v22.1.0 — Gate-Certified: CT6 Blockers Closed + Create-Race & Preflight Fixes

Certified by two full 36-phase release-gate runs (2026-07-18/19) at 4b72b9b — zero product blockers after triage.

Highlights

Tag-loss classes closed:

• Create-race not-found (#114): resources whose tag call raced their own provisioning (burst creates) were permanently untagged; not-found errors within 10 min of eventTime now retry.
• Broken day-2 config (CT6-005, #117): malformed SSM config now retries into the DLQ + alarm instead of silently acking every in-scope event.
• 13 handler fixes from golden-event replay verification, plus a coverage gate: all 158 handler branches live-tagged, replayed, or ledgered — CI-enforced.

Deploy/preflight hardening:

• Org migration no-op (CT6-004, #118): the documented v21→v22 org migration could deploy zero taggers while printing success — now fails loudly with remediation.
• SCP preflight fixed for role/SSO callers (#123): the tag:TagResources SCP check silently never ran for assumed-role deployers.
• Per-account CloudTrail preflight (#112), derived-IAM-name length validation (CT6-006, #115), StackSet peer detection (CT6-007, #115).

Operational fixes:

• Centralized per-region SNS alerts for org deployments (#108) + CT6-003 KMS fix (alerts were silently dead in v21/v22.0.0).
• Backfill time budget (#116) + wait-sentinel fix (#121 — no more guaranteed 20-min idle burn).
• delete.sh exit-code fix (#120), delete-form MPE truncation fix (#113).

Upgrading

Single-account: re-run deploy.sh or use upgrade.sh. Multi-account org deployments migrating from v21: follow INSTRUCTIONS.md — the admin stack must be deleted before re-deploying (see CT6-004 notes).

Full details in CHANGELOG.md.

v22.0.0 — Decoupled Build + Simplified Recovery Model

MAJOR. Retroactive release covering PRs #89–#102 (2026-05-06 through 2026-06-12). Three breaking changes — read the upgrade notes.

Breaking

• Source decoupling (#89, #91). The deployable YAML and configurator.html are now generated from modular src/ files via npm run build. The hand-maintained map2-auto-tagger-optimized.yaml monolith is gone; CI fails any PR whose committed artifacts are stale. Forks that patched the YAML directly must re-apply changes against src/. Developer guide: docs/DEVELOPMENT.md.
• Reconciliation Lambda removed (#95). The real-time tagger with SQS buffering (14-day retention, 5 retries × 180s) is the sole tagging path. DLQ events no longer self-heal — operators must redrive the DLQ after resolving the cause. Long-provisioning resources (notably AWS Managed Microsoft AD, 25–45 min) exhaust the 900s retry budget and require manual redrive; see LIMITATIONS.md.
• Edit and Upgrade configurator flows disabled (#97–#99). Upgrade reset scoped_account_ids to ["ALL"] on templates predating the new CFN parameters; Edit was incompatible with the !Sub-based SSM config. Day-2 account add/remove is via CloudShell update-stack-set commands (INSTRUCTIONS.md); upgrades are delete-and-redeploy.

Changed

• SSM MapConfig built from CFN parameters (ScopedAccountIds, ScopedVpcIds, TagNonVpcServices) via !Sub — stack updates with UsePreviousValue preserve real customer scope (#95).
• StackSet AutoDeployment always enabled (#93). CloudFormation stacks no longer tagged (#92, not MAP-eligible). MPE ID length limit removed; CFN MpeId MaxLength 20 → 44 (#94, #96).

Added

• FSx for NetApp ONTAP volume tagging via CreateVolume (#100). CloudFront CreateDistribution handler (#96).

Fixed

• Kinesis silent tag loss (#102). AWS began emitting a malformed resources-array ARN on CreateStream events (stream name in the account-ID field, literal null as the resource name); the generic ARN scan trusted it verbatim, so every Kinesis Data Stream silently lost its tag — no DLQ, no alert. A new well-formedness gate rejects structurally invalid resources-array ARNs and falls through to the dedicated per-service handlers. Live-verified. This was an AWS-side event-shape change, not a regression.
• CT5 chaos-test fixes (#96): SSM config cache invalidation on fetch failure; delete-flow log-group guard; per-failure SNS alert flood replaced with a CloudWatch Logs Insights query in the DLQ alarm description.

Full details in CHANGELOG.md.

🤖 Generated with Claude Code

v21.0.7 — PreflightLogGroup orphan fix + VPC-scope reconciliation leak

Two correctness fixes:

1. PreflightLogGroup orphan race — removed explicit PreflightLogGroup CFN resource. Prevents AlreadyExists error on StackSet cross-region redeploy after delete. Root cause of the MA8-use1 failure.

2. VPC-scope reconciliation leak — added _VPC_BOUND service set to is_in_scope. VPC-bound services (EC2, RDS, ElastiCache, etc.) now fail closed when VPC ID is unresolvable, preventing reconciliation from converting VPC scope into account scope on the nightly sweep. Also restores tag_non_vpc_services toggle in standalone YAML.

Validation: Layer 1 CI 17/17, E2E 37/37, CT3 chaos test 123 TAGGED with 0 new regressions.

See CHANGELOG.md for full details.

v20.3.0 — Tier 1 MAP service handlers (Keyspaces + Directory Service + CloudHSM v2)

Summary

Adds auto-tagging coverage for three MAP 2.0 Included Services that previously had zero handler coverage in the Lambda. Customers in affected verticals were silently losing credits.

New handlers

• Amazon Keyspaces — CreateKeyspace (cassandra.amazonaws.com)
• AWS Directory Service — CreateDirectory (Simple AD), CreateMicrosoftAD (Managed Microsoft AD)
• AWS CloudHSM v2 — CreateCluster, CreateHsm (HSMs tag through the parent cluster ARN)

IAM additions

• ds:AddTagsToResource
• cloudhsm:TagResource

cassandra:TagResource was already granted.

Native tag API dispatch

Resource Groups Tagging API coverage for these services is inconsistent, so all three dispatch to the native tag APIs — each with a different shape:

Service	API	Resource identifier	Tag shape
Keyspaces	keyspaces.tag_resource	resourceArn=<ARN>	[{key, value}] (lowercase)
Directory Service	ds.add_tags_to_resource	ResourceId=<directory_id>	[{Key, Value}]
CloudHSM v2	cloudhsmv2.tag_resource	ResourceId=<cluster_id>	TagList=[{Key, Value}]

Collision safety

All new handlers are guarded by event_source ==. The cloudhsmv2.amazonaws.com guard disambiguates CreateCluster from existing redshift/memorydb/dax/eks/MSK handlers.

Intentional deferrals

• AD Connector (ConnectDirectory) — requires broader EventBridge prefix expansion
• Keyspaces CreateTable — collides with Glue/DynamoDB/Timestream
• E2E fixtures — CloudHSM init is 10–15 min; dedicated fixture PR to follow

Upgrade notes

• MINOR bump (v20.2.0 → v20.3.0): new capability, no breaking change
• No customer action required to pick up new handlers on existing deployments — re-run deploy.sh or update.sh to apply the new template version
• Handler baseline: 149 → 154 (+5 new, E2E coverage follow-up pending)

Validation

• ✅ 50/50 CI checks passed first-try (including full Layer 2 E2E across 7 accounts)
• ✅ All existing handlers unaffected — no regressions
• Native API shapes verified via boto3 service model

PR #25

v20.2.0 — AutoDeployment conditional + cross-MPE conflict detection

What's Changed

• feat: AutoDeployment conditional + cross-MPE conflict detection (v20.2.0) by @hyunsies in #24

Full Changelog: v20.1.0...v20.2.0

v20.1.0 — version visibility + batched IAM preflight + stack-state preflight

First release under the new SemVer policy (see VERSIONING.md). MINOR bump from the v20 baseline — new capabilities, safe in-place update for existing deployments.

What's new

Version visibility

• New CFN AWS::SSM::Parameter at /auto-map-tagger/${MpeId}/version
• New CFN stack Output TemplateVersion
• Lambda cold-start log: auto-map-tagger v20.1.0 cold start

Zero outbound calls — version is pinned at deploy time, readable via aws ssm get-parameter, describe-stacks --query "Stacks[0].Outputs", or CloudWatch Logs.

Batched deploy-time IAM preflight

Extends deploy.sh to simulate the 21 IAM actions the deploy itself needs (CFN + IAM + Lambda + Events + SQS + SSM + Logs + SNS + S3) in a single iam:simulate-principal-policy call (~200ms). Multi-account mode adds 5 StackSets + Organizations actions for 26 total.

Fails on both explicitDeny (SCP blocks) and implicitDeny (principal missing grant). Replaces the 15-min-into-deploy AccessDenied-tarpit with a ~200ms fast fail + per-action remediation.

Correctly handles both IAM users and assumed-role (SSO) callers — the latter required converting the session ARN to the role ARN before passing to simulate-principal-policy.

Stack-state preflight

deploy.sh previously fell through to update-stack for any existing stack state that wasn't NOT_FOUND, DELETE_COMPLETE, or ROLLBACK_COMPLETE. Customers hit stuck states (*_IN_PROGRESS, UPDATE_ROLLBACK_FAILED, ROLLBACK_FAILED, DELETE_FAILED) and got cryptic CFN errors.

New preflight catches the four failure classes with specific remediation commands — including the exact continue-update-rollback invocation for stuck update rollbacks.

For existing customers

Safe in-place update. Re-run deploy.sh from the configurator to get v20.1.0. No breaking changes.

Manual validation

Six end-to-end tests run against the single-account test environment:

• Rendering: ✅ single (21 actions) + multi (26 actions)
• Admin happy path: ✅
• Under-privileged assumed role: ✅ all 20 missing permissions caught (caught a bug during testing where the assumed-role ARN needed translation to role ARN for simulate-principal-policy)
• Stack state ROLLBACK_COMPLETE: ✅ passes through (deploy.sh auto-recovers)
• Stack state CREATE_IN_PROGRESS: ✅ fails with remediation
• Stack state ROLLBACK_FAILED: ✅ fails with remediation
• Empty caller ARN fail-safe: ✅ warns and continues

Full diff

See PR #23: #23