Repository: cloud-custodian/cloud-custodian

Issue:
Feature Request - Add Tagging And Delete Support For aws.codepipeline
**Is your feature request related to a problem? Please describe.**
We would like to do tag enforcement on codepipeline so we would need both Tag support added as well as a Delete option so we can actually enforce if customers don't tag - https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/codepipeline.html#CodePipeline.Client.delete_pipeline


**Describe the solution you'd like**
If the delete action could be added ( https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/codepipeline.html#CodePipeline.Client.delete_pipeline) as well as the generic tag actions and filters.  This would allow us to perform tag enforcement on codepipeline and delete the pipeline if customer doesn't comply.

**Describe alternatives you've considered**
N/A

**Additional context**
N/A



Discussion:

Resolving patch:
diff --git a/c7n/resources/code.py b/c7n/resources/code.py
--- a/c7n/resources/code.py
+++ b/c7n/resources/code.py
@@ -34,9 +34,10 @@ class resource_type(TypeInfo):
         arn = "Arn"
         date = 'creationDate'
         cfn_type = 'AWS::CodeCommit::Repository'
+        universal_tagging = object()
 
     def get_resources(self, ids, cache=True):
-        return self.augment([{'repositoryName': i} for i in ids])
+        return universal_augment(self, self.augment([{'repositoryName': i} for i in ids]))
 
 
 @CodeRepository.action_registry.register('delete')
@@ -155,6 +156,13 @@ def process_project(self, client, project):
                 "Exception deleting project:\n %s" % e)
 
 
+class DescribePipeline(DescribeSource):
+
+    def augment(self, resources):
+        resources = super().augment(resources)
+        return universal_augment(self.manager, resources)
+
+
 @resources.register('codepipeline')
 class CodeDeployPipeline(QueryResourceManager):
 
@@ -167,3 +175,24 @@ class resource_type(TypeInfo):
         # Note this is purposeful, codepipeline don't have a separate type specifier.
         arn_type = ""
         cfn_type = config_type = "AWS::CodePipeline::Pipeline"
+        universal_tagging = object()
+
+    source_mapping = {
+        'describe': DescribePipeline,
+        'config': ConfigSource
+    }
+
+
+@CodeDeployPipeline.action_registry.register('delete')
+class DeletePipeline(BaseAction):
+
+    schema = type_schema('delete')
+    permissions = ('codepipeline:DeletePipeline',)
+
+    def process(self, resources):
+        client = local_session(self.manager.session_factory).client('codepipeline')
+        for r in resources:
+            try:
+                self.manager.retry(client.delete_pipeline, name=r['name'])
+            except client.exceptions.PipelineNotFoundException:
+                continue


Test patch:
diff --git a/tests/data/placebo/test_codecommit_get/tagging.GetResources_1.json b/tests/data/placebo/test_codecommit_get/tagging.GetResources_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_codecommit_get/tagging.GetResources_1.json
@@ -0,0 +1,8 @@
+{
+    "status_code": 200,
+    "data": {
+        "PaginationToken": "",
+        "ResourceTagMappingList": [],
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/data/placebo/test_codepipeline/tagging.GetResources_1.json b/tests/data/placebo/test_codepipeline/tagging.GetResources_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_codepipeline/tagging.GetResources_1.json
@@ -0,0 +1,8 @@
+{
+    "status_code": 200,
+    "data": {
+        "PaginationToken": "",
+        "ResourceTagMappingList": [],
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/data/placebo/test_codepipeline_delete/codepipeline.DeletePipeline_1.json b/tests/data/placebo/test_codepipeline_delete/codepipeline.DeletePipeline_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_codepipeline_delete/codepipeline.DeletePipeline_1.json
@@ -0,0 +1,6 @@
+{
+    "status_code": 200,
+    "data": {
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_codepipeline_delete/codepipeline.GetPipeline_1.json b/tests/data/placebo/test_codepipeline_delete/codepipeline.GetPipeline_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_codepipeline_delete/codepipeline.GetPipeline_1.json
@@ -0,0 +1,98 @@
+{
+    "status_code": 200,
+    "data": {
+        "pipeline": {
+            "name": "devinprod",
+            "roleArn": "arn:aws:iam::644160558196:role/service-role/BondDouble7",
+            "artifactStore": {
+                "type": "S3",
+                "location": "codepipeline-us-east-1-644160558196"
+            },
+            "stages": [
+                {
+                    "name": "Source",
+                    "actions": [
+                        {
+                            "name": "Source",
+                            "actionTypeId": {
+                                "category": "Source",
+                                "owner": "AWS",
+                                "provider": "CodeCommit",
+                                "version": "1"
+                            },
+                            "runOrder": 1,
+                            "configuration": {
+                                "BranchName": "master",
+                                "PollForSourceChanges": "false",
+                                "RepositoryName": "fizzbuzz"
+                            },
+                            "outputArtifacts": [
+                                {
+                                    "name": "SourceArtifact"
+                                }
+                            ],
+                            "inputArtifacts": [],
+                            "region": "us-east-1",
+                            "namespace": "SourceVariables"
+                        }
+                    ]
+                },
+                {
+                    "name": "Build",
+                    "actions": [
+                        {
+                            "name": "Build",
+                            "actionTypeId": {
+                                "category": "Build",
+                                "owner": "AWS",
+                                "provider": "CodeBuild",
+                                "version": "1"
+                            },
+                            "runOrder": 1,
+                            "configuration": {
+                                "ProjectName": "envoy"
+                            },
+                            "outputArtifacts": [
+                                {
+                                    "name": "BuildArtifact"
+                                }
+                            ],
+                            "inputArtifacts": [
+                                {
+                                    "name": "SourceArtifact"
+                                }
+                            ],
+                            "region": "us-east-1",
+                            "namespace": "BuildVariables"
+                        }
+                    ]
+                }
+            ],
+            "version": 1
+        },
+        "metadata": {
+            "pipelineArn": "arn:aws:codepipeline:us-east-1:644160558196:devinprod",
+            "created": {
+                "__class__": "datetime",
+                "year": 2020,
+                "month": 5,
+                "day": 1,
+                "hour": 19,
+                "minute": 36,
+                "second": 4,
+                "microsecond": 447000
+            },
+            "updated": {
+                "__class__": "datetime",
+                "year": 2020,
+                "month": 5,
+                "day": 1,
+                "hour": 19,
+                "minute": 36,
+                "second": 4,
+                "microsecond": 447000
+            }
+        },
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_codepipeline_delete/codepipeline.ListPipelines_1.json b/tests/data/placebo/test_codepipeline_delete/codepipeline.ListPipelines_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_codepipeline_delete/codepipeline.ListPipelines_1.json
@@ -0,0 +1,32 @@
+{
+    "status_code": 200,
+    "data": {
+        "pipelines": [
+            {
+                "name": "devinprod",
+                "version": 1,
+                "created": {
+                    "__class__": "datetime",
+                    "year": 2020,
+                    "month": 5,
+                    "day": 1,
+                    "hour": 19,
+                    "minute": 36,
+                    "second": 4,
+                    "microsecond": 447000
+                },
+                "updated": {
+                    "__class__": "datetime",
+                    "year": 2020,
+                    "month": 5,
+                    "day": 1,
+                    "hour": 19,
+                    "minute": 36,
+                    "second": 4,
+                    "microsecond": 447000
+                }
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_codepipeline_delete/codepipeline.ListPipelines_2.json b/tests/data/placebo/test_codepipeline_delete/codepipeline.ListPipelines_2.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_codepipeline_delete/codepipeline.ListPipelines_2.json
@@ -0,0 +1,7 @@
+{
+    "status_code": 200,
+    "data": {
+        "pipelines": [],
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_codepipeline_delete/tagging.GetResources_1.json b/tests/data/placebo/test_codepipeline_delete/tagging.GetResources_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_codepipeline_delete/tagging.GetResources_1.json
@@ -0,0 +1,8 @@
+{
+    "status_code": 200,
+    "data": {
+        "PaginationToken": "",
+        "ResourceTagMappingList": [],
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/test_code.py b/tests/test_code.py
--- a/tests/test_code.py
+++ b/tests/test_code.py
@@ -11,6 +11,7 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+import time
 from .common import BaseTest
 
 
@@ -117,3 +118,16 @@ def test_query_pipeline(self):
             p.resource_manager.get_arns(resources),
             ['arn:aws:codepipeline:us-east-1:001100:custodian-deploy'])
         self.assertEqual(len(resources[0]["stages"]), 2)
+
+    def test_delete_pipeline(self):
+        factory = self.replay_flight_data('test_codepipeline_delete')
+        p = self.load_policy(
+            {'name': 'del-pipe', 'resource': 'aws.codepipeline',
+             'actions': ['delete']},
+            session_factory=factory)
+        resources = p.run()
+        self.assertEqual(len(resources), 1)
+        client = factory().client('codepipeline')
+        if self.recording:
+            time.sleep(2)
+        self.assertFalse(client.list_pipelines().get('pipelines'))