How to use myApplication inside cdk? (Tag value doesn't resolve and applies literally)

[Cameronsplaze]

I'd like to tie myApplication into my cdk application to help monitor it vs everything else inside my account. (See which stack is creating costs, get security alerts, etc.).

The problem is I can't figure out how to add the 'awsApplication' tag to the stack I want to manage without hitting an error. You can get it working by not tagging, and then going into the console and have the myApplication gui apply the tag, but the problem is since cdk isn't applying the tag, I'm guessing it won't get applied to new resources added to the cdk stack later, right?

I tried a few routes, and this is the one I got the farthest in. It gets blocked because it tries to apply the token literally as a value, instead of resolving the token. (It tries to apply ${Token[TOKEN.594]}: ${Token[TOKEN.595]}, instead of awsApplication: <application-arn>).

from aws_cdk import (
    Stack,
    Tags,
    aws_servicecatalogappregistry as appregistry,
)
from constructs import Construct


class MyApplicationStack(Stack):
    def __init__(
        self,
        scope: Construct,
        construct_id: str,
        application_id: str,
        container_name_id: str,
        tag_stacks: list[Stack],
        **kwargs
    ) -> None:
        super().__init__(scope, construct_id, **kwargs)

        # https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_servicecatalogappregistry.CfnApplication.html
        self.my_application = appregistry.CfnApplication(
            self,
            "CfnApplication",
            name=application_id,
            description=f"Core logic for managing {container_name_id} automatically",
        )

        ## For each stack they pass in, add it to this application
        for stack in tag_stacks:
            # MUST be in the same region as this stack!!
            assert stack.region == self.region, f"Stack '{stack.stack_name}' ({stack.region}) must be in the same region as this stack '{self.stack_name}' ({self.region})"
            ## Adds the 'awsApplication' tag:
            Tags.of(stack).add(self.my_application.attr_application_tag_key, self.my_application.attr_application_tag_value)
            ## TODO: I saw a couple of other tags in the AWS myApplication GUI, add those here too.

            ## Add the Stack to myApplication:
            # https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_servicecatalogappregistry.CfnResourceAssociation.html
            stack_resource_association = appregistry.CfnResourceAssociation(
                self,
                "CfnResourceAssociation",
                application=self.my_application.name,
                # resource=stack.stack_id,
                resource=stack.stack_name,
                resource_type="CFN_STACK",
            )
            # I think this is only required because these are Cfn objects?:
            stack_resource_association.add_dependency(self.my_application)

Error:

Having this in a stack that you apply last, to the previous stack that you want to manage, gets around a circular import dependency with tags.

The stack named <MyStack> failed to deploy: UPDATE_ROLLBACK_COMPLETE: Resource handler returned message: "Invalid parameter: Tags Reason: The given tag(s) contain invalid characters (Service: Sns, Status Code: 400, Request ID: 05bf26bb-74b0-593d-abce-79ab946da8f6)" (RequestToken: 426856ca-f284-3713-cdf4-bce997fb24a2, HandlerErrorCode: GeneralServiceException)

Since I have to use the Cfn* cdk objects, maybe there's a way to resolve tokens I'm missing? I've tried token.resolve(), but it's a string instead of a token, and I can't find if there's a way to turn it into a token object.

[dil-mezzy]

The issue you're facing is with how you're trying to apply the awsApplication tag to the stacks you want to manage. Here's a breakdown of the problem and the solution:

Problem:

You're using .attr_application_tag_key and .attr_application_tag_value from the CfnApplication construct directly.
These attributes return tokens representing the actual tag key and value, but you're trying to use them as strings.
CDK needs resolved tokens, not string representations, to apply tags correctly.
Solution:

Use the Tags helper functions to add tags:
Python
Tags.of(stack).add("awsApplication", self.my_application.application_arn)

This approach uses the Tags.of(stack) to access the tag manager for the specific stack you want to tag.
add("awsApplication", self.my_application.application_arn) adds a new tag with the key "awsApplication" and the value set to the resolved application ARN using self.my_application.application_arn.
Explanation:

self.my_application.application_arn is a token that resolves to the actual application ARN when the CDK generates the CloudFormation template.
Using Tags.of(stack).add ensures CDK handles the token resolution and applies the tag correctly.
Additional Notes:

You don't need CfnResourceAssociation in this case. The Tags approach automatically tags the stack resources.
Remember to update the code for any other tags you want to add based on the AWS documentation for awsApplication GUI tags.
By following these steps, you should be able to successfully tag the stacks you want to manage with the awsApplication tag and associate them with your myApplication within the Service Catalog App Registry.

[Cameronsplaze]

Hi dil-mezzy, thanks for the reply!

I just tried something similar, but self.my_application is a lv1 Cfn object too, so .attr_arn is how you access the arn, and it's an attr/token too. I don't see any lv2 constructs for this in the docs.

I hit another problem where if you're deploying the above stack for the first time, it tries to deploy this stack before the one it's supposed to wrap around, and throws saying the other doesn't exist. I added self.add_dependency(stack) to the end, but it somehow creates a circular dependency error. I can get around it by deploying with the above stack commented out, then deploy again with it. This feels so hacky though and I'd like it to deploy the first time.

This is the first time I've used lv1 objects in cdk though. Any ideas what I could be missing?

Code

from aws_cdk import (
    Stack,
    Tags,
    aws_servicecatalogappregistry as appregistry,
)
from constructs import Construct


class MyApplicationStack(Stack):
    def __init__(
        self,
        scope: Construct,
        construct_id: str,
        application_id: str,
        container_name_id: str,
        tag_stacks: list[Stack],
        **kwargs
    ) -> None:
        super().__init__(scope, construct_id, **kwargs)

        # https://aws.amazon.com/blogs/aws/new-myapplications-in-the-aws-management-console-simplifies-managing-your-application-resources/
        # https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_servicecatalogappregistry.CfnApplication.html
        self.my_application = appregistry.CfnApplication(
            self,
            "CfnApplication",
            name=f"{application_id}-{container_name_id}",
            description=f"Core logic for managing {container_name_id} automatically",
        )

        for stack in tag_stacks:
            ## Adds the 'awsApplication' tag:
            Tags.of(stack).add("awsApplication", self.my_application.attr_arn)
            ## This creates a circular error, can't force this to be after the other stack exists for some reason...
            # self.add_dependency(stack)

[dil-mezzy]

Hello,

All i can think of is Double-Check Installation: Ensure you've installed the required v3 client libraries correctly:

npm install @aws-sdk/client-s3 @aws-sdk/s3-request-presigner

Verify the installation paths in node_modules.

Review Codemod Output: Carefully examine the migrated files generated by aws-sdk-js-codemod. Look for incomplete changes or potential errors.

myApplication and CDK Stack Dependencies:

Circular Dependency: The circular dependency arises because you're trying to add a dependency between stacks where they both need information from each other during deployment.

Solution:

Break the Circular Dependency:

Separate Tagging Logic: Create a separate construct responsible solely for tagging stacks with the awsApplication tag. This construct can depend on both MyApplicationStack and the stacks you want to tag.
Python
from aws_cdk import (Stack, Tags, aws_servicecatalogappregistry as appregistry)
from constructs import Construct

class TaggingStack(Stack):
    def __init__(self, scope: Construct, construct_id: str, my_application: appregistry.CfnApplication, stack_to_tag: Stack, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)
        Tags.of(stack_to_tag).add("awsApplication", my_application.attr_arn)

class MyApplicationStack(Stack):
    def __init__(self, scope: Construct, construct_id: str, application_id: str, container_name_id: str, tag_stacks: list[Stack], **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        self.my_application = appregistry.CfnApplication(
            self,
            "CfnApplication",
            name=f"{application_id}-{container_name_id}",
            description=f"Core logic for managing {container_name_id} automatically",
        )

        for stack in tag_stacks:
            # Create a TaggingStack instance for each stack to tag
            TaggingStack(self, f"TaggingStack-{stack.stack_name}", my_application=self.my_application, stack_to_tag=stack)

This approach ensures MyApplicationStack and the tagged stacks are deployed independently, breaking the circular dependency.
Consider Alternative Approaches (if applicable):

CloudFormation Outputs: If the information needed for tagging exists as outputs from the stack that needs tagging, you can reference those outputs directly in the MyApplicationStack to construct the awsApplication tag value.
Additional Tips:

Consult the official CDK documentation for aws_servicecatalogappregistry: https://docs.aws.amazon.com/cloudformation/

[Cameronsplaze]

I still have no luck getting that to work, it says it would create a cyclic reference. Checked installations and such too. Are you able to get this working on your end then?

[gshpychka]

Stack-level tag values cannot be tokens, they have to be known at synth-time. Refer to the explanation here: #16342 (comment)

[Cameronsplaze]

I guess the entire app gets synth-ed at once in the beginning, so trying to get around the tag dependency with multiple stacks won't work then. This is impossible in a single app. Thanks!