v20.3.0 — Tier 1 MAP service handlers (Keyspaces + Directory Service + CloudHSM v2)

Summary

Adds auto-tagging coverage for three MAP 2.0 Included Services that previously had zero handler coverage in the Lambda. Customers in affected verticals were silently losing credits.

New handlers

• Amazon Keyspaces — CreateKeyspace (cassandra.amazonaws.com)
• AWS Directory Service — CreateDirectory (Simple AD), CreateMicrosoftAD (Managed Microsoft AD)
• AWS CloudHSM v2 — CreateCluster, CreateHsm (HSMs tag through the parent cluster ARN)

IAM additions

• ds:AddTagsToResource
• cloudhsm:TagResource

cassandra:TagResource was already granted.

Native tag API dispatch

Resource Groups Tagging API coverage for these services is inconsistent, so all three dispatch to the native tag APIs — each with a different shape:

Service	API	Resource identifier	Tag shape
Keyspaces	keyspaces.tag_resource	resourceArn=<ARN>	[{key, value}] (lowercase)
Directory Service	ds.add_tags_to_resource	ResourceId=<directory_id>	[{Key, Value}]
CloudHSM v2	cloudhsmv2.tag_resource	ResourceId=<cluster_id>	TagList=[{Key, Value}]

Collision safety

All new handlers are guarded by event_source ==. The cloudhsmv2.amazonaws.com guard disambiguates CreateCluster from existing redshift/memorydb/dax/eks/MSK handlers.

Intentional deferrals

• AD Connector (ConnectDirectory) — requires broader EventBridge prefix expansion
• Keyspaces CreateTable — collides with Glue/DynamoDB/Timestream
• E2E fixtures — CloudHSM init is 10–15 min; dedicated fixture PR to follow

Upgrade notes

• MINOR bump (v20.2.0 → v20.3.0): new capability, no breaking change
• No customer action required to pick up new handlers on existing deployments — re-run deploy.sh or update.sh to apply the new template version
• Handler baseline: 149 → 154 (+5 new, E2E coverage follow-up pending)

Validation

• ✅ 50/50 CI checks passed first-try (including full Layer 2 E2E across 7 accounts)
• ✅ All existing handlers unaffected — no regressions
• Native API shapes verified via boto3 service model

PR #25