AWS::SecretsManager::Secret - Tags

[kalrish]

1. Title

AWS::SecretsManager::Secret resources should inherit the stack tags, i.e. the tags of the CloudFormation stack that the resource belongs to.

2. Scope of request

AWS::SecretsManager::Secret already supports tagging. By default it should inherit the tags of the CloudFormation stack it belongs to, unless tags are explicitly specified.

3. Expected behavior

If the Tags property is not specified for an AWS::SecretsManager::Secret resource, the secret should get the same tags as the CloudFormation stack.

4. Suggest specific test cases

Create a stack with an AWS::SecretsManager::Secret, specifying some tags in the CreateStack call. The secret should get the same tags as the stack.

5. Helpful Links to speed up research and evaluation

It would be great if it worked like many other resource types which by default inherit the stack tags.

6. Category

Security

[parimaldeshmukh]

Tested this by launching a stack with stack-tags and confirming those tags exist on the secret as well. Looks like its already implemented.

[emspoars]

Tag inheritance works as expected on stack creation, but not on stack update.

[parimaldeshmukh]

Tested again with various update scenarios.
If the resource is updated, then stack tags get updated on it. If the resource is not updated, stack tags don't get updated on it.

This is not unique to Secrets. I tested with other resources like AWS::SSM::Parameter, and this seems to be consistent behaviour.

[c24w]

Tested again with various update scenarios.
If the resource is updated, then stack tags get updated on it. If the resource is not updated, stack tags don't get updated on it.

This is not unique to Secrets. I tested with other resources like AWS::SSM::Parameter, and this seems to be consistent behaviour.

We've been in touch with AWS Support about AWS::SSM::Parameter resource tags not being updated and they've acknowledged that it is an issue. It's interesting that updating the resource forces the tags to update though 🤔

[antoniordz96]

Why was this closed if this is still an issue?