AWS::IAM::Role resources don’t receive the aws:cloudformation built-in tags

[bogdanb]

Name of the resource

AWS::IAM::Role

Issue Description

When you have an AWS::IAM::Role resource in your stack, it does not get assigned the built-in tags: aws:cloudformation:stack-name, aws:cloudformation:logical-id and aws:cloudformation:stack-id

This happens both for roles specified directly in the template and in roles added by the AWS::Serverless transform.

Expected Behavior

All stack resources should automatically receive the aws:cloudformation:* built-in tags.

Observed Behavior

No tags are added automatically to AWS::IAM::Role resources.

Test Cases

AWSTemplateFormatVersion: '2010-09-09'
Resources:
    BasicLambdaFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - sts:AssumeRole
            Principal:
              Service:
                - lambda.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
        - arn:aws:iam::aws:policy/AWSLambda_ReadOnlyAccess
        - arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess

[rgoltz]

Linking https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/1066 (for common tracking)

[glb]

See also #277 from 2019.

[reidca]

This is making writing SCPs to protect resources created by CloudFormation from deletion very difficult