Implicit API: local PropagateTags: false is silently overridden by global PropagateTags: true

Open Beginner friendly
#3,977 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
aws, python
Domain
api, tooling

Research direction

The behavior is in ImplicitApiPlugin._add_tags_to_implicit_api_if_necessary(); read that entry point and compare its local/global selection with GlobalProperties._prefer_local in samtranslator/plugins/globals/globals.py. Done means an explicit false prevents tags from reaching generated implicit AWS::Serverless::Api or HttpApi resources, while an unset value still follows the global setting.

Written by the indexing model from the issue text.

Description

Describe the bug

ImplicitApiPlugin._add_tags_to_implicit_api_if_necessary() decides whether to copy a resource's Tags onto its generated implicit AWS::Serverless::Api/HttpApi resource using:

should_propagate_tags = resource.properties.get("PropagateTags") or globals_var.get("PropagateTags")

PropagateTags is documented as bool | None (see samtranslator/internal/schema_source/aws_serverless_function.py), where None means "not set" and False is a meaningful, explicit opt-out. Using or means a local PropagateTags: false is indistinguishable from "not set" — it silently falls through to the global value.

Reproduction
Globals:
  Function:
    PropagateTags: true
    Tags:
      Team: Data

Resources:
  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      PropagateTags: false        # explicit opt-out
      Runtime: python3.12
      Handler: index.handler
      CodeUri: s3://bucket/key
      Events:
        Api:
          Type: Api
          Properties:
            Path: /hello
            Method: get
Expected behavior

The function explicitly disables PropagateTags, so the generated implicit AWS::Serverless::Api should NOT receive the Team: Data tag.

Actual behavior

resource.properties.get("PropagateTags") returns False (falsy), so or evaluates the global value (True) instead, and the tag is propagated to the implicit API anyway — silently ignoring the resource-level override.

This is inconsistent with the standard Globals merge logic (GlobalProperties._prefer_local in samtranslator/plugins/globals/globals.py), which always prefers the local value when the key is present locally, regardless of its truthiness.

Fix

PR incoming.

Dominant language
Python
Stars
9.6k
Forks
2.5k
Avg merge
1d 11h
Merged PRs (30d)
7

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from aws/serverless-application-model

All issues in aws/serverless-application-model

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.