[BUG] EC2: DescribeImages ignores tag: filters and never returns image tags

Author: yogeekCreated Sep 16, 2026Updated Sep 17, 2026

Labelsbugec2

What happens

DescribeImages accepts tag: filters but does not apply them, and never returns an image's tags. Tags set with CreateTags are stored — DescribeTags returns them — they just do not reach DescribeImages.

A filter that matches nothing returns the full catalogue instead of an empty list, so a caller selecting an AMI by tag gets a confident wrong answer rather than an error. Tag filters on other EC2 resources work correctly, so this looks specific to images.

Reproduction

Floci 2.1.0 (floci/floci@sha256:f5aa8c18302cedb4f2385f5c4e455b3efc77fee6bf7b6e5d1712b2817ba102db), fresh container, AWS CLI v2.

bash

export AWS_ENDPOINT_URL=http://localhost:4566 AWS_DEFAULT_REGION=us-east-1
export AWS_ACCESS_KEY_ID=111111111111 AWS_SECRET_ACCESS_KEY=test

A=$(aws ec2 register-image --name my-app-ami --architecture x86_64 \
      --root-device-name /dev/xvda --virtualization-type hvm \
      --query ImageId --output text)
aws ec2 create-tags --resources "$A" --tags Key=Origin,Value=Packer

aws ec2 describe-tags --filters Name=resource-id,Values=$A --query 'Tags[0].[Key,Value]' --output text
aws ec2 describe-images --image-ids "$A" --query 'Images[0].Tags' --output text
aws ec2 describe-images --filters Name=tag:Origin,Values=Packer          --query 'length(Images)' --output text
aws ec2 describe-images --filters Name=tag:Origin,Values=DOES-NOT-EXIST  --query 'length(Images)' --output text
aws ec2 describe-images                                                  --query 'length(Images)' --output text
aws ec2 describe-images --filters Name=name,Values=my-app-ami            --query 'length(Images)' --output text

Observed:

DescribeTags                      -> Origin  Packer     # stored
DescribeImages .Tags              -> None               # not returned
filter tag:Origin=Packer          -> 11
filter tag:Origin=DOES-NOT-EXIST  -> 11                 # filter ignored
no filter                         -> 11
filter name=my-app-ami            -> 1                  # name filters work

Expected: .Tags contains Origin=Packer; the matching filter returns 1; the nonsense filter returns 0.

The same tag filter applied to a VPC behaves correctly, which is the useful contrast:

bash

aws ec2 create-vpc --cidr-block 10.0.0.0/16 \
  --tag-specifications 'ResourceType=vpc,Tags=[{Key=Origin,Value=Packer}]'

aws ec2 describe-vpcs --filters Name=tag:Origin,Values=Packer         --query 'length(Vpcs)' --output text  # 1
aws ec2 describe-vpcs --filters Name=tag:Origin,Values=DOES-NOT-EXIST --query 'length(Vpcs)' --output text  # 0

Why this one is worth prioritising

Most emulator gaps fail loudly and you go and fix your code. This one returns a plausible success for a query that matches nothing in reality, so a test suite goes green and the same configuration fails against real AWS.

Selecting an AMI by tag is a very common Terraform pattern:

hcl

data "aws_ami" "app" {
  most_recent = true
  filter {
    name   = "tag:Origin"
    values = ["Packer"]
  }
}

Against Floci this resolves even when the tag is wrong or absent, so the emulator silently validates a broken lookup. I hit this while using Floci to test a Terraform stack offline: the AMI data source resolved locally, and the filter was never actually exercised.

Happy to send a PR if that is useful.

Source: floci-io/floci

View original on GitHub View discussion on GitHub