[cli] removes tags on self-mutating updates

[roskelleycj]

I've observed that the tags placed initially on the cdk-pipeline are subsequently removed on updates. It appears that the tags are lost because I used the cdk --tags option and that is not preserved in the CodeBuild that is used for the self-mutating aspects.

Reproduction Steps

Using this tutorial I was able to get a cdk-pipeline setup for my cdk app. When the tutorial describes this:

As a one-time operation, deploy the pipeline stack:

npx cdk deploy \
  --profile account1-profile \
  CdkpipelinesDemoPipelineStack

I added added the following:

--tags blueprint=woodstock3368 --tags system=testing 

so that the command looks like this:

npx cdk deploy \
  --profile account1-profile \
  --tags blueprint=woodstock3368 --tags system=testing  \
  CdkpipelinesDemoPipelineStack

The stack was successfully created initially. I checked the resources and they were properly tagged. I then started to move on with the tutorial to add more stages/stacks and eventually noticed the the tags were lost.

Ideally, the tags should be preserved from update to update.

Error Log

Observation of tags being removed from resources that initially had tags.

Environment

• CLI Version : 1.54.0 (build c01b9b9)
• Framework Version:
• Node.js Version: v12.18.3
• OS : osx 10.15.6
• Language (Version): all

---

This is 🐛 Bug Report

[njlynch]

This seems to be [potentially] a general issue with the cli. Tags that are assigned via a change set (like the ones created with cdk deploy --tags ...) are not taken into account on the next deploy. From first glance, it looks like we could easily pass along the existing tags of the stack on the next deploy (quick test shows this would work). However, we'd want to do this in a way that allows users to remove tags and doesn't disrupt any existing workflows with the CLI. Tagging the tools and @shivlaks to weigh in.

[rix0rrr]

Agreed that this is a CLI issue.

UX question: what should the command be if one wants to remove the tags? Not supplying any will not be sufficient anymore then.

[rix0rrr]

In hindsight, this is not a bug. cdk deploy --tags should never have been a feature and you shouldn't be using it. Tagging inside the CDK app is the proper way to do tagging.

[roskelleycj]

I disagree with your assessment that it should never have been added as a feature. It is actually quite a useful feature.

Please consider enterprise ORGs that have required tags and some of those tags are provided at time of build/deploy.
If this isn't a feature of the CDK it raises the level of complexity that an ORG must adopt to enforce their tagging specifications.

For example without this feature there is no means without forcing either a new construct (I.e., standard Aspect for Tagging) and then requiring (how????) each CDK App in the ORG to include the specifics. And since there is no re-enforcement in CDK it is difficult to stop a build/deploy. In other words the cdk deploy --tags is actually a very good feature, if it worked! I would ask that you re-consider addressing the issue OR allowing ORGs to easily apply consistent tagging behavior.

PS. BTW, where is the issue to 'remove cdk deploy --tags'? I.e., I would expect a mature community process wherein if you believe that the feature is deprecated and should be removed I would see 'issues' to address that. As it is, I just see that this issue is closed with no reference to the other issues. Leaving me to wonder if cdk deploy --tags will ever be removed. And thus encouraging me to look at other projects that might better meet my needs.