Skip if tag value is empty or set to true

[wakeful]

Description

Fixes #822, change the exclude by tag behaviour to allow matching by an empty tag value.

TODOs

Read the Gruntwork contribution guidelines.

• Update the docs.
• Run the relevant tests successfully, including pre-commit checks.
• Ensure any 3rd party code adheres with our license policy or delete this line if its not applicable.
• Include release notes. If this PR is backward incompatible, include a migration guide.
• Attention Grunts - if this PR adds support for a new resource, ensure the nuke_sandbox and nuke_phxdevops jobs in .circleci/config.yml have been updated with appropriate exclusions (either directly in the job or via the .circleci/nuke_config.yml file) to prevent nuking IAM roles, groups, resources, etc that are important for the test accounts.

Release Notes (draft)

change the exclude by tag behaviour to allow matching by an empty tag value, fix #822.

Migration Guide

n/a

[james03160927]

I suggest changing the existing behavior slightly: if the exclusion tag has no value, we should assume the tag itself indicates that the resource should be excluded. If a value is present, we should check whether it is set to "true."

[wakeful]

I suggest changing the existing behavior slightly: if the exclusion tag has no value, we should assume the tag itself indicates that the resource should be excluded. If a value is present, we should check whether it is set to "true."

Agreed, this simplifies the whole logic quite a lot.

[james03160927]

#822 (comment) - To accommodate this, we could introduce a TagValue property within the FilterRule. The TagValue could default to true, be set to a specific value being targeted, or use *, indicating that it can match any value.

How does this sound?

[wakeful]

#822 (comment) - To accommodate this, we could introduce a TagValue property within the FilterRule. The TagValue could default to true, be set to a specific value being targeted, or use *, indicating that it can match any value.

How does this sound?

I added tag_value to the configuration as a regular expression, primarily because there is already a matches(name string, regexps []Expression) bool function.

The original request should now be easy to address using this configuration. cc: @ErezWeiss

s3:
  exclude:
    tag: Component
    tag_value: .*

[ErezWeiss]

@james03160927
@wakeful
@arsci
@denis256

it seems amazing.
Can we proceed?

[james03160927]

LGTM. Passed all the tests.

[ErezWeiss]

@james03160927 thank you.
Can you guys build a version for it?

@wakeful