Fix #17647 - AWS add tag to SG only if existing tag

pkg/cloudprovider/providers/aws/aws.go

@@ -1552,6 +1552,7 @@ func (s *AWSCloud) ensureSecurityGroup(name string, description string, vpcID st
 		tags = append(tags, tag)
 	}
 
+	if len(tags) > 0 {
 		tagRequest := &ec2.CreateTagsInput{}
 		tagRequest.Resources = []*string{&groupID}
 		tagRequest.Tags = tags
@@ -1559,6 +1560,7 @@ func (s *AWSCloud) ensureSecurityGroup(name string, description string, vpcID st
 			// Not clear how to recover fully from this; we're OK because we don't match on tags, but that is a little odd
 			return "", fmt.Errorf("error tagging security group: %v", err)
 		}
+	}
 	return groupID, nil
 }