lake-formation lf-delete-tags does not prevent deleting the tags assigned to resources

[aminsindi]

• [x] I've gone though the User Guide and the API reference
• [x] I've searched for previous similar issues and didn't find any solution

Describe the bug We are getting an issue with aws cli, when we try to delete and lf-tag. The docs says if tag is assigned to any resource, then it would not let us delete the tag.

SDK version number aws --version aws-cli/2.2.25 Python/3.9.6 Darwin/20.6.0 source/x86_64 prompt/off

Platform/OS/Hardware/Device MacOS Darwin FVFYR0CGHV2G 20.6.0 Darwin Kernel Version 20.6.0

To Reproduce (observed behavior)

1. create lf-tags

   aws lakeformation create-lf-tag --tag-key classification --tag-values '["public","private"]'

2. add glue resource(table,database etc)

   aws glue create-database --database-input '{"Name":"test_db"}'

3. assign the tag to created resource

   aws lakeformation add-lf-tags-to-resource --resource '{"Database":{"Name":"test_db"}}' --lf-tags '{"TagKey":"classification", "TagValues":["private"]}'
   aws lakeformation get-resource-lf-tags --resource '{"Database":{"Name":"test_db"}}'

4. drop the tags

   aws lakeformation delete-lf-tag --tag-key classification

Expected behavior Expected to be not allowed to delete the tag and instead throw an error.

Logs/output

Additional context

[stobrien89]

Hi @aminsindi,

Thanks for pointing this out! I was able to reproduce. Because this is an issue with the Lake Formation API, this will affect all AWS SDKs and tools. I'll be transferring this issue to our shared repository for such issues and sending an internal ticket to the Lake Formation team to address this. I'll let you know as soon as I have an update!

[stobrien89]

P52367089

[tim-finnigan]

The documentation for the DeleteLFTag API has since been updated for clarification and now says the following:

Deletes the specified LF-tag given a key name. If the input parameter tag key was not found, then the operation will throw an exception. When you delete an LF-tag, the LFTagPolicy attached to the LF-tag becomes invalid. If the deleted LF-tag was still assigned to any resource, the tag policy attach to the deleted LF-tag will no longer be applied to the resource.

I'll go ahead and close this issue, if there are any further questions or feedback related to us please let us know. Thanks!

[github-actions[bot]]

This issue is now closed.

Comments on closed issues are hard for our team to see. If you need more assistance, please either tag a team member or open a new issue that references this one. If you wish to keep having a conversation with other community members under this issue feel free to do so.