mirror of
https://github.com/floci-io/floci.git
synced 2026-11-15 14:13:07 +08:00
soreavisandPriamo Germosen
b2fa3e0cfb
PutResourcePolicy replaced the tag set of an existing resource policy whenever the request carried Tags. The model says tags apply only to the initial creation of the resource policy and that the call throws otherwise. It now applies Tags only when it creates the policy and answers InvalidInputException for Tags on an existing one, before it changes anything. The model names no error for this case; InvalidInputException is the one it lists for invalid request values. An empty Tags list has no tags to apply and is accepted. The CloudFormation provisioner relied on the old replace to converge the Tags of AWS::Organizations::ResourcePolicy on update. An update now leaves Tags out of PutResourcePolicy and converges them through TagResource and UntagResource by the rp- ID, as the provisioner does for OUs, accounts and policies and as AWS's own handler does. Co-authored-by: Priamo Germosen <6233424+pgermosen@users.noreply.github.com>