# Buggy code
def process(self, resources):
    client = local_session(self.manager.session_factory).client("iam")

    age = self.data.get("age")
    disable = self.data.get("disable")
    matched = self.data.get("matched")

    if age:
        threshold_date = datetime.datetime.now(tz=tzutc()) - timedelta(age)

    for r in resources:
        if "c7n:AccessKeys" not in r:
            r["c7n:AccessKeys"] = client.list_access_keys(UserName=r["UserName"])[
                "AccessKeyMetadata"
            ]

        keys = r["c7n:AccessKeys"]
        if matched:
            m_keys = resolve_credential_keys(
                r.get(CredentialReport.matched_annotation_key), keys
            )
            assert m_keys, "shouldn't have gotten this far without keys"
            keys = m_keys

        for k in keys:
            if age:
                if not k["CreateDate"] < threshold_date:
                    continue
            if disable:
                client.update_access_key(
                    UserName=r["UserName"],
                    AccessKeyId=k["AccessKeyId"],
                    Status="Inactive",
                )
            else:
                client.delete_access_key(
                    UserName=r["UserName"], AccessKeyId=k["AccessKeyId"]
                )


# Traceback (AssertionError)
[ERROR]	2021-01-29T09:48:39.544Z	9911f614-77a7-465b-8544-743b132ff816	Error while executing policyTraceback (most recent call last):  File "/var/task/c7n/policy.py", line 316, in run    results = a.process(resources)  File "/var/task/c7n/resources/iam.py", line 2211, in process    assert m_keys, "shouldn't have gotten this far without keys"AssertionError: shouldn't have gotten this far without keys | [ERROR] 2021-01-29T09:48:39.544Z 9911f614-77a7-465b-8544-743b132ff816 Error while executing policy Traceback (most recent call last): File "/var/task/c7n/policy.py", line 316, in run results = a.process(resources) File "/var/task/c7n/resources/iam.py", line 2211, in process assert m_keys, "shouldn't have gotten this far without keys" AssertionError: shouldn't have gotten this far without keys

# Fixed code
def process(self, resources):
    client = local_session(self.manager.session_factory).client("iam")

    age = self.data.get("age")
    disable = self.data.get("disable")
    matched = self.data.get("matched")

    if age:
        threshold_date = datetime.datetime.now(tz=tzutc()) - timedelta(age)

    for r in resources:
        if "c7n:AccessKeys" not in r:
            r["c7n:AccessKeys"] = client.list_access_keys(UserName=r["UserName"])[
                "AccessKeyMetadata"
            ]

        keys = r["c7n:AccessKeys"]
        if matched:
            m_keys = resolve_credential_keys(
                r.get(CredentialReport.matched_annotation_key), keys
            )
            # It is possible for a _user_ to match multiple credential filters
            # without having any single key match them all.
            if not m_keys:
                continue
            keys = m_keys

        for k in keys:
            if age:
                if not k["CreateDate"] < threshold_date:
                    continue
            if disable:
                client.update_access_key(
                    UserName=r["UserName"],
                    AccessKeyId=k["AccessKeyId"],
                    Status="Inactive",
                )
            else:
                client.delete_access_key(
                    UserName=r["UserName"], AccessKeyId=k["AccessKeyId"]
                )