Feature Flag TagUnmanagedNetworkResources does not work if network resources have internal aws tags

[fiunchinho]

/kind bug

What steps did you take and what happened: We want to use already existing subnets. But we want to enable the TagUnmanagedNetworkResources feature flag, so that we can manage the subnet tags. But the subnets were created using CloudFormation, so they contain some tags of the form aws::cloudformation::*. When trying to add or delete tags of that form, the AWS API returns an error, because those are reserved/internal AWS tags.

InvalidParameterValue: Value ( aws:cloudformation:stack-name ) for parameter key is invalid. Tag keys starting with 'aws:' are reserved for internal use

What did you expect to happen: When enabling the TagUnmanagedNetworkResources feature flag, VPC and subnets are reconciled without errors, and tags are applied normally.

Anything else you would like to add: Would it be possible to change CAPA code so that it ignores tags that start with aws:?

Environment:

• Cluster-api-provider-aws version: 2.5.2
• Kubernetes version: (use kubectl version): 1.28
• OS (e.g. from /etc/os-release):

[dlipovetsky]

/triage accepted /priority important-longterm