fix: cloud control hotswap removes reserved aws: tags

[dgandhi62]

Two cli-integ tests on the shared cc-hotswap stack failed on every PR (tests 5 & 6), blocking the merge queue:

• hotswap deployment supports CloudControl-based resources with attribute resolution
• hotswap deployment caches template and uses it for subsequent hotswaps

Both died on the --hotswap deploy with:

❌  cdktest-...-cc-hotswap failed to deploy
‣ HotswapFailed: [cloudcontrol] Failed to update <queue-url> (AWS::SQS::Queue)
‣ ValidationException: aws: prefixed tag key names are not allowed for external use.

Only the SQS Queue failed. The CloudWatch Dashboard and Events Rule in the same stack hotswapped successfully. Nothing in this repo seems to have caused this change - leading me to believe this is a service side behavioral change.

Why

The only thing the deploy changed on the Queue was a tag (the test fixture flips DynamicTag between deploys). For a tag change, the hotswap code sent one "replace the whole Tags list" operation:

json

[{ "op": "replace", "path": "/Tags", "value": [
    { "Key": "DynamicTag",     "Value": "new value" },
    { "Key": "DynamoTableArn", "Value": "arn:aws:dynamodb:..." }
]}]

Any tag already on the resource that isn't in this list gets dropped. The issue arose because CFN adds tags themselves on resources (aws:cloudformation:stack-name, stack-id, and logical-id). The underlying change now made it such that us sending the list of tags asked the service to remove the CFN ones as well, which it wouldn't allow because they are aws: prefixed. So it rejected the request.

Fix

We now address individual tags by their index in the resource's current Tags list, so reserved tags are never named by the patch and the service sees no change to them:

[{ "op": "replace", "path": "/Tags/4", "value": { "Key": "DynamicTag", "Value": "new value" } }]

The live ordering is not the template ordering, so the indices cannot be derived from the template. They come from reading current state with Cloud Control GetResource. If it cannot be read, we raise HotswapTagReadFailed

Known assumption

The approach assumes the live tag ordering is stable between the GetResource read and when Cloud Control applies the patch. The passing integ test shows this holds in practice for SQS; it is not proven to be deterministic across calls in general.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None