如何仅在部署时为CDK托管资源添加动态标签

针对你的需求——动态标签（如Git提交哈希、部署时间）仅在CDK因其他原因变更资源时更新，且不触发CDK的模型一致性检查——以下是两种可行方案：

方案一：CDK忽略动态标签变更 + 部署后脚本更新 #

步骤1：仅维护静态标签在CDK模型中 #

跳过在CDK的Tags系统中添加动态标签，避免其纳入模型一致性检查：

var app = new App();
var stack = new MyStack(app, "MyStack", new StackProps());

// 静态标签（完全纳入CDK模型一致性检查）
Tags.Of(app).Add("uuid", "unique-internal-identifier");
Tags.Of(app).Add("env.name", "testish");
Tags.Of(app).Add("managed:ownership:division", "Flibble");
Tags.Of(app).Add("managed:ownership:portfolio", "Flooble");
Tags.Of(app).Add("managed:ownership:product-group", "Wibble");

app.Synth();

步骤2：部署后用脚本批量更新动态标签 #

在CDK部署完成后，通过AWS CLI获取栈内资源并更新动态标签，仅当CDK实际执行部署时才触发：

# 执行CDK部署，无变更则直接跳过后续步骤
cdk deploy MyStack --require-approval never

# 获取栈内所有资源ARN
RESOURCES=$(aws cloudformation describe-stack-resources --stack-name MyStack --query 'StackResources[*].PhysicalResourceId' --output text)

# 生成动态标签值
COMMIT_HASH=$(git rev-parse HEAD)
DEPLOY_TIME=$(date -u +"%Y-%m-%dT%H:%M:%SZ")

# 遍历资源更新动态标签
for RESOURCE in $RESOURCES; do
    aws resourcegroupstaggingapi tag-resources --resource-arns $RESOURCE --tags git.commit=$COMMIT_HASH deployed.at=$DEPLOY_TIME
done

方案二：用CloudFormation自定义资源自动更新标签 #

通过自定义资源触发Lambda函数，在栈部署完成后自动更新动态标签，无需额外脚本：

步骤1：创建标签更新Lambda #

var commitHash = Environment.GetEnvironmentVariable("GIT_COMMIT_HASH");
var deployTime = DateTime.UtcNow.ToString("yyyy-MM-ddTHH:mm:ssZ");

// 创建处理标签更新的Lambda
var tagUpdaterLambda = new Function(this, "DynamicTagUpdaterLambda", new FunctionProps
{
    Runtime = Runtime.DotNet6,
    Handler = "TagUpdater::TagUpdater.Function::Handler",
    Code = Code.FromAsset("path/to/lambda/code"),
    Environment = new Dictionary<string, string>
    {
        {"STACK_NAME", this.StackName},
        {"GIT_COMMIT", commitHash},
        {"DEPLOY_TIME", deployTime}
    }
});

// 赋予Lambda必要权限
tagUpdaterLambda.AddToRolePolicy(new PolicyStatement(new PolicyStatementProps
{
    Actions = new[] { "cloudformation:DescribeStackResources", "resourcegroupstaggingapi:TagResources" },
    Resources = new[] { "*" }
}));

步骤2：添加自定义资源触发Lambda #

// 自定义资源会在栈部署完成后触发Lambda执行
new CfnCustomResource(this, "DynamicTagUpdater", new CfnCustomResourceProps
{
    ServiceToken = tagUpdaterLambda.FunctionArn,
    Properties = new Dictionary<string, object>
    {
        {"GitCommit", commitHash},
        {"DeployTime", deployTime}
    }
});

步骤3：Lambda核心逻辑 #

Lambda收到CloudFormation事件后，自动更新栈内所有资源的动态标签：

public async Task<APIGatewayProxyResponse> Handler(APIGatewayProxyRequest request, ILambdaContext context)
{
    var stackName = Environment.GetEnvironmentVariable("STACK_NAME");
    var commitHash = Environment.GetEnvironmentVariable("GIT_COMMIT");
    var deployTime = Environment.GetEnvironmentVariable("DEPLOY_TIME");

    // 获取栈内所有资源
    var cfClient = new AmazonCloudFormationClient();
    var stackResources = await cfClient.DescribeStackResourcesAsync(new DescribeStackResourcesRequest { StackName = stackName });

    // 收集资源ARN列表
    var resourceArns = stackResources.StackResources
        .Where(r => !string.IsNullOrEmpty(r.PhysicalResourceId))
        .Select(r => r.PhysicalResourceId)
        .ToList();

    // 更新动态标签
    var taggingClient = new AmazonResourceGroupsTaggingAPIClient();
    await taggingClient.TagResourcesAsync(new TagResourcesRequest
    {
        ResourceARNList = resourceArns,
        Tags = new Dictionary<string, string>
        {
            {"git.commit", commitHash},
            {"deployed.at", deployTime}
        }
    });

    return new APIGatewayProxyResponse { StatusCode = 200 };
}

核心注意事项 #

• 动态标签不纳入CDK模型：避免CDK将动态标签的变化视为资源变更，触发不必要的部署。
• 权限控制：脚本或Lambda必须拥有cloudformation:DescribeStackResources和resourcegroupstaggingapi:TagResources权限。
• 按需更新：两种方案都确保仅在CDK实际部署资源变更时，才更新动态标签，符合你的需求。

内容的提问来源于stack exchange，提问作者Jon Pawley