Tag Doit-DCI-CloudConnect StackSet Resources in AWS Accounts
For standardization purposes, we would like to have the ability to tag AWS resources in our accounts that are managed by DoiT.
Preferred: add the following tags at the StackSet level so they propagate to
the stack instances and their taggable resources (the doitintldcicloudconnect
IAM role and the two managed policies).
If per-account tag values aren't possible in your tooling (StackSet tags are
uniform across instances), either of these works for us:
1) Apply the account-varying values (Environment, Name) directly on the IAM
role and policies via iam:TagRole / iam:TagPolicy in each account, and set
the uniform keys (Application, ManagedBy, Team) at the StackSet level.
2) Tell us, and we'll apply the tags ourselves directly on the role and
policies from our side. In that case please confirm your StackSet template
does not manage a Tags property on these resources, so future StackSet
updates won't strip them.
Brian Dalmeida
shared this idea