AWS::CloudFormation::StackSet schema restricts tag values

[wayne-folkes]

I am trying to create a stackset with the new StackSet resource but tags i want to apply to the stackset cause validation errors

According to the schema a valid tag and it's value must adhere to the following "^(?!aws:.*)[a-z0-9\s\_\.\/\=\+\-]+$"

This makes it impossible to use intrinsic functions or even Tags with capital letters in it's value

When trying to create a tag with the following Key, Value pair

      -
        Key: "Source"
        Value: !Ref Source

I get the following error

Model validation failed (#: #: only 1 subschema matches out of 2) #/Tags/0/Key: failed validation constraint for keyword [pattern] (#/Tags/0/Key)

Here is a sample of the template I am working with

AWSTemplateFormatVersion: "2010-09-09"
Description: Stackset for SSM Parameters
Parameters:
  MasterAccountId:
    Description: ID of the Organization Master Account
    Type: String
    Default: 123456789012
  OrganizationID:
    Description: AWS OrganizationId
    Type: String
    Default: o-123456789
  OrganizationRootID:
    Description: AWS Organization Root Id
    Type: String
    Default: r-r1234
  GitHubSource:
    Description: Repo where this template is located
    Type: String

Resources:
    SSMStackSet:
      Type: AWS::CloudFormation::StackSet
      Properties:
        Tags:
          -
            Key: Source
            Value: !Ref Source
        Description: Common SSM Parameters
        AutoDeployment:
          Enabled: True
          RetainStacksOnAccountRemoval: False
        PermissionModel: SERVICE_MANAGED
        Parameters:
          - ParameterKey: MasterAccountId
            ParameterValue: !Ref MasterAccountId
          - ParameterKey: OrgID
            ParameterValue: !Ref OrganizationID
        StackInstancesGroup:
          - DeploymentTargets:
              OrganizationalUnitIds:
                - !Ref OrganizationRootID
            Regions:
              - us-east-1
        StackSetName: common-parameters
        TemplateBody: |
          AWSTemplateFormatVersion: "2010-09-09"
          Parameters:
            MasterAccountId:
              Description: ID of the Organization Master Account
              Type: String
            OrgID:
              Description: ID of the Organization Master Account
              Type: String
          Description: Common SSM Parameters
          Resources:
            MasterAccount:
              Type: "AWS::SSM::Parameter"
              Properties:
                Name: MasterAccountId
                Description: AWS Organization Master AccountId
                Type: String
                Value: !Ref MasterAccountId
            OrganizationID:
              Type: "AWS::SSM::Parameter"
              Properties:
                Name: OrganizationID
                Description: AWS OrganizationId
                Type: String
                Value: !Ref OrgID

[citrusoft]

I can understand AWS motivation to prevent Tag-Keys from beginning with "aws" but why no uppercase letters. I suspect the current regex is a "left-over" from AWS internal standards that needs to be relaxed for the general public.

• Our organization uses both upper and lower case tag-keys and the volume of IaC templates/source is so great that our firm would rather NOT use the resource AWS::CloudFormation::StackSet than to go back and change tag-key standards and try to socialize the change across 1000+ employees. https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-cloudformation/blob/93db66e4794b77cebabf00f2c4072e5af7b66609/aws-cloudformation-stackset/aws-cloudformation-stackset.json#L21

• Why are you putting any restrictions on the Tag-Values? Why not regex '*.'? for example, your current regex denies firms from inserting email address as a Tag-value. I can't recall any firm that doesn't have some email addresses in some tag-values. https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-cloudformation/blob/93db66e4794b77cebabf00f2c4072e5af7b66609/aws-cloudformation-stackset/aws-cloudformation-stackset.json#L28

Bottom-line: If you want clients to leverage this valuable contribution then you need to loosen up the tagging regular expressions.

[xiwhuang]

Thanks a lot for your feedback, after internal discussion. We will address this and release the restriction for uppercase letters.

[xiwhuang]

Please track #23

[citrusoft]

Thanks @xiwhuang and @wayne-folkes, the issue has been resolved and deployed to production. Can you please close this issue?