[jtroup]

ENG-8974

what

Cherry-picks six changes carried by the July release line onto
release/2026-08-26 and stamps the workspace
0.9.52a5.post2+a83dda5c9 — fc8d0ac72 already took .post1.

Two are Stacklet-authored and will never arrive from upstream:

• 50d330ad1 aws(s3) — modify_bucket_tags() tolerates the same
  transport failures BucketAssembly.assemble() already does, so one
  bucket whose endpoint hangs no longer costs the rest of its chunk
  their tags (chore: aws(s3) - per bucket tolerance in the tag action #19).
• 1b5ad409c gcp(cloud-run) — label mutations send only fields the
  Knative schema defines, so the annotations c7n leaves on a resource
  don't 400 the whole-object replace (gcp - cloud-run - drop non-schema fields from label mutations cloud-custodian/cloud-custodian#11052).

Four are upstream:

• 459879a59 tags — dynamic tag lookups centralized in c7n.lookup,
  the "default-value with no key" form extended from AWS to GCP and
  Azure, and asg's tag action moved onto the shared resolver (tags - standardize dynamic tagging support cloud-custodian/cloud-custodian#10968).
• bf3a18095 aws kms, route53 — AWS-managed KMS keys and Route 53
  auto-defined resolver rules excluded from the actions they reject
  (aws - kms, route53 - exclude AWS-managed resources from actions cloud-custodian/cloud-custodian#11050).
• 16f20d030 aws cloudwatch-dashboard — tags read and written through
  the cloudwatch apis, which cover dashboards where the resource
  groups tagging api does not (aws - cloudwatch-dashboard - use native cloudwatch apis for tagging cloud-custodian/cloud-custodian#11090).
• 1dde3003c aws tagging — a resource deleted between enumeration and
  the tag call is dropped from the batch rather than failing it, in
  place of the per-resource handling ebs carried (aws - tagging - tolerate resources deleted mid-run cloud-custodian/cloud-custodian#11089).

A seventh candidate, cloud-custodian#11016 (s3 augment() connection errors),
needed no pick: it reached integration before August's base was cut,
so the content is already present under a different SHA.

why

August was cut from a later integration point, which is not a
superset of July's. Its base predates most of the upstream tagging
work July picked up, and none of that has been applied since, so a
deployment moving from the July line to August loses all six changes.
The two Stacklet-authored ones are the same pair the June-to-July
port existed to rescue; without this, they would be lost a second
time.

testing

Each pick brings its own coverage: per-bucket tolerance on the s3 tag
action, including an end-to-end case through collection and tagging;
cloud run replace bodies rejecting root fields absent from the
schema; dynamic tag resolution across AWS, GCP and Azure and on the
asg-specific path; AWS-managed kms keys and auto-defined resolver
rules skipped by their actions; cloudwatch dashboard tag and
remove-tag against the native apis; and batched ec2 tagging dropping
the ids an error names as gone.

What the diff cannot settle is whether cloud-custodian#10942, already on the August
line, and cloud-custodian#10968 cohere when applied in this order — the reverse of
the order July received them in. That is the question the suite run
on this branch answers.

docs

No docs needed.

---

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 2/5

[High risk] Resync of tagging system with resource-gone error handling.

The PR is not ready to merge because valid tag policies can overwrite existing Azure values or silently omit an ASG tag.

Findings

1.  Existing Azure tag overwritten ▶
2.  Single-tag default overwrites values ▶
3.  Falsy ASG values discarded ▶

Fix with agent prompt

### Issue 1
tools/c7n_azure/c7n_azure/actions/tagging.py:112
If a resource already has an `owner` tag and the policy sets `Owner` with a no-key default, this case-sensitive check treats the tag as absent. Azure tag names are case-insensitive, so the default can replace the existing value instead of preserving it.

### Issue 2
tools/c7n_azure/c7n_azure/actions/tagging.py:109-110
In the single `tag`/`value` form, a no-key default is accepted by the schema, but `Lookup.extract` returns that default without checking whether the tag exists. If it does, the action overwrites its value rather than leaving it untouched.

### Issue 3
c7n/resources/asg.py:1176
The single-value schema now accepts numbers and booleans, but this truthiness check drops `0` and `false` before they become tag values. A policy using either value validates yet silently writes no requested tag.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

The PR resynchronizes July tagging and resource-action fixes onto the August release line and advances workspace package versions.

• Centralizes lookup and conditional-default handling across AWS, Azure, and GCP.
• Adds CloudWatch dashboard tagging, Cloud Run replacement-body cleanup, and handling for deleted or unmodifiable AWS resources.
• The Azure conditional-default paths and ASG’s newly accepted falsy values need correction.

_{Reviews (1) · Last reviewed commit: "chore: cherry pick tagging fixes and bum..."}

[cubic-dev-ai]

All reported issues were addressed across 66 files

Architecture diagram

sequenceDiagram
    participant Policy as Policy Engine
    participant Lookup as c7n.lookup
    participant ASG as ASG Tag Action
    participant EC2 as EC2 CreateTags
    participant RGTA as Resource Groups Tagging API
    participant CW as CloudWatch API
    participant S3 as S3 API
    participant KMS as KMS API
    participant R53 as Route53 API
    participant GCP as GCP/Knative API
    participant Azure as Azure API

    Note over Policy,Lookup: Dynamic Tag Value Resolution (shared across providers)

    Policy->>Lookup: resolve_value(spec, resource, name, current_tags)
    alt Lookup with key
        Lookup->>Lookup: Extract value via jmespath
        alt Key found
            Lookup-->>Policy: Resolved value
        else Key not found, default-value present
            Lookup-->>Policy: Default value
        else Key not found, no default
            Lookup-->>Policy: Raise error
        end
    else Conditional default (no key)
        alt Tag already present
            Lookup-->>Policy: SKIP (omit tag)
        else Tag absent
            Lookup-->>Policy: Default value
        end
    else Static scalar
        Lookup-->>Policy: Value as-is
    end

    Note over Policy,EC2: EC2 Native Tag Action (deleted resource handling)

    Policy->>EC2: Process resource batch
    EC2->>EC2: retry_skip_bad_ids()
    EC2->>EC2: call CreateTags with resource IDs
    alt Success
        EC2-->>Policy: Tags applied
    else ClientError with InvalidXXX.NotFound
        EC2->>EC2: Extract bad IDs from error message
        EC2->>EC2: Remove bad IDs from batch
        opt Remaining IDs
            EC2->>EC2: Retry with remaining IDs
            EC2-->>Policy: Tags applied to survivors
        end
    end

    Note over Policy,RGTA: Universal Tag Action (KMS, Route53, Elasticache)

    Policy->>RGTA: Process resources with tags
    alt AWS-managed KMS key
        Policy->>Policy: Skip (KeyManager == 'AWS')
    else Auto-defined resolver rule
        Policy->>Policy: Skip (Id starts with rslvr-autodefined-rr-)
    else Normal resource
        RGTA->>RGTA: Call TagResources
        alt Resource already deleted
            RGTA->>RGTA: Skip failed ARN from FailedResourcesMap
            RGTA-->>Policy: Partial success
        else Success
            RGTA-->>Policy: Tags applied
        end
    end

    Note over Policy,CW: CloudWatch Dashboard Tagging

    Policy->>CW: ListDashboards
    CW-->>Policy: Dashboard list
    Policy->>CW: ListTagsForResource (per dashboard ARN)
    alt Dashboard deleted between calls
        Policy->>Policy: Skip dashboard
    else Success
        CW-->>Policy: Existing tags
    end
    Policy->>CW: TagResource / UntagResource (native API)
    CW-->>Policy: Confirmation

    Note over Policy,S3: S3 Bucket Tagging with Transport Error Tolerance

    Policy->>S3: get_bucket_tagging
    alt Transport error (timeout, connection closed)
        Policy->>Policy: Skip bucket, continue batch
    else Success
        S3-->>Policy: Existing tags
    end
    Policy->>S3: put_bucket_tagging
    alt Transport error on write
        Policy->>Policy: Log error, continue batch
    else Success
        S3-->>Policy: Confirmation
    end

    Note over Policy,GCP: GCP Cloud Run Label Actions

    Policy->>GCP: Get resource
    GCP-->>Policy: Service/Job object
    Policy->>Policy: knative_body() - filter to schema fields
    alt Unrecognized root field
        Policy->>Policy: Raise PolicyExecutionError
    else Valid body
        Policy->>Policy: Strip c7n annotations
        Policy->>GCP: Replace service/job (whole-object)
        GCP-->>Policy: Updated object
    end

    Note over Policy,Azure: Azure Tag Actions

    Policy->>Azure: Get resource
    Azure-->>Policy: Resource with existing tags
    Policy->>Azure: Resolve tag values via Lookup
    alt Conditional default and tag exists
        Policy->>Policy: Skip tag write
    else Resolved tags to write
        Policy->>Azure: Update resource tags
        Azure-->>Policy: Confirmation
    end

Loading

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[kevin-birkett]

Thanks @jtroup