TagFilter for GetResources call to get resources that do not have specified tag

Question

In the console, I can go to Tag Editor > Find Resources to Tag. From there I can specify a tag key, and then I can either specify a value or select either "(not tagged)" or "(empty value)".

This page appears to be analogous to the API call GetResources (https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/API_GetResources.html). It appears as though I should be able to use this call with a TagFilter to get the same result as on the console page. But I can't find anywhere how to specify "(not tagged)" or "(empty value)"

So in the example python code:

```
    client = boto3.client('resourcegroupstaggingapi')
    
    response = client.get_resources(
        ResourceTypeFilters=[
            'secretsmanager',
        ],
        TagFilters=[
            {
                'Key': 'my_cool_tag',
                'Values': [
                    'what-to-put-here'
                ]
            },
        ],
    )
```
How can I format the TagFilters object to return resources that do not have a 'my_cool_tag'?

PS Just to clarify, I want to be able to search across multiple or even all resource types, not just secrets. I think the get_resources call is the right API for this, but I could be mistaken.

Answer

API `GetResources` does not support listing _only_ untagged resources or tags with empty values. In the invocation for `GetResources`, If you don't specify a `TagFilter` parameter, the response includes all resources that are currently tagged or ever had a tag. Resources that currently don't have tags are shown with an empty tag set, like this: `"Tags": []`.

Additionally, If you don't specify a value for a key, the response returns all resources that are tagged with that key, with any or no value.

Also, this API may only list currently tagged resources or resources that were previously tagged, but may skip resources which were never tagged.

Filtering untagged resources is a functionality which is only available in Tag Editor console at the moment, with details listed in [document - Finding resources to tag](https://docs.aws.amazon.com/tag-editor/latest/userguide/find-resources-to-tag.html).

A workaround would be to use the `GetResources` with no `TagFilter` parameter, which will return all currently or previously tagged resources for given `ResourceTypeFilters`, and then parse the resource list in response using client side filtering based on `ResourceTagMappingList[].Tags[]` in the output.

TagFilter for GetResources call to get resources that do not have specified tag

Relevant content