Skip to content

aws - copy-related-tag - fetch resourcegroupstaggingapi tags in batches of 100 - #11301

Merged
ajkerrigan merged 2 commits into
cloud-custodian:mainfrom
haeganm:fix/copy-related-tag-universal-batch
Nov 12, 2026
Merged

ajkerrigan merged 2 commits into
cloud-custodian:mainfrom
haeganm:fix/copy-related-tag-universal-batch

Conversation

@haeganm

@haeganm haeganm commented Nov 4, 2026

Copy link
Copy Markdown
Contributor

Fixes #11300

copy-related-tag with resource: resourcegroupstaggingapi sent every related arn to one GetResources call. ResourceARNList takes 1 to 100 arns (API reference, same min/max in the botocore model), so over 100 related arns is over the limit, and zero related arns raises botocore's ParamValidationError: Invalid length for parameter ResourceARNList, value: 0, valid min length: 1 before any request goes out.

Change: get_resource_tag_map_universal now looks the arns up with utils.chunks(ids, 100), same as universal_augment already does for this api. an empty set makes no call and returns {}, so those resources just count as missing like any other unresolved related id. that means the empty case now follows skip_missing (skipped by default, PolicyExecutionError with skip_missing: false) instead of raising ParamValidationError. 100 or fewer arns is still a single call.

I also removed the get_resources paginator in that method. it was built and never used, and GetResources rejects pagination params when ResourceARNList is set, so it couldn't have been used here anyway.

Test: test_copy_related_tag_resourcegroupstaggingapi_batches checks 250 arns go out as 100 + 100 + 50 with every arn's tags in the result, and that an empty set makes no call. fails on main ([250] != [100, 100, 50]), passes with the fix. a full pytest -n auto tests run gives the same result as main plus the new test, and ruff check c7n tests tools is clean.

…es of 100

copy-related-tag with resource: resourcegroupstaggingapi passed every
related arn to a single GetResources call. ResourceARNList takes 1 to
100 arns, so more than 100 related arns goes over the documented limit,
and zero (none of the matched resources carry the key) fails botocore
param validation before any request is sent.

Look the arns up in chunks of 100, the same way universal_augment
already does, and skip the call when there are none. Also drop the
get_resources paginator that was built but never used. GetResources
rejects pagination params when ResourceARNList is set anyway.
@haeganm
haeganm requested review from a team and kapilt as code owners November 4, 2026 19:11
@linux-foundation-easycla

linux-foundation-easycla Bot commented Nov 4, 2026 •

Copy link
Copy Markdown

CLA Signed
The committers listed above are authorized under a signed CLA.

  • ✅ login: haeganm / name: Haegan McGarry (a9418a4)

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 2 files

Confidence score: 5/5

  • Automated review surfaced no issues in the provided summaries.
  • No files require special attention.

Re-trigger cubic

@ajkerrigan ajkerrigan left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch, thanks! 👍

@ajkerrigan
ajkerrigan enabled auto-merge (squash) November 12, 2026 14:50
@ajkerrigan
ajkerrigan merged commit 6a22d82 into cloud-custodian:main Nov 12, 2026
21 of 22 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

aws - copy-related-tag - resourcegroupstaggingapi lookup sends all arns in one GetResources call

2 participants