serverless-tag-resources 3.1.1 → 3.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "serverless-tag-resources",
-  "version": "3.1.1",
+  "version": "3.1.2",
   "description": "Datamart: Tag all AWS resources with dual legacy + datamart:* tag support",
   "main": "index.js",
   "files": [

package/src/post-deploy/untag.js

@@ -10,20 +10,19 @@ const {
   DescribeStackResourcesCommand,
 } = require("@aws-sdk/client-cloudformation");
 const { getClient } = require("../aws-clients");
+const { SKIP_TYPES } = require("../resource-classifier");
 
 /**
  * Remove unwanted tags from the stack itself and all its resources.
  * Uses Resource Groups Tagging API (UntagResources) which works on
  * both CF stacks and individual resources.
  *
- * This runs post-deploy to clean up tags injected by SFW (e.g., STAGE)
- * that we cannot prevent at template/deploy time.
+ * No UpdateStack — only tag removal, zero infrastructure changes.
  */
 async function removeUnwantedTags(config, stackName, tagKeysToRemove, log) {
   const cfnClient = getClient(CloudFormationClient, config);
   const taggingClient = getClient(ResourceGroupsTaggingAPIClient, config);
 
-  // Collect ARNs: stack + all resources
   const arns = [];
 
   // 1. Get stack ARN
@@ -33,13 +32,18 @@ async function removeUnwantedTags(config, stackName, tagKeysToRemove, log) {
   const stackArn = stackResult.Stacks?.[0]?.StackId;
   if (stackArn) arns.push(stackArn);
 
-  // 2. Get all resource ARNs
+  // 2. Get resource ARNs (deduplicated, excluding types that don't support tags)
+  const seen = new Set();
   const resourceResult = await cfnClient.send(
     new DescribeStackResourcesCommand({ StackName: stackName })
   );
   for (const resource of resourceResult.StackResources || []) {
+    if (SKIP_TYPES.has(resource.ResourceType)) continue;
     const arn = resolveArn(resource);
-    if (arn) arns.push(arn);
+    if (arn && !seen.has(arn)) {
+      seen.add(arn);
+      arns.push(arn);
+    }
   }
 
   if (arns.length === 0) return;
@@ -47,7 +51,7 @@ async function removeUnwantedTags(config, stackName, tagKeysToRemove, log) {
   // UntagResources accepts max 20 ARNs per call
   const batchSize = 20;
   let untagged = 0;
-  let failed = 0;
+  let skipped = 0;
 
   for (let i = 0; i < arns.length; i += batchSize) {
     const batch = arns.slice(i, i + batchSize);
@@ -58,16 +62,16 @@ async function removeUnwantedTags(config, stackName, tagKeysToRemove, log) {
           TagKeys: tagKeysToRemove,
         })
       );
-      const failures = Object.keys(result.FailedResourcesMap || {}).length;
+      const failedMap = result.FailedResourcesMap || {};
+      const failures = Object.keys(failedMap).length;
       untagged += batch.length - failures;
-      failed += failures;
+      skipped += failures;
     } catch (err) {
-      // Some resource types don't support tagging API — skip
-      failed += batch.length;
+      skipped += batch.length;
     }
   }
 
-  log(`TAGGING: Removed [${tagKeysToRemove.join(", ")}] from ${untagged} resources (${failed} skipped)`);
+  log(`TAGGING: Removed [${tagKeysToRemove.join(", ")}] from ${untagged} resources (${skipped} skipped)`);
 }
 
 /**
@@ -98,21 +102,24 @@ function resolveArn(resource) {
       `arn:${partition}:sns:${region}:${account}:${physicalId}`,
     "AWS::Events::EventBus": () =>
       `arn:${partition}:events:${region}:${account}:event-bus/${physicalId}`,
+    "AWS::Events::Rule": () =>
+      `arn:${partition}:events:${region}:${account}:rule/${physicalId}`,
     "AWS::Logs::LogGroup": () =>
       `arn:${partition}:logs:${region}:${account}:log-group:${physicalId}`,
     "AWS::IAM::Role": () =>
       `arn:${partition}:iam::${account}:role/${physicalId}`,
-    "AWS::IAM::ManagedPolicy": () =>
-      `arn:${partition}:iam::${account}:policy/${physicalId}`,
     "AWS::S3::Bucket": () =>
       `arn:${partition}:s3:::${physicalId}`,
     "AWS::SSM::Parameter": () =>
       `arn:${partition}:ssm:${region}:${account}:parameter${physicalId.startsWith("/") ? "" : "/"}${physicalId}`,
     "AWS::KMS::Key": () =>
       `arn:${partition}:kms:${region}:${account}:key/${physicalId}`,
-    "AWS::KMS::Alias": () => null, // aliases don't support tagging
     "AWS::CodeBuild::Project": () =>
       `arn:${partition}:codebuild:${region}:${account}:project/${physicalId}`,
+    "AWS::ApiGateway::RestApi": () =>
+      `arn:${partition}:apigateway:${region}::/restapis/${physicalId}`,
+    "AWS::WAFv2::WebACL": () =>
+      `arn:${partition}:wafv2:${region}:${account}:regional/webacl/${physicalId}`,
   };
 
   const builder = builders[type];

package/src/resource-classifier.js

@@ -264,6 +264,7 @@ const SKIP_TYPES = new Set([
   // Glue
   "AWS::Glue::Database",
   "AWS::Glue::Classifier",
+  "AWS::Glue::Crawler",
   "AWS::Glue::Connection",
   "AWS::Glue::DataCatalogEncryptionSettings",
   "AWS::Glue::Partition",