Repository: cloud-custodian/cloud-custodian

Issue:
Any way to filter on tags for Cognito identity-pool or user-pool?
### Discussed in https://github.com/orgs/cloud-custodian/discussions/7616

<div type='discussions-op-text'>

<sup>Originally posted by **stepkirk** August  5, 2022</sup>
We normally enforce tags on AWS resources by using Custodian to look for certain required tags on a resource and then, if the tags don't exist or aren't in the correct format, we mark the resource for deletion after a certain grace period. With the Cognito identity-pool and user-pool resources, it doesn't look like we can check for tags the normal way and it doesn't look like we can mark a resource for later deletion. Is that true or am I missing something?

Any plans to add tagging/marking support in the future for these Cognito resources?</div>


Discussion:

Resolving patch:
diff --git a/c7n/resources/cognito.py b/c7n/resources/cognito.py
--- a/c7n/resources/cognito.py
+++ b/c7n/resources/cognito.py
@@ -4,10 +4,21 @@
 
 from c7n.actions import BaseAction
 from c7n.manager import resources
-from c7n.query import QueryResourceManager, TypeInfo
+from c7n.query import QueryResourceManager, TypeInfo, DescribeSource
+from c7n.tags import universal_augment
 from c7n.utils import local_session, type_schema
 
 
+class DescribeIdentityPool(DescribeSource):
+    def augment(self, resources):
+        return universal_augment(self.manager, resources)
+
+
+class DescribeUserPool(DescribeSource):
+    def augment(self, resources):
+        return universal_augment(self.manager, resources)
+
+
 @resources.register('identity-pool')
 class CognitoIdentityPool(QueryResourceManager):
 
@@ -20,6 +31,11 @@ class resource_type(TypeInfo):
         name = 'IdentityPoolName'
         arn_type = "identitypool"
         cfn_type = 'AWS::Cognito::IdentityPool'
+        universal_taggable = object()
+
+    source_mapping = {
+        'describe': DescribeIdentityPool,
+    }
 
 
 @CognitoIdentityPool.action_registry.register('delete')
@@ -69,6 +85,10 @@ class resource_type(TypeInfo):
         arn_type = "userpool"
         cfn_type = 'AWS::Cognito::UserPool'
 
+    source_mapping = {
+        'describe': DescribeUserPool,
+    }
+
 
 @CognitoUserPool.action_registry.register('delete')
 class DeleteUserPool(BaseAction):


Test patch:
diff --git a/tests/data/placebo/test_cognito-identity-pool/tagging.GetResources_1.json b/tests/data/placebo/test_cognito-identity-pool/tagging.GetResources_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_cognito-identity-pool/tagging.GetResources_1.json
@@ -0,0 +1,17 @@
+{
+    "status_code": 200,
+    "data": {
+        "PaginationToken": "",
+        "ResourceTagMappingList": [
+            {
+                "ResourceARN": "arn:aws:cognito-identity:us-east-1:644160558196:identitypool/us-east-1:7af6af21-0a2b-49fb-98e6-07d8a39a3f7a",
+                "Tags": []
+            },
+            {
+                "ResourceARN": "arn:aws:cognito-identity:us-east-1:644160558196:identitypool/us-east-1:us-east-1:dee8f727-00d8-468d-9309-cf1ef485b96c",
+                "Tags": []
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/data/placebo/test_cognito-identity-pool_delete/tagging.GetResources_1.json b/tests/data/placebo/test_cognito-identity-pool_delete/tagging.GetResources_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_cognito-identity-pool_delete/tagging.GetResources_1.json
@@ -0,0 +1,13 @@
+{
+    "status_code": 200,
+    "data": {
+        "PaginationToken": "",
+        "ResourceTagMappingList": [
+            {
+                "ResourceARN": "arn:aws:cognito-identity:us-east-1:644160558196:identitypool/us-east-1:7af6af21-0a2b-49fb-98e6-07d8a39a3f7a",
+                "Tags": []
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/data/placebo/test_cognito-user-pool/tagging.GetResources_1.json b/tests/data/placebo/test_cognito-user-pool/tagging.GetResources_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_cognito-user-pool/tagging.GetResources_1.json
@@ -0,0 +1,17 @@
+{
+    "status_code": 200,
+    "data": {
+        "PaginationToken": "",
+        "ResourceTagMappingList": [
+            {
+                "ResourceARN": "arn:aws:cognito-idp:us-east-1:644160558196:userpool/us-east-1_W6ST8sYH6",
+                "Tags": []
+            },
+            {
+                "ResourceARN": "arn:aws:cognito-idp:us-east-1:644160558196:userpool/us-east-1_xzq8X91on",
+                "Tags": []
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/data/placebo/test_cognito-user-pool_delete/tagging.GetResources_1.json b/tests/data/placebo/test_cognito-user-pool_delete/tagging.GetResources_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_cognito-user-pool_delete/tagging.GetResources_1.json
@@ -0,0 +1,17 @@
+{
+    "status_code": 200,
+    "data": {
+        "PaginationToken": "",
+        "ResourceTagMappingList": [
+            {
+                "ResourceARN": "arn:aws:cognito-idp:us-east-1:644160558196:userpool/us-east-1_rDwm3X6Xo",
+                "Tags": []
+            },
+            {
+                "ResourceARN": "arn:aws:cognito-idp:us-east-1:644160558196:userpool/us-east-1_hK13zaUU3",
+                "Tags": []
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}