Implement configuring ignore_tags via environment variables

[bberg-indeed]

Description

Implements support for setting ignore_tags via the environment variables TF_AWS_IGNORE_TAGS_KEYS and TF_AWS_IGNORE_TAGS_KEY_PREFIXES, which can be set to comma-separated lists of tag keys or key prefixes.

The keys and prefixes specified via these variables are merged with those explicitly specified in the HCL provider definition. I do understand that this approach has some drawbacks, so I'd like to get some feedback on this approach before writing the documentation for this change.

Relations

Closes #35243
Relates #33339

References

Output from Acceptance Testing

 % make testacc TESTS=TestAccProvider_ PKG=../provider 
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/../provider/... -v -count 1 -parallel 20 -run='TestAccProvider_'  -timeout 360m
?   	github.com/hashicorp/terraform-provider-aws/internal/provider/fwprovider	[no test files]
=== RUN   TestAccProvider_DefaultTags_emptyBlock
=== PAUSE TestAccProvider_DefaultTags_emptyBlock
=== RUN   TestAccProvider_DefaultTagsTags_none
=== PAUSE TestAccProvider_DefaultTagsTags_none
=== RUN   TestAccProvider_DefaultTagsTags_one
=== PAUSE TestAccProvider_DefaultTagsTags_one
=== RUN   TestAccProvider_DefaultTagsTags_multiple
=== PAUSE TestAccProvider_DefaultTagsTags_multiple
=== RUN   TestAccProvider_DefaultAndIgnoreTags_emptyBlocks
=== PAUSE TestAccProvider_DefaultAndIgnoreTags_emptyBlocks
=== RUN   TestAccProvider_endpoints
=== PAUSE TestAccProvider_endpoints
=== RUN   TestAccProvider_fipsEndpoint
=== PAUSE TestAccProvider_fipsEndpoint
=== RUN   TestAccProvider_unusualEndpoints
=== PAUSE TestAccProvider_unusualEndpoints
=== RUN   TestAccProvider_IgnoreTags_emptyBlock
=== PAUSE TestAccProvider_IgnoreTags_emptyBlock
=== RUN   TestAccProvider_IgnoreTagsKeyPrefixes_none
=== PAUSE TestAccProvider_IgnoreTagsKeyPrefixes_none
=== RUN   TestAccProvider_IgnoreTagsKeyPrefixes_one
=== PAUSE TestAccProvider_IgnoreTagsKeyPrefixes_one
=== RUN   TestAccProvider_IgnoreTagsKeyPrefixes_multiple
=== PAUSE TestAccProvider_IgnoreTagsKeyPrefixes_multiple
=== RUN   TestAccProvider_IgnoreTagsKeys_none
=== PAUSE TestAccProvider_IgnoreTagsKeys_none
=== RUN   TestAccProvider_IgnoreTagsKeys_one
=== PAUSE TestAccProvider_IgnoreTagsKeys_one
=== RUN   TestAccProvider_IgnoreTagsKeys_multiple
=== PAUSE TestAccProvider_IgnoreTagsKeys_multiple
=== RUN   TestAccProvider_IgnoreTagsKeys_envVarOnly
--- PASS: TestAccProvider_IgnoreTagsKeys_envVarOnly (9.00s)
=== RUN   TestAccProvider_IgnoreTagsKeys_envVarMerged
--- PASS: TestAccProvider_IgnoreTagsKeys_envVarMerged (8.04s)
=== RUN   TestAccProvider_IgnoreTagsKeyPrefixes_envVarOnly
--- PASS: TestAccProvider_IgnoreTagsKeyPrefixes_envVarOnly (7.94s)
=== RUN   TestAccProvider_IgnoreTagsKeyPrefixes_envVarMerged
--- PASS: TestAccProvider_IgnoreTagsKeyPrefixes_envVarMerged (7.92s)
=== RUN   TestAccProvider_Region_c2s
=== PAUSE TestAccProvider_Region_c2s
=== RUN   TestAccProvider_Region_china
=== PAUSE TestAccProvider_Region_china
=== RUN   TestAccProvider_Region_commercial
=== PAUSE TestAccProvider_Region_commercial
=== RUN   TestAccProvider_Region_govCloud
=== PAUSE TestAccProvider_Region_govCloud
=== RUN   TestAccProvider_Region_sc2s
=== PAUSE TestAccProvider_Region_sc2s
=== RUN   TestAccProvider_Region_stsRegion
=== PAUSE TestAccProvider_Region_stsRegion
=== RUN   TestAccProvider_AssumeRole_empty
=== PAUSE TestAccProvider_AssumeRole_empty
=== CONT  TestAccProvider_DefaultTags_emptyBlock
=== CONT  TestAccProvider_IgnoreTagsKeyPrefixes_multiple
=== CONT  TestAccProvider_Region_commercial
=== CONT  TestAccProvider_IgnoreTagsKeys_multiple
=== CONT  TestAccProvider_Region_china
=== CONT  TestAccProvider_fipsEndpoint
=== CONT  TestAccProvider_IgnoreTagsKeyPrefixes_none
=== CONT  TestAccProvider_DefaultTagsTags_multiple
=== CONT  TestAccProvider_IgnoreTagsKeyPrefixes_one
=== CONT  TestAccProvider_endpoints
=== CONT  TestAccProvider_IgnoreTagsKeys_one
=== CONT  TestAccProvider_IgnoreTags_emptyBlock
=== CONT  TestAccProvider_IgnoreTagsKeys_none
=== CONT  TestAccProvider_DefaultAndIgnoreTags_emptyBlocks
=== CONT  TestAccProvider_DefaultTagsTags_one
=== CONT  TestAccProvider_DefaultTagsTags_none
=== CONT  TestAccProvider_Region_stsRegion
=== CONT  TestAccProvider_AssumeRole_empty
=== CONT  TestAccProvider_unusualEndpoints
=== CONT  TestAccProvider_Region_sc2s
--- PASS: TestAccProvider_Region_sc2s (21.40s)
=== CONT  TestAccProvider_Region_c2s
--- PASS: TestAccProvider_Region_stsRegion (21.48s)
=== CONT  TestAccProvider_Region_govCloud
--- PASS: TestAccProvider_Region_commercial (23.23s)
--- PASS: TestAccProvider_Region_china (23.22s)
--- PASS: TestAccProvider_Region_c2s (20.93s)
--- PASS: TestAccProvider_Region_govCloud (21.68s)
--- PASS: TestAccProvider_DefaultTagsTags_one (45.17s)
--- PASS: TestAccProvider_IgnoreTagsKeys_multiple (45.15s)
--- PASS: TestAccProvider_IgnoreTagsKeyPrefixes_none (45.32s)
--- PASS: TestAccProvider_DefaultTagsTags_multiple (45.50s)
--- PASS: TestAccProvider_DefaultAndIgnoreTags_emptyBlocks (45.52s)
--- PASS: TestAccProvider_DefaultTags_emptyBlock (45.85s)
--- PASS: TestAccProvider_IgnoreTagsKeyPrefixes_one (46.03s)
--- PASS: TestAccProvider_IgnoreTagsKeys_one (46.06s)
--- PASS: TestAccProvider_IgnoreTagsKeyPrefixes_multiple (46.26s)
--- PASS: TestAccProvider_DefaultTagsTags_none (46.35s)
--- PASS: TestAccProvider_IgnoreTagsKeys_none (46.51s)
--- PASS: TestAccProvider_IgnoreTags_emptyBlock (47.26s)
--- PASS: TestAccProvider_AssumeRole_empty (49.25s)
--- PASS: TestAccProvider_unusualEndpoints (61.18s)
--- PASS: TestAccProvider_endpoints (61.77s)
--- PASS: TestAccProvider_fipsEndpoint (74.55s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/provider	108.208s
...

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this pull request by adding a 👍 reaction to the original post to help the community and maintainers prioritize this pull request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

For Submitters

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[github-actions]

Welcome @bberg-indeed 👋

It looks like this is your first Pull Request submission to the Terraform AWS Provider! If you haven’t already done so please make sure you have checked out our CONTRIBUTOR guide and FAQ to make sure your contribution is adhering to best practice and has all the necessary elements in place for a successful approval.

Also take a look at our FAQ which details how we prioritize Pull Requests for inclusion.

Thanks again, and welcome to the community! 😃

[bberg-indeed]

One of my coworkers suggested adding an "EXTRA" to the environment names, like TF_AWS_EXTRA_IGNORE_TAGS_KEYS, to make it clear that the tag keys in the environment variable are merged with the tag keys specified in the HCL, so that's another option.

[jar-b]

Hello @bberg-indeed 👋, thanks for implementing this!

Given the significant community interest, we've been discussing internally how to approach extending all available provider tagging options via environment variables in a consistent way. #33339 has implemented a workflow for default_tags, which I'll be reviewing first, followed by this implementation for ignore_tags.

I'm planning to have both PRs in before the next release (v5.62.0), but wanted to give some context on the order in which reviews will happen now that we've formally picked this up. Thanks again!

[jar-b]

To confirm one point from the original PR body - in our internal design document we also came to the conclusion that merging was the most reasonable behavior when values are provided both via environment variables and the provider configuration. I'll be adding comments and examples to the provider documentation which describe this behavior.

[jar-b]

LGTM 🎉

% TF_ACC=1 go test ./internal/provider/...
?       github.com/hashicorp/terraform-provider-aws/internal/provider/fwprovider        [no test files]
ok      github.com/hashicorp/terraform-provider-aws/internal/provider   75.832s

[jar-b]

Thanks for your contribution, @bberg-indeed! 👍

[github-actions]

This functionality has been released in v5.62.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.