fix(core): stack tags should not allow tokens

[comcalvi]

Issue # (if applicable)

Closes #29424.

Reason for this change

Stack tags get applied to every resource they contain. Tokens must be resolved by CloudFormation itself and the CDK CLI has to apply stack tags to the stack before the deployment starts. This results in the string representation of the token (eg Token[AWS.AccountId.6]) making its way into the stack tags. CFN applies these tags automatically to every resource, but this string value contains characters that many resource handlers do not allow in tags. This causes a deployment error.

Description of changes

Move this error to synthesis time by checking for tokens before adding the tags.

Description of how you validated changes

Unit tests.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: e15f461
• Result: FAILED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[comcalvi]

Closing this because it is possible to add a Stack tag containing a Token that gets resolved to the right value for all the resources in the stack, and this change would break that. One user has reported that adding an unresolved token to a Stack tag successfully tagged the resources with the resolved value, so throwing an error will break them.

We've also seen that this can cause deployment errors, but there's no way to reliably distinguish between which cases a stack tag will cause an error and which ones it won't cause an error; it's resource-dependent, and we shouldn't own logic that says "if IAM gets this stack tag, fail early, because IAM doesn't like unresolved tokens". This logic won't scale to all of AWS and the payoff for this minimal; the error is being thrown either way.

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.