feat(aws): add configurable tagging API resource resolver

cloud/aws/common/config.go

@@ -17,11 +17,20 @@
 package common
 
 import (
+	"fmt"
+
 	"github.com/imdario/mergo"
 	"github.com/mitchellh/mapstructure"
 	"github.com/nitrictech/nitric/cloud/common/deploy/config"
 )
 
+const (
+	// ResourceResolverSSM uses SSM Parameter Store for runtime resource discovery (default).
+	ResourceResolverSSM = "ssm"
+	// ResourceResolverTagging uses the AWS Resource Groups Tagging API for runtime resource discovery.
+	ResourceResolverTagging = "tagging"
+)
+
 type AwsApiConfig struct {
 	Description string
 	Domains     []string
@@ -64,6 +73,7 @@ type AuroraRdsClusterConfig struct {
 
 type AwsConfig struct {
 	ScheduleTimezone                      string `mapstructure:"schedule-timezone,omitempty"`
+	ResourceResolver                      string `mapstructure:"resource-resolver,omitempty"`
 	Import                                AwsImports
 	Refresh                               bool
 	Apis                                  map[string]*AwsApiConfig
@@ -139,6 +149,15 @@ func ConfigFromAttributes(attributes map[string]interface{}) (*AwsConfig, error)
 		awsConfig.ScheduleTimezone = "UTC"
 	}
 
+	// Default resource resolver to SSM if not specified
+	if awsConfig.ResourceResolver == "" {
+		awsConfig.ResourceResolver = ResourceResolverSSM
+	}
+
+	if awsConfig.ResourceResolver != ResourceResolverSSM && awsConfig.ResourceResolver != ResourceResolverTagging {
+		return nil, fmt.Errorf("invalid resource-resolver value %q: must be %q or %q", awsConfig.ResourceResolver, ResourceResolverSSM, ResourceResolverTagging)
+	}
+
 	if awsConfig.Apis == nil {
 		awsConfig.Apis = map[string]*AwsApiConfig{}
 	}

cloud/aws/common/config_test.go

@@ -0,0 +1,96 @@
+// Copyright 2021 Nitric Technologies Pty Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package common
+
+import (
+	"testing"
+)
+
+func TestConfigFromAttributes_ResourceResolver(t *testing.T) {
+	tests := []struct {
+		name        string
+		attrs       map[string]interface{}
+		wantValue   string
+		wantErr     bool
+		errContains string
+	}{
+		{
+			name:      "defaults to ssm when not specified",
+			attrs:     map[string]interface{}{},
+			wantValue: ResourceResolverSSM,
+		},
+		{
+			name:      "accepts ssm explicitly",
+			attrs:     map[string]interface{}{"resource-resolver": "ssm"},
+			wantValue: ResourceResolverSSM,
+		},
+		{
+			name:      "accepts tagging",
+			attrs:     map[string]interface{}{"resource-resolver": "tagging"},
+			wantValue: ResourceResolverTagging,
+		},
+		{
+			name:        "rejects invalid value",
+			attrs:       map[string]interface{}{"resource-resolver": "taging"},
+			wantErr:     true,
+			errContains: "invalid resource-resolver",
+		},
+		{
+			name:        "rejects arbitrary string",
+			attrs:       map[string]interface{}{"resource-resolver": "something-else"},
+			wantErr:     true,
+			errContains: "invalid resource-resolver",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg, err := ConfigFromAttributes(tt.attrs)
+
+			if tt.wantErr {
+				if err == nil {
+					t.Fatalf("expected error containing %q, got nil", tt.errContains)
+				}
+				if tt.errContains != "" {
+					if !containsString(err.Error(), tt.errContains) {
+						t.Fatalf("expected error containing %q, got %q", tt.errContains, err.Error())
+					}
+				}
+				return
+			}
+
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+
+			if cfg.ResourceResolver != tt.wantValue {
+				t.Errorf("ResourceResolver = %q, want %q", cfg.ResourceResolver, tt.wantValue)
+			}
+		})
+	}
+}
+
+func containsString(s, substr string) bool {
+	return len(s) >= len(substr) && searchString(s, substr)
+}
+
+func searchString(s, substr string) bool {
+	for i := 0; i <= len(s)-len(substr); i++ {
+		if s[i:i+len(substr)] == substr {
+			return true
+		}
+	}
+	return false
+}

cloud/aws/deploy/batch.go

@@ -19,6 +19,7 @@ import (
 	"fmt"
 	"strconv"
 
+	"github.com/nitrictech/nitric/cloud/aws/common"
 	"github.com/nitrictech/nitric/cloud/common/deploy/image"
 	"github.com/nitrictech/nitric/cloud/common/deploy/provider"
 	"github.com/nitrictech/nitric/cloud/common/deploy/tags"
@@ -364,6 +365,13 @@ func (p *NitricAwsPulumiProvider) Batch(ctx *pulumi.Context, parent pulumi.Resou
 				})
 			}
 
+			if p.AwsConfig.ResourceResolver == common.ResourceResolverTagging {
+				jobDefinitionContainerProperties.Environment = append(jobDefinitionContainerProperties.Environment, EnvironmentVariable{
+					Name:  "NITRIC_AWS_RESOURCE_RESOLVER",
+					Value: common.ResourceResolverTagging,
+				})
+			}
+
 			if job.Requirements.Gpus > 0 {
 				jobDefinitionContainerProperties.ResourceRequirements = append(jobDefinitionContainerProperties.ResourceRequirements, ResourceRequirement{
 					Type:  "GPU",

cloud/aws/deploy/resources.go

@@ -24,6 +24,10 @@ import (
 )
 
 func (a *NitricAwsPulumiProvider) resourcesStore(ctx *pulumi.Context) error {
+	if a.AwsConfig.ResourceResolver == common.ResourceResolverTagging {
+		return nil
+	}
+
 	// Build the AWS resource index from the provider information
 	// This will be used to store the ARNs/Identifiers of all resources created by the stack
 	bucketArnMap := pulumi.StringMap{}

cloud/aws/deploy/service.go

@@ -23,6 +23,7 @@ import (
 	"github.com/avast/retry-go"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/lambda"
+	"github.com/nitrictech/nitric/cloud/aws/common"
 	"github.com/nitrictech/nitric/cloud/common/deploy/image"
 	"github.com/nitrictech/nitric/cloud/common/deploy/provider"
 	"github.com/nitrictech/nitric/cloud/common/deploy/pulumix"
@@ -181,6 +182,10 @@ func (a *NitricAwsPulumiProvider) Service(ctx *pulumi.Context, parent pulumi.Res
 		envVars[k] = v
 	}
 
+	if a.AwsConfig.ResourceResolver == common.ResourceResolverTagging {
+		envVars["NITRIC_AWS_RESOURCE_RESOLVER"] = pulumi.String(common.ResourceResolverTagging)
+	}
+
 	if a.JobQueue != nil {
 		envVars["NITRIC_JOB_QUEUE_ARN"] = a.JobQueue.Arn
 	}

cloud/aws/deploytf/resources.go

@@ -25,6 +25,10 @@ import (
 )
 
 func (a *NitricAwsTerraformProvider) ResourcesStore(stack cdktf.TerraformStack, accessRoleNames []string) error {
+	if a.AwsConfig.ResourceResolver == common.ResourceResolverTagging {
+		return nil
+	}
+
 	index := common.NewResourceIndex()
 
 	for name, bucket := range a.Buckets {

cloud/aws/deploytf/service.go

@@ -19,6 +19,7 @@ import (
 
 	"github.com/aws/jsii-runtime-go"
 	"github.com/hashicorp/terraform-cdk-go/cdktf"
+	"github.com/nitrictech/nitric/cloud/aws/common"
 	"github.com/nitrictech/nitric/cloud/aws/deploytf/generated/service"
 	"github.com/nitrictech/nitric/cloud/common/deploy/image"
 	"github.com/nitrictech/nitric/cloud/common/deploy/provider"
@@ -53,6 +54,10 @@ func (a *NitricAwsTerraformProvider) Service(stack cdktf.TerraformStack, name st
 		"NITRIC_HTTP_PROXY_PORT": jsii.String(fmt.Sprint(3000)),
 	}
 
+	if a.AwsConfig.ResourceResolver == common.ResourceResolverTagging {
+		jsiiEnv["NITRIC_AWS_RESOURCE_RESOLVER"] = jsii.String(common.ResourceResolverTagging)
+	}
+
 	// TODO: Only apply to requesting services
 	if a.Rds != nil {
 		jsiiEnv["NITRIC_DATABASE_BASE_URL"] = jsii.Sprintf("postgres://%s:%s@%s:%s", *a.Rds.ClusterUsernameOutput(), *a.Rds.ClusterPasswordOutput(),

docs/docs/providers/pulumi/aws.mdx

@@ -166,6 +166,13 @@ region: my-aws-stack-region
 # https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
 schedule-timezone: Australia/Sydney # Available since v0.27.0
 
+# Configure how the runtime discovers deployed resources
+# 'ssm' (default) stores a resource index in SSM Parameter Store
+# 'tagging' uses the AWS Resource Groups Tagging API for runtime resource
+# discovery, avoiding the SSM parameter size limits (4KB standard / 8KB advanced)
+# which can be exceeded in stacks with many resources
+resource-resolver: tagging
+
 # Import existing AWS Resources
 # Available since v0.28.0
 import:

docs/docs/providers/terraform/aws.mdx

@@ -146,6 +146,13 @@ import:
 # https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
 schedule-timezone: Australia/Sydney # Available since v0.27.0
 
+# Configure how the runtime discovers deployed resources
+# 'ssm' (default) stores a resource index in SSM Parameter Store
+# 'tagging' uses the AWS Resource Groups Tagging API for runtime resource
+# discovery, avoiding the SSM parameter size limits (4KB standard / 8KB advanced)
+# which can be exceeded in stacks with many resources
+resource-resolver: tagging
+
 # Apply configuration to nitric APIs
 apis:
   # The nitric name of the API to configure