Tagged tables and other resources

[AnthonySteele]

We are going to be using tags more and more, in order to mark dynamo tables as belonging to a particular feature. Watchman should be able to using this grouping metadata to apply rules to dynamo tables, and to other resources that support tags.

[AnthonySteele]

Tags are becoming more common and widely used. We have legacy support for dynamo tables and SQS queues and generic support for everything else.

Ideally we want the generic config to support matching on tags for all supported resource types.
This will provide an incentive to migrate dynamo tables and SQS queues to the generic format.

We may want to match combinations of tags, e.g "TeamFoo" and "FeatureBar" and not "isBeta"

[tomhaigh]

Suggest we add two properties to ResourceThreshold - something like ExcludedTags and RequiredTags.

Annoyingly the dynamo api (at least) only has ListTagsOfResource endpoint which only accepts one table at a time. So unless we are prepared to call this for every resource which has been discovered then tagging support for dynamo doesn't seem possible. It doesn't seem ideal for watchman to only support tags on certain resources. (cc @nick4eva )

[tomhaigh]

Having looked at this a while back, the main challenge appears to be that (last time I looked) not all AWS services provide a method to retrieve tags for multiple resources at a time. So, for example, you would end up requesting individual resources for every dynamo table in the account, whereas now we can list and filter dynamo tables in one call.

[tomhaigh]

The approach we discussed was for IResourceSource<T>.GetResourceNamesAsync to return an object containing both the name and set of tags.
The thing that then filters on name can than be extended to also filter on the tags.

The type that is loaded from config, ResourceThresholds<TConfig>, could be extended to have a Tags set and an ExcludedTags set.