Skip to content

v22.0.0 — Decoupled Build + Simplified Recovery Model

Choose a tag to compare

View all tags
@hyunsies hyunsies released this 12 Jun 05:35
· 24 commits to main since this release
v22.0.0
77be9de
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

MAJOR. Retroactive release covering PRs #89–#102 (2026-05-06 through 2026-06-12). Three breaking changes — read the upgrade notes.

Breaking

  • Source decoupling (#89, #91). The deployable YAML and configurator.html are now generated from modular src/ files via npm run build. The hand-maintained map2-auto-tagger-optimized.yaml monolith is gone; CI fails any PR whose committed artifacts are stale. Forks that patched the YAML directly must re-apply changes against src/. Developer guide: docs/DEVELOPMENT.md.
  • Reconciliation Lambda removed (#95). The real-time tagger with SQS buffering (14-day retention, 5 retries × 180s) is the sole tagging path. DLQ events no longer self-heal — operators must redrive the DLQ after resolving the cause. Long-provisioning resources (notably AWS Managed Microsoft AD, 25–45 min) exhaust the 900s retry budget and require manual redrive; see LIMITATIONS.md.
  • Edit and Upgrade configurator flows disabled (#97–#99). Upgrade reset scoped_account_ids to ["ALL"] on templates predating the new CFN parameters; Edit was incompatible with the !Sub-based SSM config. Day-2 account add/remove is via CloudShell update-stack-set commands (INSTRUCTIONS.md); upgrades are delete-and-redeploy.

Changed

  • SSM MapConfig built from CFN parameters (ScopedAccountIds, ScopedVpcIds, TagNonVpcServices) via !Sub — stack updates with UsePreviousValue preserve real customer scope (#95).
  • StackSet AutoDeployment always enabled (#93). CloudFormation stacks no longer tagged (#92, not MAP-eligible). MPE ID length limit removed; CFN MpeId MaxLength 20 → 44 (#94, #96).

Added

  • FSx for NetApp ONTAP volume tagging via CreateVolume (#100). CloudFront CreateDistribution handler (#96).

Fixed

  • Kinesis silent tag loss (#102). AWS began emitting a malformed resources-array ARN on CreateStream events (stream name in the account-ID field, literal null as the resource name); the generic ARN scan trusted it verbatim, so every Kinesis Data Stream silently lost its tag — no DLQ, no alert. A new well-formedness gate rejects structurally invalid resources-array ARNs and falls through to the dedicated per-service handlers. Live-verified. This was an AWS-side event-shape change, not a regression.
  • CT5 chaos-test fixes (#96): SSM config cache invalidation on fetch failure; delete-flow log-group guard; per-failure SNS alert flood replaced with a CloudWatch Logs Insights query in the DLQ alarm description.

Full details in CHANGELOG.md.

🤖 Generated with Claude Code

Assets 2
Loading