Resource Tagging

[aarcro]

This is a feature request for meta data that's usable by -target and -exclude (and thus an endorsement of #2253)

User Story

As a cluster administrator
I'd like to apply tagging metadata to resources
So that I can easily deploy or destroy parts of my infrastructure

Use Cases

Even when scorching the earth of my cloud deployment with terraform destroy, there are a few resources that should stay in place, Eg AWS Route53 Hosted Zones, an S3 bucket for backups. Currently these are managed without TF at all and referenced through variables.

Sometimes I'd like to blast all the way down to just the Hosted Zones. I see it working like this:

terraform apply -target=essential   # Deploys the Zones only
terraform apply -target=backup      # Deploys the backup infrastructure (and dependancies)
terraform apply                     # Deploys everything else
terraform destroy -exclude=backup    # Destroys everything, except resources tagged "backup" and things they depend on
terraform destroy -exclude=essential # Destroys everything, except resources tagged "essential"
terraform destroy -target=backup    # Destroys resources tagged "backup" and things that depend on it

Acceptance Criteria

Given resources tagged X
And resources that depend on tag:X
And resources that tag:X depends on
And resources with no relation to tag:X
When running terraform apply -target=X
Then The resources with tag:X are deployed
And resources that tag:X depends on are deployed
And resources that depend on tag:X are NOT deployed
And resources with no relation to tag:X are NOT deployed

Given resources tagged X
And resources that depend on tag:X
And resources that tag:X depends on
And resources with no relation to tag:X
When running terraform apply -exclude=X
Then The resources with tag:X are deployed
And resources that tag:X depends on are deployed
And resources that depend on tag:X are NOT deployed
And resources with no relation to tag:X are NOT deployed

Given resources tagged X
And resources that depend on tag:X
And resources that tag:X depends on
And resources with no relation to tag:X
When running terraform destroy -exclude=X
Then The resources with tag:X are NOT destroyed
And resources that tag:X depends on are NOT destroyed
And resources that depend on tag:X are destroyed
And resources with no relation to tag:X are destroyed

Given resources tagged X
And resources that depend on tag:X
And resources that tag:X depends on
And resources with no relation to tag:X
When running terraform destroy -target=X
Then The resources with tag:X are destroyed
And resources that tag:X depends on are NOT destroyed
And resources that depend on tag:X are destroyed
And resources with no relation to tag:X are NOT destroyed

References

#3874 prevent_destroy should let you succeed
#3366 adding exclude flag to plan and apply to exclude specified resource from map
#2253 feature request: inverse targeting / exclude