Implement Provider Ignore Tags Functionality Across All Resources

[bflad]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

This issue is currently a placeholder for future work and should not be implemented at this time. The writeup here is dependent on the refactoring from #10688 and based off the proof of concept contained in #10418. The implementation details of this issue may change.

Historically, the Terraform AWS Provider has taken a holistic approach to managing resource tagging for a resource, by requiring complete management of all tag keys and values or ignoring them on a per-resource basis using the resource lifecycle configuration block ignore_changes functionality:

# Terraform 0.12 syntax
resource "aws_vpc" "example" {
  # ... other configuration ...

  lifecycle {
    ignore_changes = [tags]
  }
}

Especially in Terraform 0.12, the ability to ignore a specific tag key requires first configuring it.

Certain external systems such as Configuration Management Databases or Kubernetes deployments, may be creating and managing specific resource tags outside of Terraform's control to numerous resources, that operators do not wish to remove, ignore, or otherwise change.

To help in these situations, the Terraform AWS Provider in the future will support ignoring tags across all resources under a specific provider configuration, e.g.

# Proof of Concept implementation, both arguments are optional
provider "aws" {
  ignore_tags {
    key_prefixes = ["keyprefix"]
    keys         = ["exactkey"]
  }
}

For this functionality to work correctly across all resources, they each must implement some additional logic to get the provider-level ignore tags configuration and filter out those tags.

In the data source or resource Read function, the following can be added:

ignoreTagConfig := meta.(*AWSClient).IgnoreTagsConfig

Where the calls to save the tags attribute to the Terraform state, such as:

d.Set("tags", keyvaluetags.Ec2KeyValueTags(subnet.Tags).IgnoreAws().Map())

Can use the new variables to filter tags:

d.Set("tags", keyvaluetags.Ec2KeyValueTags(subnet.Tags).IgnoreAws().IgnoreConfig(ignoreTagsConfig).Map())

For completeness this can be checked via acceptance testing similar to the below, however in a pragmatic sense, the acceptance testing of the proof of concept resources cover the functionality already so this additional acceptance testing should likely not be considered a requirement for future resources.

func TestAccAWSVpc_ignoreTags(t *testing.T) {
	var providers []*schema.Provider
	var vpc ec2.Vpc
	resourceName := "aws_vpc.test"

	resource.ParallelTest(t, resource.TestCase{
		PreCheck:          func() { testAccPreCheck(t) },
		ProviderFactories: testAccProviderFactories(&providers),
		CheckDestroy:      testAccCheckVpcDestroy,
		Steps: []resource.TestStep{
			{
				Config: testAccVpcConfigTags,
				Check: resource.ComposeTestCheckFunc(
					testAccCheckVpcExists(resourceName, &vpc),
					testAccCheckVpcUpdateTags(&vpc, nil, map[string]string{"ignorekey1": "ignorevalue1"}),
				),
				ExpectNonEmptyPlan: true,
			},
			{
				Config:   testAccProviderConfigIgnoreTagPrefixes1("ignorekey") + testAccVpcConfigTags,
				PlanOnly: true,
			},
			{
				Config:   testAccProviderConfigIgnoreTags1("ignorekey1") + testAccVpcConfigTags,
				PlanOnly: true,
			},
		},
	})
}

func testAccCheckVpcUpdateTags(vpc *ec2.Vpc, oldTags, newTags map[string]string) resource.TestCheckFunc {
	return func(s *terraform.State) error {
		conn := testAccProvider.Meta().(*AWSClient).ec2conn

		return keyvaluetags.Ec2UpdateTags(conn, aws.StringValue(vpc.VpcId), oldTags, newTags)
	}
}

Affected Resource(s)

The maintainers will decide if these should be completed all at once or in another manner.

• aws/data_source_aws_acmpca_certificate_authority.go
• aws/data_source_aws_ami.go
• aws/data_source_aws_cloudformation_stack.go
• aws/data_source_aws_customer_gateway.go
• aws/data_source_aws_db_cluster_snapshot.go
• aws/data_source_aws_db_instance.go
• aws/data_source_aws_dynamodb_table.go
• aws/data_source_aws_ebs_snapshot.go
• aws/data_source_aws_ebs_volume.go
• aws/data_source_aws_ec2_transit_gateway.go
• aws/data_source_aws_ec2_transit_gateway_dx_gateway_attachment.go
• aws/data_source_aws_ec2_transit_gateway_route_table.go
• aws/data_source_aws_ec2_transit_gateway_vpc_attachment.go
• aws/data_source_aws_ec2_transit_gateway_vpn_attachment.go
• aws/data_source_aws_ecr_repository.go
• aws/data_source_aws_efs_file_system.go
• aws/data_source_aws_eip.go
• aws/data_source_aws_eks_cluster.go
• aws/data_source_aws_elasticache_cluster.go
• aws/data_source_aws_elasticsearch_domain.go
• aws/data_source_aws_elb.go
• aws/data_source_aws_instance.go
• aws/data_source_aws_internet_gateway.go
• aws/data_source_aws_kinesis_stream.go
• aws/data_source_aws_lambda_function.go
• aws/data_source_aws_launch_template.go
• aws/data_source_aws_lb.go
• aws/data_source_aws_lb_target_group.go
• aws/data_source_aws_mq_broker.go
• aws/data_source_aws_msk_cluster.go
• aws/data_source_aws_nat_gateway.go
• aws/data_source_aws_network_acls.go
• aws/data_source_aws_network_interface.go
• aws/data_source_aws_network_interfaces.go
• aws/data_source_aws_ram_resource_share.go
• aws/data_source_aws_rds_cluster.go
• aws/data_source_aws_redshift_cluster.go
• aws/data_source_aws_route53_resolver_rule.go
• aws/data_source_aws_route53_zone.go
• aws/data_source_aws_route_table.go
• aws/data_source_aws_route_tables.go
• aws/data_source_aws_s3_bucket_object.go
• aws/data_source_aws_secretsmanager_secret.go
• aws/data_source_aws_security_group.go
• aws/data_source_aws_security_groups.go
• aws/data_source_aws_subnet.go
• aws/data_source_aws_subnet_ids.go
• aws/data_source_aws_vpc.go
• aws/data_source_aws_vpc_dhcp_options.go
• aws/data_source_aws_vpc_endpoint.go
• aws/data_source_aws_vpc_endpoint_service.go
• aws/data_source_aws_vpc_peering_connection.go
• aws/data_source_aws_vpcs.go
• aws/data_source_aws_vpn_gateway.go
• aws/resource_aws_acm_certificate.go
• aws/resource_aws_acmpca_certificate_authority.go
• aws/resource_aws_ami.go
• aws/resource_aws_ami_copy.go
• aws/resource_aws_ami_from_instance.go
• aws/resource_aws_api_gateway_api_key.go
• aws/resource_aws_api_gateway_client_certificate.go
• aws/resource_aws_api_gateway_domain_name.go
• aws/resource_aws_api_gateway_rest_api.go
• aws/resource_aws_api_gateway_stage.go
• aws/resource_aws_api_gateway_usage_plan.go
• aws/resource_aws_api_gateway_vpc_link.go
• aws/resource_aws_appmesh_mesh.go
• aws/resource_aws_appmesh_route.go
• aws/resource_aws_appmesh_virtual_node.go
• aws/resource_aws_appmesh_virtual_router.go
• aws/resource_aws_appmesh_virtual_service.go
• aws/resource_aws_appsync_graphql_api.go
• aws/resource_aws_athena_workgroup.go
• aws/resource_aws_autoscaling_group.go (skip for now)
• aws/resource_aws_backup_plan.go
• aws/resource_aws_backup_vault.go
• aws/resource_aws_batch_compute_environment.go
• aws/resource_aws_cloudformation_stack.go
• aws/resource_aws_cloudformation_stack_set.go
• aws/resource_aws_cloudfront_distribution.go
• aws/resource_aws_cloudhsm2_cluster.go
• aws/resource_aws_cloudtrail.go
• aws/resource_aws_cloudwatch_event_rule.go
• aws/resource_aws_cloudwatch_log_group.go
• aws/resource_aws_cloudwatch_metric_alarm.go
• aws/resource_aws_codebuild_project.go
• aws/resource_aws_codecommit_repository.go
• aws/resource_aws_codepipeline.go
• aws/resource_aws_codepipeline_webhook.go
• aws/resource_aws_cognito_identity_pool.go
• aws/resource_aws_cognito_user_pool.go
• aws/resource_aws_config_aggregate_authorization.go
• aws/resource_aws_config_config_rule.go
• aws/resource_aws_config_configuration_aggregator.go
• aws/resource_aws_customer_gateway.go
• aws/resource_aws_datapipeline_pipeline.go
• aws/resource_aws_datasync_agent.go
• aws/resource_aws_datasync_location_efs.go
• aws/resource_aws_datasync_location_nfs.go
• aws/resource_aws_datasync_location_s3.go
• aws/resource_aws_datasync_task.go
• aws/resource_aws_dax_cluster.go
• aws/resource_aws_db_cluster_snapshot.go
• aws/resource_aws_db_event_subscription.go
• aws/resource_aws_db_instance.go
• aws/resource_aws_db_option_group.go
• aws/resource_aws_db_parameter_group.go
• aws/resource_aws_db_security_group.go
• aws/resource_aws_db_snapshot.go
• aws/resource_aws_db_subnet_group.go
• aws/resource_aws_default_network_acl.go
• aws/resource_aws_default_route_table.go
• aws/resource_aws_directory_service_directory.go
• aws/resource_aws_dlm_lifecycle_policy.go
• aws/resource_aws_dms_endpoint.go
• aws/resource_aws_dms_replication_instance.go
• aws/resource_aws_dms_replication_subnet_group.go
• aws/resource_aws_dms_replication_task.go
• aws/resource_aws_docdb_cluster.go
• aws/resource_aws_docdb_cluster_instance.go
• aws/resource_aws_docdb_cluster_parameter_group.go
• aws/resource_aws_docdb_subnet_group.go
• aws/resource_aws_dx_connection.go
• aws/resource_aws_dx_hosted_private_virtual_interface_accepter.go
• aws/resource_aws_dx_hosted_public_virtual_interface_accepter.go
• aws/resource_aws_dx_lag.go
• aws/resource_aws_dx_private_virtual_interface.go
• aws/resource_aws_dx_public_virtual_interface.go
• aws/resource_aws_dx_transit_virtual_interface.go
• aws/resource_aws_dynamodb_table.go
• aws/resource_aws_ebs_snapshot.go
• aws/resource_aws_ebs_snapshot_copy.go
• aws/resource_aws_ebs_volume.go
• aws/resource_aws_ec2_capacity_reservation.go
• aws/resource_aws_ec2_client_vpn_endpoint.go
• aws/resource_aws_ec2_fleet.go
• aws/resource_aws_ec2_transit_gateway.go
• aws/resource_aws_ec2_transit_gateway_route_table.go
• aws/resource_aws_ec2_transit_gateway_vpc_attachment.go
• aws/resource_aws_ec2_transit_gateway_vpc_attachment_accepter.go
• aws/resource_aws_ecr_repository.go
• aws/resource_aws_ecs_cluster.go
• aws/resource_aws_ecs_service.go
• aws/resource_aws_ecs_task_definition.go
• aws/resource_aws_efs_file_system.go
• aws/resource_aws_eip.go
• aws/resource_aws_eks_cluster.go
• aws/resource_aws_elastic_beanstalk_application.go
• aws/resource_aws_elastic_beanstalk_application_version.go
• aws/resource_aws_elastic_beanstalk_environment.go
• aws/resource_aws_elasticache_cluster.go
• aws/resource_aws_elasticache_replication_group.go
• aws/resource_aws_elasticsearch_domain.go
• aws/resource_aws_elb.go
• aws/resource_aws_emr_cluster.go
• aws/resource_aws_fsx_lustre_file_system.go
• aws/resource_aws_fsx_windows_file_system.go
• aws/resource_aws_glacier_vault.go
• aws/resource_aws_glue_crawler.go
• aws/resource_aws_glue_job.go
• aws/resource_aws_glue_trigger.go
• aws/resource_aws_iam_role.go
• aws/resource_aws_iam_user.go
• aws/resource_aws_inspector_resource_group.go
• aws/resource_aws_instance.go
• aws/resource_aws_internet_gateway.go
• aws/resource_aws_kinesis_analytics_application.go
• aws/resource_aws_kinesis_firehose_delivery_stream.go
• aws/resource_aws_kinesis_stream.go
• aws/resource_aws_kms_external_key.go
• aws/resource_aws_kms_key.go
• aws/resource_aws_lambda_function.go
• aws/resource_aws_launch_template.go
• aws/resource_aws_lb.go
• aws/resource_aws_lb_target_group.go
• aws/resource_aws_licensemanager_license_configuration.go
• aws/resource_aws_lightsail_instance.go
• aws/resource_aws_media_package_channel.go
• aws/resource_aws_media_store_container.go
• aws/resource_aws_mq_broker.go
• aws/resource_aws_mq_configuration.go
• aws/resource_aws_msk_cluster.go
• aws/resource_aws_nat_gateway.go
• aws/resource_aws_neptune_cluster.go
• aws/resource_aws_neptune_cluster_instance.go
• aws/resource_aws_neptune_cluster_parameter_group.go
• aws/resource_aws_neptune_event_subscription.go
• aws/resource_aws_neptune_parameter_group.go
• aws/resource_aws_neptune_subnet_group.go
• aws/resource_aws_network_acl.go
• aws/resource_aws_network_interface.go
• aws/resource_aws_opsworks_stack.go
• aws/resource_aws_organizations_account.go
• aws/resource_aws_pinpoint_app.go
• aws/resource_aws_ram_resource_share.go
• aws/resource_aws_rds_cluster.go
• aws/resource_aws_rds_cluster_instance.go
• aws/resource_aws_rds_cluster_parameter_group.go
• aws/resource_aws_redshift_cluster.go
• aws/resource_aws_redshift_event_subscription.go
• aws/resource_aws_redshift_parameter_group.go
• aws/resource_aws_redshift_snapshot_copy_grant.go
• aws/resource_aws_redshift_snapshot_schedule.go
• aws/resource_aws_redshift_subnet_group.go
• aws/resource_aws_route53_health_check.go
• aws/resource_aws_route53_resolver_endpoint.go
• aws/resource_aws_route53_resolver_rule.go
• aws/resource_aws_route53_zone.go
• aws/resource_aws_route_table.go
• aws/resource_aws_s3_bucket.go
• aws/resource_aws_s3_bucket_metric.go
• aws/resource_aws_s3_bucket_object.go
• aws/resource_aws_sagemaker_endpoint.go
• aws/resource_aws_sagemaker_endpoint_configuration.go
• aws/resource_aws_sagemaker_model.go
• aws/resource_aws_sagemaker_notebook_instance.go
• aws/resource_aws_secretsmanager_secret.go
• aws/resource_aws_security_group.go
• aws/resource_aws_servicecatalog_portfolio.go
• aws/resource_aws_sfn_activity.go
• aws/resource_aws_sfn_state_machine.go
• aws/resource_aws_sns_topic.go
• aws/resource_aws_spot_fleet_request.go
• aws/resource_aws_spot_instance_request.go
• aws/resource_aws_sqs_queue.go
• aws/resource_aws_ssm_activation.go
• aws/resource_aws_ssm_document.go
• aws/resource_aws_ssm_maintenance_window.go
• aws/resource_aws_ssm_parameter.go
• aws/resource_aws_ssm_patch_baseline.go
• aws/resource_aws_storagegateway_cached_iscsi_volume.go
• aws/resource_aws_storagegateway_gateway.go
• aws/resource_aws_storagegateway_nfs_file_share.go
• aws/resource_aws_storagegateway_smb_file_share.go
• aws/resource_aws_subnet.go
• aws/resource_aws_swf_domain.go
• aws/resource_aws_transfer_server.go
• aws/resource_aws_transfer_user.go
• aws/resource_aws_vpc.go
• aws/resource_aws_vpc_dhcp_options.go
• aws/resource_aws_vpc_endpoint.go
• aws/resource_aws_vpc_endpoint_service.go
• aws/resource_aws_vpc_peering_connection.go
• aws/resource_aws_vpc_peering_connection_accepter.go
• aws/resource_aws_vpn_connection.go
• aws/resource_aws_vpn_gateway.go
• aws/resource_aws_waf_rate_based_rule.go
• aws/resource_aws_waf_rule.go
• aws/resource_aws_waf_rule_group.go
• aws/resource_aws_waf_web_acl.go
• aws/resource_aws_wafregional_rate_based_rule.go
• aws/resource_aws_wafregional_rule.go
• aws/resource_aws_wafregional_rule_group.go
• aws/resource_aws_wafregional_web_acl.go

References

• Default tags for all resources #7926
• [Proof of Concept] provider: Ignore tags implementation #10418
• Refactor Resource Tagging Code to use keyvaluetags Package #10688

[bflad]

Implementation submitted: #13039

[bflad]

Support for the provider level ignore tags functionality across all data sources and resources (except aws_autoscaling_group) has been merged and will release with version 2.60.0 of the Terraform AWS Provider, likely later today. 👍

[ghost]

This has been released in version 2.60.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!