parameter": () =>
+      `arn:${partition}:ssm:${region}:${account}:parameter${physicalId.startsWith("/") ? "" : "/"}${physicalId}`,
+    "AWS::KMS::Key": () =>
+      `arn:${partition}:kms:${region}:${account}:key/${physicalId}`,
+    "AWS::KMS::Alias": () => null, // aliases don't support tagging
+    "AWS::CodeBuild::Project": () =>
+      `arn:${partition}:codebuild:${region}:${account}:project/${physicalId}`,
+  };
+
+  const builder = builders[type];
+  return builder ? builder() : null;
+}
+
+module.exports = { removeUnwantedTags };

package/src/post-deploy-tagger.js

@@ -90,6 +90,7 @@ async function updateTagsPostDeploy(config, stackName, stackTags, stage, partiti
       log(`TAGGING: ERROR post-deploy ${type} ${logicalId}: ${err.message}`);
     }
   }
+
 }
 
 module.exports = { updateTagsPostDeploy };

package/src/tags.js

@@ -3,15 +3,19 @@
 /**
  * Tag building module.
  *
- * Produces both legacy (PascalCase) and new datamart:* tags
- * during the transition period. Auto-generates:
- *   - Stage / datamart:environment  (from deployment stage)
- *   - Resource / datamart:resource  (from CloudFormation LogicalID)
+ * Auto-generates datamart:* tags only (no legacy PascalCase):
+ *   - datamart:environment  (from deployment stage)
+ *   - datamart:resource     (from CloudFormation LogicalID)
+ *
+ * Legacy tags (Stage, Resource) removed in v3.1.0 per tagging policy v2.1.
  */
 
+// Tags injected by SFW that should be removed post-deploy
+const TAGS_TO_REMOVE = ["STAGE"];
+
 /**
  * Build list-based tags [{Key, Value}] for CloudFormation resources.
- * Merges stackTags + auto-generated tags. Does not overwrite existing keys.
+ * Merges stackTags + auto-generated datamart:* tags.
  */
 function buildListTags(stackTags, stage, logicalId) {
   const tags = [];
@@ -25,11 +29,9 @@ function buildListTags(stackTags, stage, logicalId) {
     }
   }
 
-  // Auto-generated pairs (legacy + datamart)
+  // Auto-generated datamart:* tags only
   const autoTags = [
-    { Key: "Stage", Value: stage },
     { Key: "datamart:environment", Value: stage },
-    { Key: "Resource", Value: logicalId },
     { Key: "datamart:resource", Value: logicalId },
   ];
 
@@ -57,10 +59,8 @@ function buildDictTags(stackTags, stage, logicalId) {
     }
   }
 
-  // Auto-generated pairs (legacy + datamart) — don't overwrite user-provided
-  if (!tags["Stage"]) tags["Stage"] = stage;
+  // Auto-generated datamart:* tags only — don't overwrite user-provided
   if (!tags["datamart:environment"]) tags["datamart:environment"] = stage;
-  if (!tags["Resource"]) tags["Resource"] = logicalId;
   if (!tags["datamart:resource"]) tags["datamart:resource"] = logicalId;
 
   return tags;
@@ -75,4 +75,4 @@ function excludeAwsTags(tags) {
   );
 }
 
-module.exports = { buildListTags, buildDictTags, excludeAwsTags };
+module.exports = { buildListTags, buildDictTags, excludeAwsTags, TAGS_TO_REMOVE };