From e2e525a62ba1f86e452c6d96609500a0516bc261 Mon Sep 17 00:00:00 2001
From: Goran Ceric <cericg@hhmi.org>
Date: Mon, 9 Feb 2026 11:16:40 -0500
Subject: [PATCH] Fix EBS volume tagging for Batch compute instances

AWS Batch ComputeResources.Tags only applies to EC2 instances, not
attached EBS volumes. This causes untagged volumes (e.g., vol-096ac87ce5ec41606)
which breaks cost tracking.

Solution: Add an EC2 Launch Template with TagSpecifications that explicitly
tags both 'instance' and 'volume' resource types at creation time.

Changes:
- Add AlignmentLaunchTemplate resource with TagSpecifications
- Update ComputeAlignmentEnv to reference the launch template
- Remove Tags property (now handled by launch template)

Tags applied to both instances and volumes:
- PROJECT, VERSION, DEVELOPER, STAGE (matches existing stackTags)
---
 align/serverless.yml | 31 ++++++++++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/align/serverless.yml b/align/serverless.yml
index 45ef577..f893577 100644
--- a/align/serverless.yml
+++ b/align/serverless.yml
@@ -49,6 +49,33 @@ resources:
 
   Resources:
 
+    AlignmentLaunchTemplate:
+      Type: AWS::EC2::LaunchTemplate
+      Properties:
+        LaunchTemplateName: "${self:custom.stackName}-launch-template"
+        LaunchTemplateData:
+          TagSpecifications:
+            - ResourceType: instance
+              Tags:
+                - Key: PROJECT
+                  Value: ${file(../config.yml):config.project}
+                - Key: VERSION
+                  Value: ${self:custom.version}
+                - Key: DEVELOPER
+                  Value: ${env:USER}
+                - Key: STAGE
+                  Value: ${self:provider.stage}
+            - ResourceType: volume
+              Tags:
+                - Key: PROJECT
+                  Value: ${file(../config.yml):config.project}
+                - Key: VERSION
+                  Value: ${self:custom.version}
+                - Key: DEVELOPER
+                  Value: ${env:USER}
+                - Key: STAGE
+                  Value: ${self:provider.stage}
+
     ComputeAlignmentEnv:
       Type: AWS::Batch::ComputeEnvironment
       Properties:
@@ -70,7 +97,9 @@ resources:
             - !ImportValue 'janelia-neuronbridge-vpc-shared-AppSecurityGroupId'
           Ec2KeyPair: ${self:custom.sshKeyPairName}
           InstanceRole: ecsInstanceRole
-          Tags: ${self:provider.stackTags}
+          LaunchTemplate:
+            LaunchTemplateId: !Ref AlignmentLaunchTemplate
+            Version: $Latest
 
     ComputeAlignmentJobQueue:
       Type: AWS::Batch::JobQueue