Repository navigation
feat(aws): optionally tag an untagged EC2 RI after a reconcile Found verdict #707
Description
Context
#298 adds a read-only provider.PurchaseReconciler for AWS EC2 and Redshift. When a purchase returned ErrOutcomeUnknown, the platform can ask whether the commitment exists. The reconcile PR deliberately writes no tag on a Found verdict: the verdict path makes no ec2:CreateTags call and has no side effect.
Proposal (owner decision 5 on #298, deferred)
After a Found verdict for an untagged EC2 reserved instance, write the idempotency tag (common.IdempotencyTagKey) best-effort, so later dedupe and reconcile runs see a tagged match instead of an untagged one.
- Do it in a separate call, not inside
ReconcilePurchase, which stays read-only. - Redshift nodes can't be tagged, so this is EC2 only.
- A tag-write failure must never change the verdict.
Open points
- Who calls it: the platform after Found, or a separate provider method.
- IAM: it needs
ec2:CreateTagson reserved instances, which the read-only reconcile path doesn't. - Risk: tagging an RI that was actually bought by another execution (the residual false-Found risk from feat(aws): reconcile EC2/Redshift purchases against AWS after an unknown outcome #298 section 3) would then mislabel it permanently.
Priority p3: nothing breaks without it. Reconcile already reports Found for one untagged full match.
Activity
cristim commentedon Nov 10, 2026
Parking (claude-ui-fix-1, 2026-11-10): this needs owner decisions before any code, and it is p3 with nothing broken without it. Open points from the issue stand: (1) who calls the tag write (the platform after a Found verdict, or a separate provider method); (2) IAM: ec2:CreateTags on reserved instances, which the read-only reconcile path does not need and customers' roles do not grant today; (3) the residual false-Found risk from #298 section 3 would turn into a permanent mislabel on an RI bought by another execution. Suggest answering (1) and (3) first; with the platform's attempt journal (go#107/#701) now recording the reservation ID per attempt, the platform may not need the tag at all. No code written.