aws
diff --git a/‎packages/aws-cdk/lib/context-providers/load-balancers.ts
Lines changed: 6 additions & 9 deletions b/‎packages/aws-cdk/lib/context-providers/load-balancers.ts
Lines changed: 6 additions & 9 deletions
diff --git a/‎packages/aws-cdk/test/context-providers/load-balancers.test.ts
Lines changed: 46 additions & 0 deletions b/‎packages/aws-cdk/test/context-providers/load-balancers.test.ts
Lines changed: 46 additions & 0 deletions
@@ -160,15 +160,12 @@ class LoadBalancerProvider {
     }
     return (await this.describeTags(loadBalancers.map((lb) => lb.LoadBalancerArn!)))
       .filter((tagDescription) => {
-        return (
-          tagDescription.Tags?.length === this.filter.loadBalancerTags?.length &&
-          tagDescription.Tags?.filter(
-            (tag) =>
-              !this.filter.loadBalancerTags!.some((filter) => {
-                return filter.key === tag.Key && filter.value === tag.Value;
-              }),
-          ).length === 0
-        );
+        // For every tag in the filter, there is some tag in the LB that matches it.
+        // In other words, the set of tags in the filter is a subset of the set of tags in the LB.
+        return this.filter.loadBalancerTags!.every((filter) => {
+          return tagDescription.Tags?.some((tag) =>
+            filter.key === tag.Key && filter.value === tag.Value);
+        });
       })
       .flatMap((tag) => loadBalancers.filter((loadBalancer) => tag.ResourceArn === loadBalancer.LoadBalancerArn));
   }
 
@@ -199,6 +199,52 @@ describe('load balancer context provider plugin', () => {
     });
   });
 
+  test('looks up by tags - query by subset', async () => {
+    // GIVEN
+    mockElasticLoadBalancingV2Client
+      .on(DescribeLoadBalancersCommand)
+      .resolves({
+        LoadBalancers: [
+          {
+            IpAddressType: 'ipv4',
+            LoadBalancerArn: 'arn:load-balancer2',
+            DNSName: 'dns2.example.com',
+            CanonicalHostedZoneId: 'Z1234',
+            SecurityGroups: ['sg-1234'],
+            VpcId: 'vpc-1234',
+            Type: 'application',
+          },
+        ],
+      })
+      .on(DescribeTagsCommand)
+      .resolves({
+        TagDescriptions: [
+          {
+            ResourceArn: 'arn:load-balancer2',
+            Tags: [
+              // Load balancer has two tags...
+              { Key: 'some', Value: 'tag' },
+              { Key: 'second', Value: 'tag2' },
+            ],
+          },
+        ],
+      });
+    const provider = new LoadBalancerContextProviderPlugin(mockSDK);
+
+    // WHEN
+    const result = await provider.getValue({
+      account: '1234',
+      region: 'us-east-1',
+      loadBalancerType: LoadBalancerType.APPLICATION,
+      loadBalancerTags: [
+        // ...but we are querying for only one of them
+        { key: 'second', value: 'tag2' },
+      ],
+    });
+
+    expect(result.loadBalancerArn).toEqual('arn:load-balancer2');
+  });
+
   test('filters by type', async () => {
     // GIVEN
     mockElasticLoadBalancingV2Client