fix(infra): add ProjectId tags to fcknat CFN template - #3
Open
ellen-goc wants to merge 1 commit into
Open
Conversation
Adds ProjectId, Project, and Environment tags to all resources: NetworkInterfaces, AutoScalingGroups (with PropagateAtLaunch), SecurityGroup, and IAM Role. ASG tags propagate to EC2 NAT instances at launch. Also adds Environment parameter (default: dev) to allow environment-scoped tagging when deploying to staging/prod. Fixes monkut#388
ellen-goc
commented
Jul 22, 2026
ellen-goc
left a comment
ellen-goc
left a comment
Author
There was a problem hiding this comment.
PR Review — kippo#3 (ProjectId tags on fcknat CFN)
Verdict: Approve (comment — self-authored, cannot self-approve).
- Adds
ProjectId/Project/Environmenttags to bothFckNatInterfaceENIs and the ASG (PropagateAtLaunch: trueso NAT EC2 instances inherit them). This is exactly the cost-allocation-tag coverage the org is standardizing on. - New
Environmentparameter (defaultdev, constrainedAllowedValues) is env-scoped and safe. - No hardcoded account IDs, ARNs, or secrets; template-only change. Structurally valid CFN.
CI: no checks configured on this repo; mergeStateStatus=CLEAN. Ready for human merge.
ellen-goc
added
the
ellen:awaiting-merge
Author
|
✅ CI green — Slack notification sent. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ProjectId: kippo,Project: kippo, andEnvironmenttags to all resources inconf/aws/fcknat.cfn.yamlPropagateAtLaunch: trueso EC2 NAT instances inherit tagsEnvironmentparameter (defaultdev) for environment-scoped taggingWhy
EC2 NAT instances and related resources created by this template were appearing as
(untagged)in AWS Cost Explorer. This blocked attribution to thekippoproject in the weekly cost report.Resources now tagged
FckNatInterfaceA/FckNatInterfaceB(NetworkInterface)FckNatAsgA/FckNatAsgB(AutoScalingGroup + propagate to EC2 instances)NatSecurityGroup(SecurityGroup)NatRole(IAM Role)Test plan
aws cloudformation deploy --template-file conf/aws/fcknat.cfn.yaml --stack-name kippo-dev-fcknat ...ProjectId=kippotag in AWS console