Terraform-provider-aws: Add support for ECS tags

[matthewduren]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Add support for tagging ECS resources

As of 11/15, all ECS resources support tagging, including clusters, services, tasks, task definitions, container instances, etc.

New or Affected Resource(s)

• aws_ecs_cluster
• aws_ecs_service
• aws_ecs_task_definition

Potential Terraform Configuration

resource "aws_ecs_service" "example" {
  tags {
    tag1 = "value"
    tag2 = "value"
  }
}

References

https://console.aws.amazon.com/ecs/home?region=us-east-1#/clusters/optIn/resourceIdArnFormat

https://aws.amazon.com/ecs/faqs/#Transition_to_new_ARN_and_ID_format

[bflad]

Luckily this was already work in progress! More soon. 😄

[edvalenciano]

I've used locals within our microservices.tf and then and merged resource specific tags with the locals to ensure all tags are applied to resources provisioned within the microservice.tf, that is, those that support tagging on creation. I my mind the tags for ECS would apply as with any other resource. However, I cannot test at this time due to Terraform not recognizing the "tags" key.

Resource tag, similar to the example above:

resource "aws_ecs_service" "example" {
tags = "${merge(
local.common_tags,
map(
"tag5", "tag5_value",
"tag6", "tag6_value"
)
)}"
}

Locals would be added at the top of the file but are not depicted in this example.

[bflad]

The tags argument has been added, tested, and documented for the three available ECS resources. This support will be released with version 1.46.0 of the AWS provider, likely sometime before Wednesday.

[bflad]

This has been released in version 1.46.0 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[andrewotoole]

This is great that tags are now supported, but they require a manual opt-in step in AWS. Is there any way to automate this opt-in process for particular roles that are created through terraform? Still getting:

InvalidParameterException: Long arn format must be used for tagging operations

currently on version 1.50.0 of the AWS provider

[kl4w]

@andrewotoole to do this on the whole account level, you need to log in using the root AWS account and enable it per region you want.

[andrewotoole]

@kl4w thank you! I have spoken to our SRE team and will check back once they are done to let you know if that worked.

[ozbillwang]

@kl4w & @bflad

Not really get the meaning of opted-in. The resource I create is a total new ecs stack.

In the company, I have to login aws with assume role, no root account.

I got this error InvalidParameterException: Long arn format must be used for tagging operations today and I can't apply tags to aws_ecs_service resource.

[ozbillwang]

Test with my own aws account (which I have root access), now I understood the difference.

• Login as assume role, which I can only opted-in for this role. In this case, even I enable to opt in to the new ARN and resource ID format it is useless, I still get the same issue.

• Login as root account, I can see the choices (setting scope) now:

1) set for root (override account default)
2) set for specific IAM user
3) set for specific IAM role

[ebarault]

@bflad : although this is working perfectly fine for new ECS resources, this raises an error for resources created before AWS added the support for ECS tags.
InvalidParameterException: Long arn format must be used for tagging operations

I have opted in at root account level.

[bflad]

@ebarault can you please file a new bug report issue filling out the issue template details so we can further triage? Thanks.

[rantecki]

@ebarault I just ran into the same issue. Interestingly, AWS wouldn't let me add tags to the ECS service via the AWS console either, so I don't think the issue is Terraform-specific. I had to destroy and recreate the service before I could add tags.

[matthewduren]

The new long arn has to be used in order to tag any ecs resources. This isn't a bug but rather an expected behavior. This issue is closed and I believe it's working as intended.

[hashibot[bot]]

I'm going to lock this issue because it has been closed for _30 days_ ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!