Add AWS creation timestamp to test resources (#6262)

# Description

Today we blindly delete all AWS resources created by our tests at
midnight every day. This could cause functional tests to fail around
this time. This PR adds a `creationTimestamp` to each AWS test resource
that we create as well as logic to delete them by timestamp in the
GitHub workflow.

* Adds AWS creation timestamp to AWS test resources
* Update purge-aws-test-resources GitHub workflow to delete old
resources instead of all resources

## Type of change

<!--

Please select **one** of the following options that describes your
change and delete the others. Clearly identifying the type of change you
are making will help us review your PR faster, and is used in authoring
release notes.

If you are making a bug fix or functionality change to Radius and do not
have an associated issue link please create one now.

-->

- This pull request is a minor refactor, code cleanup, test improvement,
or other maintenance task and doesn't change the functionality of Radius
(issue link optional).

Fixes: #6263

<!--

Please update the following to link the associated issue. This is
required for some kinds of changes (see above).

-->

## Auto-generated summary

<!--
GitHub Copilot for docs will auto-generate a summary of the PR
-->

<!--
copilot:all
-->
### <samp>🤖 Generated by Copilot at adea799</samp>

### Summary
🧹🕒🛠️

<!--
1. 🧹 - This emoji represents the cleanup of old AWS resources and the
improvement of test reliability.
2. 🕒 - This emoji represents the use of creation timestamps to tag and
delete AWS resources based on their age.
3. 🛠️ - This emoji represents the refactoring of the workflow and the
test code to use a common script and a functional package.
-->
This pull request improves the cleanup of AWS resources created by
functional tests. It adds a `creationTimestamp` parameter to the bicep
templates and tags the resources with their creation time. It also
refactors the workflow to use a common script that deletes old resources
based on their tags. It renames a test file and adds some helper
functions to the functional package.

> _We're sailing on the AWS sea, testing our bicep templates_
> _We tag our resources with `creationTimestamp`, so we don't forget_
> _When the tests are done, we run a script to clean up the mess_
> _We heave away, haul away, delete them all on the count of three_

### Walkthrough
* Add a script to delete old AWS resources created by tests
([link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-5625fc3520f54a6e805114f672e280334dac76957f1f5d54cbf3b661f9efeb12R1-R99))
* Update the workflow to use the script instead of inline bash code
([link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-cdbef2239fc7a1aa34d773cb6dae3395193da5015c322ef49bb02025b701a0bcL26-R30),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-cdbef2239fc7a1aa34d773cb6dae3395193da5015c322ef49bb02025b701a0bcL38-R41))
* Add a creationTimestamp parameter to the bicep templates and the
deploy executors for the AWS tests
([link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-531a6f46ae9d530508fc569f3d8efb677f5c2b85ef21732415c71fd370f62050L32-R37),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-531a6f46ae9d530508fc569f3d8efb677f5c2b85ef21732415c71fd370f62050L59-R61),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-531a6f46ae9d530508fc569f3d8efb677f5c2b85ef21732415c71fd370f62050L89-R95),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-531a6f46ae9d530508fc569f3d8efb677f5c2b85ef21732415c71fd370f62050L112-R115),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-b3530585153a4510be532a01249257b09a772f91060a2d1a8be8b3d83fbb8e87L3-R6),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-b3530585153a4510be532a01249257b09a772f91060a2d1a8be8b3d83fbb8e87L9-R20),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-b3530585153a4510be532a01249257b09a772f91060a2d1a8be8b3d83fbb8e87R41-R46),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-e77e6e04f4821e32634940d0dc5c5b2779a7cff9c5c6a0bd27186c64cafbca88L3-R6),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-e77e6e04f4821e32634940d0dc5c5b2779a7cff9c5c6a0bd27186c64cafbca88L9-R20),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-e77e6e04f4821e32634940d0dc5c5b2779a7cff9c5c6a0bd27186c64cafbca88R41-R46),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-ba3f86a7fb8241bd0809f2962fd7561f641229cd4ed710bd00cba541ab66869dR3),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-ba3f86a7fb8241bd0809f2962fd7561f641229cd4ed710bd00cba541ab66869dR15-R18),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-863bee2e7a81fc1dedef482aec1f9d5f965b5a99017411c312d5a6ecf4a34e2cR3),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-863bee2e7a81fc1dedef482aec1f9d5f965b5a99017411c312d5a6ecf4a34e2cR15-R18),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-a6fbd74775c3d83d1c5b066748f75618dea663e00f90a79c8dd115bf452bcbe0L33-R39),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-fbc42064371b122a7ca2d92bfbd5452a51f680c7face11e8db22a71cd7d58e5bL30-R35),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-fbc42064371b122a7ca2d92bfbd5452a51f680c7face11e8db22a71cd7d58e5bL64-R70),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-ea6b32716a499d0deffb7fc13fe99ab1fb5b4fa7f67576e4b89757e76d813b5bL112-R114),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-ea6b32716a499d0deffb7fc13fe99ab1fb5b4fa7f67576e4b89757e76d813b5bL119-R121),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-78e80694bb1ed5b7778407307535be7c50101bfe8b07ee9961e874f4b722c582R3),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-78e80694bb1ed5b7778407307535be7c50101bfe8b07ee9961e874f4b722c582L24-R32),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-43e2af67f3b9b4ceac2bc9597de95219b945ff2a646c5f82dab83a42a3910f6cR3),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-43e2af67f3b9b4ceac2bc9597de95219b945ff2a646c5f82dab83a42a3910f6cR15-R18),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-8028150b2b6a967b9e999213bca3ca236d9428ae62acf3ba5ca2d5d1937fea80R3),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-8028150b2b6a967b9e999213bca3ca236d9428ae62acf3ba5ca2d5d1937fea80R10-R15))
* Add a Tags property to the AWS resources in the bicep templates with
the key 'RadiusCreationTimestamp' and the value of the creationTimestamp
parameter
([link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-b3530585153a4510be532a01249257b09a772f91060a2d1a8be8b3d83fbb8e87L9-R20),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-b3530585153a4510be532a01249257b09a772f91060a2d1a8be8b3d83fbb8e87R41-R46),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-e77e6e04f4821e32634940d0dc5c5b2779a7cff9c5c6a0bd27186c64cafbca88L9-R20),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-e77e6e04f4821e32634940d0dc5c5b2779a7cff9c5c6a0bd27186c64cafbca88R41-R46),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-ba3f86a7fb8241bd0809f2962fd7561f641229cd4ed710bd00cba541ab66869dR15-R18),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-863bee2e7a81fc1dedef482aec1f9d5f965b5a99017411c312d5a6ecf4a34e2cR15-R18),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-78e80694bb1ed5b7778407307535be7c50101bfe8b07ee9961e874f4b722c582L24-R32),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-43e2af67f3b9b4ceac2bc9597de95219b945ff2a646c5f82dab83a42a3910f6cR15-R18),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-8028150b2b6a967b9e999213bca3ca236d9428ae62acf3ba5ca2d5d1937fea80R10-R15))
* Add utility functions to the functional package to get the creation
timestamp and generate a unique S3 bucket name
([link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-d7fffa085c17b99a173ae530015cc075c39419e8ff504aea56ef80eb527b3c18R321-R330))
* Replace the generateS3BucketName function with the one from the
functional package
([link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-fbc42064371b122a7ca2d92bfbd5452a51f680c7face11e8db22a71cd7d58e5bL120-L123))
* Add import statements to use the functional and time packages where
needed
([link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-531a6f46ae9d530508fc569f3d8efb677f5c2b85ef21732415c71fd370f62050R24),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-a6fbd74775c3d83d1c5b066748f75618dea663e00f90a79c8dd115bf452bcbe0L20-R22),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-fbc42064371b122a7ca2d92bfbd5452a51f680c7face11e8db22a71cd7d58e5bL22-R22),
[link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-d7fffa085c17b99a173ae530015cc075c39419e8ff504aea56ef80eb527b3c18R29))
* Rename the file
`test/functional/shared/resources/kubmetadata_cascade_test.go` to
`test/functional/shared/resources/kubemetadata_cascade_test.go`
([link](https://github.com/radius-project/radius/pull/6262/files?diff=unified&w=0#diff-1e27d371cd4d9e9f238ec3ce2d2d567b1fa40156dbe16b83f2f09541c4ecce09))

.github/scripts/delete-aws-resources.sh

@@ -0,0 +1,99 @@
+#!/bin/bash
+
+# ------------------------------------------------------------
+# Copyright 2023 The Radius Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#    
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ------------------------------------------------------------
+
+# Comma-separated list of AWS resource types
+RESOURCE_TYPES=$1
+
+# Label on AWS resources
+LABEL='RadiusCreationTimestamp'
+
+# File to store the list of deleted resources
+DELETED_RESOURCES_FILE='deleted-resources.txt'
+
+# Number of retries
+MAX_RETRIES=5
+
+# Retry delay in seconds
+RETRY_DELAY=300 # 5 minutes
+
+# Maximum age of resources in seconds
+MAX_AGE=21600
+
+# Current time in seconds
+CURRENT_TIME=$(date +%s)
+
+function delete_old_aws_resources() {
+  # Empty the file
+  truncate -s 0 $DELETED_RESOURCES_FILE
+
+  for resource_type in ${RESOURCE_TYPES//,/ }
+  do
+    aws cloudcontrol list-resources --type-name "$resource_type" --query "ResourceDescriptions[].Identifier" --output text | tr '\t' '\n' | while read identifier
+    do
+      aws cloudcontrol get-resource --type-name "$resource_type" --identifier "$identifier" --query "ResourceDescription.Properties" --output text | while read resource
+      do
+        resource_tags=$(jq -c -r .Tags <<< "$resource")
+        for tag in $(jq -c -r '.[]' <<< "$resource_tags")
+        do
+          key=$(jq -r '.Key' <<< "$tag")
+          value=$(jq -r '.Value' <<< "$tag")
+          if [[ "$key" == "$LABEL" && $((CURRENT_TIME - value)) -gt $MAX_AGE]]
+          then
+            echo "Deleting resource of type: $resource_type with identifier: $identifier"
+            echo "$identifier\n" >> $DELETED_RESOURCES_FILE
+            aws cloudcontrol delete-resource --type-name "$resource_type" --identifier "$identifier"
+          fi
+        done
+      done
+    done
+  done
+
+  if [ -s $DELETED_RESOURCES_FILE ]; then
+    return 1
+  else
+    return 0
+  fi
+}
+
+RETRY_COUNT=0
+while [ $RETRY_COUNT -lt $MAX_RETRIES ]; do
+    # Trigger the function to delete the resources
+    delete_old_aws_resources
+
+    # If the function returned 0, then no resources needed to be deleted
+    # on this run. This means that all resources have been deleted.
+    if [ $? -eq 0 ]; then
+        echo "All resources deleted successfully"
+        break
+    fi
+
+    # Still have resources to delete, increase the retry count
+    RETRY_COUNT=$((RETRY_COUNT + 1))
+
+    # Check if there are more retries left
+    if [ $RETRY_COUNT -lt $MAX_RETRIES ]; then
+        # Retry after delay
+        echo "Retrying in $RETRY_DELAY seconds..."
+        sleep $RETRY_DELAY
+    fi
+done
+
+# Check if the maximum number of retries exceeded
+if [ $RETRY_COUNT -eq $MAX_RETRIES ]; then
+    echo "Maximum number of retries exceeded"
+fi

.github/workflows/purge-aws-test-resources.yaml

@@ -23,10 +23,11 @@ on:
 
 env:
   AWS_REGION: us-west-2
-  AWS_RESOURCE_TYPES: 'AWS::Kinesis::Stream,AWS::S3::Bucket,AWS::RDS::DBInstance,AWS::RDS::DBSubnetGroup,AWS::MemoryDB::Cluster,AWS::MemoryDB::SubnetGroup'
+  AWS_RESOURCE_TYPES: 'AWS::RDS::DBSubnetGroup,AWS::RDS::DBInstance,AWS::S3::Bucket,AWS::Logs::MetricFilter,AWS::Logs::LogGroup'
+
 jobs:
   purge_aws_resources:
-    name: Delete all AWS resources created by tests
+    name: Delete old AWS resources created by tests
     runs-on: ubuntu-latest
     steps:
       - name: Configure AWS Credentials
@@ -35,15 +36,6 @@ jobs:
           aws-access-key-id: ${{ secrets.FUNCTEST_AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.FUNCTEST_AWS_SECRET_ACCESS_KEY }}
           aws-region: ${{ env.AWS_REGION }}
-      - name: Filter and delete resources
+      - name: Delete old AWS resources
         run: |
-          RESOURCE_TYPES=${{env.AWS_RESOURCE_TYPES}}
-          for resource_type in ${RESOURCE_TYPES//,/ }
-          do
-            echo "Deleting resources of type $resource_type"
-            aws cloudcontrol list-resources --type-name "$resource_type" --query "ResourceDescriptions[].Identifier" --output text | tr '\t' '\n' | while read identifier
-            do
-              echo "Deleting resource $identifier of type $resource_type"
-              aws cloudcontrol delete-resource --type-name "$resource_type" --identifier "$identifier"
-            done
-          done
+          ./.github/scripts/delete_aws_resources.sh ${{ env.AWS_RESOURCE_TYPES }}

test/functional/shared/mechanics/aws_mechanics_test.go

@@ -21,6 +21,7 @@ import (
 	"testing"
 
 	"github.com/google/uuid"
+	"github.com/radius-project/radius/test/functional"
 	"github.com/radius-project/radius/test/functional/shared"
 	"github.com/radius-project/radius/test/step"
 	"github.com/radius-project/radius/test/validation"
@@ -29,10 +30,11 @@ import (
 func Test_AWSRedeployWithUpdatedResourceUpdatesResource(t *testing.T) {
 	templateFmt := "testdata/aws-mechanics-redeploy-withupdatedresource.step%d.bicep"
 	name := "radiusfunctionaltestbucket-" + uuid.New().String()
+	creationTimestamp := functional.GetCreationTimestamp()
 
 	test := shared.NewRPTest(t, name, []shared.TestStep{
 		{
-			Executor:                               step.NewDeployExecutor(fmt.Sprintf(templateFmt, 1), "bucketName="+name),
+			Executor:                               step.NewDeployExecutor(fmt.Sprintf(templateFmt, 1), "bucketName="+name, "creationTimestamp="+creationTimestamp),
 			SkipKubernetesOutputResourceValidation: true,
 			SkipObjectValidation:                   true,
 			SkipResourceDeletion:                   true,
@@ -49,14 +51,18 @@ func Test_AWSRedeployWithUpdatedResourceUpdatesResource(t *testing.T) {
 									"Key":   "testKey",
 									"Value": "testValue",
 								},
+								map[string]any{
+									"Key":   "RadiusCreationTimestamp",
+									"Value": creationTimestamp,
+								},
 							},
 						},
 					},
 				},
 			},
 		},
 		{
-			Executor:                               step.NewDeployExecutor(fmt.Sprintf(templateFmt, 2), "bucketName="+name),
+			Executor:                               step.NewDeployExecutor(fmt.Sprintf(templateFmt, 2), "bucketName="+name, "creationTimestamp="+creationTimestamp),
 			SkipKubernetesOutputResourceValidation: true,
 			SkipObjectValidation:                   true,
 			AWSResources: &validation.AWSResourceSet{
@@ -72,6 +78,10 @@ func Test_AWSRedeployWithUpdatedResourceUpdatesResource(t *testing.T) {
 									"Key":   "testKey",
 									"Value": "testValue2",
 								},
+								map[string]any{
+									"Key":   "RadiusCreationTimestamp",
+									"Value": creationTimestamp,
+								},
 							},
 						},
 					},
@@ -86,10 +96,11 @@ func Test_AWSRedeployWithCreateAndWriteOnlyPropertyUpdate(t *testing.T) {
 	t.Skip("This test will fail because step 2 is updating a create-and-write-only property.")
 	name := "my-db"
 	templateFmt := "testdata/aws-mechanics-redeploy-withcreateandwriteonlypropertyupdate.step%d.bicep"
+	creationTimestamp := functional.GetCreationTimestamp()
 
 	test := shared.NewRPTest(t, name, []shared.TestStep{
 		{
-			Executor:                               step.NewDeployExecutor(fmt.Sprintf(templateFmt, 1)),
+			Executor:                               step.NewDeployExecutor(fmt.Sprintf(templateFmt, 1), "creationTimestamp="+creationTimestamp),
 			SkipKubernetesOutputResourceValidation: true,
 			SkipObjectValidation:                   true,
 			SkipResourceDeletion:                   true,
@@ -103,13 +114,19 @@ func Test_AWSRedeployWithCreateAndWriteOnlyPropertyUpdate(t *testing.T) {
 							"Endpoint": map[string]any{
 								"Port": 1444,
 							},
+							"Tags": []any{
+								map[string]any{
+									"Key":   "RadiusCreationTimestamp",
+									"Value": creationTimestamp,
+								},
+							},
 						},
 					},
 				},
 			},
 		},
 		{
-			Executor:                               step.NewDeployExecutor(fmt.Sprintf(templateFmt, 2)),
+			Executor:                               step.NewDeployExecutor(fmt.Sprintf(templateFmt, 2), "creationTimestamp="+creationTimestamp),
 			SkipKubernetesOutputResourceValidation: true,
 			SkipObjectValidation:                   true,
 			AWSResources: &validation.AWSResourceSet{
@@ -122,6 +139,12 @@ func Test_AWSRedeployWithCreateAndWriteOnlyPropertyUpdate(t *testing.T) {
 							"Endpoint": map[string]any{
 								"Port": 1444,
 							},
+							"Tags": []any{
+								map[string]any{
+									"Key":   "RadiusCreationTimestamp",
+									"Value": creationTimestamp,
+								},
+							},
 						},
 					},
 				},

test/functional/shared/mechanics/testdata/aws-mechanics-redeploy-withcreateandwritepropertyupdate.step1.bicep

@@ -1,15 +1,23 @@
 import aws as aws
 
-param dbSubnetGroupName string = 'willsmith-rds-mssql-subnet-group-3'
+param creationTimestamp string
+param dbSubnetGroupName string
+param dbName string
+
 resource subnetGroup 'AWS.RDS/DBSubnetGroup@default' = {
   alias: dbSubnetGroupName
   properties: {
     DBSubnetGroupDescription: dbSubnetGroupName
     SubnetIds: ['']
+    Tags: [
+      {
+        Key: 'RadiusCreationTimestamp'
+        Value: creationTimestamp
+      }
+    ]
   }
 }
 
-param dbName string = 'willsmith-rds-mssql-3'
 resource db 'AWS.RDS/DBInstance@default' = {
   alias: dbName
   properties: {
@@ -30,5 +38,11 @@ resource db 'AWS.RDS/DBInstance@default' = {
     LicenseModel: 'license-included'
     Timezone: 'GMT Standard Time'
     CharacterSetName: 'Latin1_General_CI_AS'
+    Tags: [
+      {
+        Key: 'RadiusCreationTimestamp'
+        Value: creationTimestamp
+      }
+    ]
   }
 }

test/functional/shared/mechanics/testdata/aws-mechanics-redeploy-withcreateandwritepropertyupdate.step2.bicep

@@ -1,15 +1,23 @@
 import aws as aws
 
-param dbSubnetGroupName string = 'willsmith-rds-mssql-subnet-group-3'
+param creationTimestamp string
+param dbSubnetGroupName string
+param dbName string
+
 resource subnetGroup 'AWS.RDS/DBSubnetGroup@default' = {
   alias: dbSubnetGroupName
   properties: {
     DBSubnetGroupDescription: dbSubnetGroupName
     SubnetIds: ['']
+    Tags: [
+      {
+        Key: 'RadiusCreationTimestamp'
+        Value: creationTimestamp
+      }
+    ]
   }
 }
 
-param dbName string = 'willsmith-rds-mssql-3'
 resource db 'AWS.RDS/DBInstance@default' = {
   alias: dbName
   properties: {
@@ -30,5 +38,11 @@ resource db 'AWS.RDS/DBInstance@default' = {
     LicenseModel: 'license-included'
     Timezone: 'GMT Standard Time'
     CharacterSetName: 'Latin1_General_CI_AS'
+    Tags: [
+      {
+        Key: 'RadiusCreationTimestamp'
+        Value: creationTimestamp
+      }
+    ]
   }
 }

test/functional/shared/mechanics/testdata/aws-mechanics-redeploy-withupdatedresource.step1.bicep

@@ -1,5 +1,6 @@
 import aws as aws
 
+param creationTimestamp string
 param bucketName string
 
 resource bucket 'AWS.S3/Bucket@default' = {
@@ -11,6 +12,10 @@ resource bucket 'AWS.S3/Bucket@default' = {
         Key: 'testKey'
         Value: 'testValue'
       }
+      {
+        Key: 'RadiusCreationTimestamp'
+        Value: creationTimestamp
+      }
     ]
   }
 }

test/functional/shared/mechanics/testdata/aws-mechanics-redeploy-withupdatedresource.step2.bicep

@@ -1,5 +1,6 @@
 import aws as aws
 
+param creationTimestamp string
 param bucketName string
 
 resource bucket 'AWS.S3/Bucket@default' = {
@@ -11,6 +12,10 @@ resource bucket 'AWS.S3/Bucket@default' = {
         Key: 'testKey'
         Value: 'testValue2'
       }
+      {
+        Key: 'RadiusCreationTimestamp'
+        Value: creationTimestamp
+      }
     ]
   }
 }

test/functional/shared/resources/aws_multi_identifier_resource_test.go

@@ -17,7 +17,9 @@ limitations under the License.
 package resource_test
 
 import (
+	"fmt"
 	"testing"
+	"time"
 
 	"github.com/google/uuid"
 	"github.com/radius-project/radius/test/functional/shared"
@@ -30,10 +32,11 @@ func Test_AWS_MultiIdentifier_Resource(t *testing.T) {
 	filterName := "ms" + uuid.New().String()
 	logGroupName := "ms" + uuid.New().String()
 	testName := "ms" + uuid.New().String()
+	creationTimestamp := fmt.Sprintf("%d", time.Now().Unix())
 
 	test := shared.NewRPTest(t, testName, []shared.TestStep{
 		{
-			Executor:                               step.NewDeployExecutor(template, "filterName="+filterName, "logGroupName="+logGroupName),
+			Executor:                               step.NewDeployExecutor(template, "filterName="+filterName, "logGroupName="+logGroupName, "creationTimestamp="+creationTimestamp),
 			SkipKubernetesOutputResourceValidation: true,
 			SkipObjectValidation:                   true,
 			AWSResources: &validation.AWSResourceSet{
@@ -42,6 +45,14 @@ func Test_AWS_MultiIdentifier_Resource(t *testing.T) {
 						Name:       logGroupName,
 						Type:       validation.AWSLogsLogGroupResourceType,
 						Identifier: logGroupName,
+						Properties: map[string]any{
+							"Tags": []any{
+								map[string]any{
+									"Key":   "RadiusCreationTimestamp",
+									"Value": creationTimestamp,
+								},
+							},
+						},
 					},
 					{
 						Name:       filterName,