chore(cloudformation): tag every stack resource with Name BuildBot #436

Activity

1. credfeto

   added

   Tech DebtTechnical debtTechnical debt

   buildbotChanges in BuildBot projectChanges in BuildBot project

   LowLow PriorityLow Priority

   on Oct 16, 2026
2. credfeto commented on Oct 16, 2026

   

   credfeto

   on Oct 16, 2026

   MemberAuthor

   More actions

   Implementation Plan

   Files to change

   • cloudformation.json: add a Name tag to every taggable resource.
   • CHANGELOG.md: one Changed entry, made with the dotnet changelog tool.

   Approach

   The tag value is { "Ref": "ApplicationName" }, which resolves to BuildBot. Each resource type uses the tag format it requires:

   Resource	Type	Tags format
   VpcLinkSecurityGroup	AWS::EC2::SecurityGroup	list of Key/Value
   TaskDefinition	AWS::ECS::TaskDefinition	list
   ECSService	AWS::ECS::Service	list
   TargetGroup	AWS::ElasticLoadBalancingV2::TargetGroup	list
   LogGroup, ApiAccessLogGroup	AWS::Logs::LogGroup	list
   VpcLink	AWS::ApiGatewayV2::VpcLink	map
   Api	AWS::ApiGatewayV2::Api	map
   ApiStage	AWS::ApiGatewayV2::Stage	map
   ApiDomainName	AWS::ApiGatewayV2::DomainName	map

   These resources don't support tags and are left as they are: Integration, the six Routes, ApiMapping, ListenerRule and the Route 53 RecordSet.

   The following stay the same:

   • the security group's GroupDescription, because changing it would replace the security group and the VPC Link;
   • every resource name;
   • every other property.

   Test strategy

   • cfn-lint and jq both pass on the template.
   • A scripted comparison of the template against origin/main shows that the only difference is the added Tags properties.
   • There is no C# change. The existing build and tests are run to confirm they still pass.
   • After deploy: the security group and the VPC Link show BuildBot in the console's Name column, and the stack update finishes with no resource replaced. The task definition gets a new revision, as it does on every deploy.

   Assumptions

   1. Updating tags on each of these resources happens in place, with no interruption. If CloudFormation documents a replacement for any type other than the task definition, the code writer reports it instead of tagging that resource.
   2. The value comes from ApplicationName, not a hard-coded BuildBot, so the template stays generic.

   Open questions

   1. Deploy-ECS probably needs two more permissions to apply the tags: ecs:TagResource for the service and task definition, and elasticloadbalancing:AddTags for the target group. Do you want to check them or add them before this deploys? The EC2, API Gateway and logs tagging permissions are already covered by the policy added for feat(cloudformation): serve BuildBot through API Gateway on the internal load balancer #433.
3. credfeto

   added

   BlockedBlocked by a dependency or external factorBlocked by a dependency or external factor

   on Oct 16, 2026
4. credfeto commented on Oct 16, 2026

   

   credfeto

   on Oct 16, 2026

   MemberAuthor

   More actions

   1. already has the tag resource
5. credfeto

   removed

   BlockedBlocked by a dependency or external factorBlocked by a dependency or external factor

   on Oct 16, 2026