fix(tags): don't propagate tags to DnsValidatedCertificate

src/__tests__/tags.test.ts

@@ -0,0 +1,49 @@
+import { ABSENT } from "@aws-cdk/assert"
+import "@aws-cdk/assert/jest"
+import * as acm from "@aws-cdk/aws-certificatemanager"
+import * as r53 from "@aws-cdk/aws-route53"
+import { Bucket } from "@aws-cdk/aws-s3"
+import { App, Stack } from "@aws-cdk/core"
+import { tagResources } from ".."
+
+test("should tag a taggable resource", () => {
+  const app = new App()
+  const stack = new Stack(app, "Stack")
+
+  new Bucket(stack, "Bucket")
+
+  tagResources(app, () => ({
+    TestTag: "abc",
+  }))
+
+  expect(stack).toHaveResourceLike("AWS::S3::Bucket", {
+    Tags: [
+      {
+        Key: "TestTag",
+        Value: "abc",
+      },
+    ],
+  })
+})
+
+// See https://github.com/aws/aws-cdk/issues/14519#issuecomment-833103147
+test("should not tag DnsValidatedCertificate", () => {
+  const app = new App()
+  const stack = new Stack(app, "Stack")
+
+  new acm.DnsValidatedCertificate(stack, "Cert", {
+    domainName: "example.com",
+    hostedZone: new r53.HostedZone(stack, "HostedZone", {
+      zoneName: "example.com",
+    }),
+  })
+
+  tagResources(app, () => ({
+    TestTag: "abc",
+  }))
+
+  expect(stack).toHaveResourceLike("AWS::CloudFormation::CustomResource", {
+    // No tags.
+    Tags: ABSENT,
+  })
+})

src/tags.ts

@@ -1,4 +1,14 @@
 import * as cdk from "@aws-cdk/core"
+import * as cm from "@aws-cdk/aws-certificatemanager"
+
+function shouldTag(construct: cdk.IConstruct) {
+  // See https://github.com/aws/aws-cdk/issues/14519#issuecomment-833103147
+  if (construct instanceof cm.DnsValidatedCertificate) {
+    return false
+  }
+
+  return true
+}
 
 /**
  * Tag all supported resources within an application.
@@ -11,7 +21,7 @@ export function tagResources(
 ): void {
   cdk.Aspects.of(scope).add({
     visit(construct: cdk.IConstruct) {
-      if (cdk.TagManager.isTaggable(construct)) {
+      if (cdk.TagManager.isTaggable(construct) && shouldTag(construct)) {
         // We pick the last stack in chain to support stages where
         // there are multiple stacks.
         const allStacks = construct.node.scopes.filter((it): it is cdk.Stack =>