# Buggy code
def process_resource(self, client, r, related_tags, tag_keys, tag_action):
    tags = {}
    resource_tags = {
        t["Key"]: t["Value"]
        for t in r.get("Tags", [])
        if not t["Key"].startswith("aws:")
    }

    if tag_keys == "*":
        tags = {k: v for k, v in related_tags.items() if resource_tags.get(k) != v}
    else:
        tags = {
            k: v
            for k, v in related_tags.items()
            if k in tag_keys and resource_tags.get(k) != v
        }
    if not tags:
        return
    if not isinstance(tag_action, UniversalTag):
        tags = [{"Key": k, "Value": v} for k, v in tags.items()]
    tag_action.process_resource_set(client, resource_set=[r], tags=tags)
    return True


# Traceback (botocore.exceptions.ClientError)
$ custodian run --verbose --cache-period 0 --region us-east-1 -p aws-copy-tags-from-instance-to-ebs-volume -s . daily_policies.yml
2020-07-21 15:46:54,904: custodian.cache:DEBUG Disabling cache
2020-07-21 15:46:54,905: custodian.commands:DEBUG Loaded file daily_policies.yml. Contains 3 policies
2020-07-21 15:46:55,510: custodian.output:DEBUG Storing output with <LogFile file://./aws-copy-tags-from-instance-to-ebs-volume/custodian-run.log>
2020-07-21 15:46:55,517: custodian.policy:DEBUG Running policy:aws-copy-tags-from-instance-to-ebs-volume resource:aws.ebs region:us-east-1 c7n:0.9.4
2020-07-21 15:47:00,540: custodian.resources.ebs:DEBUG Filtered from 1150 to 1118 ebs
2020-07-21 15:47:00,540: custodian.policy:INFO policy:aws-copy-tags-from-instance-to-ebs-volume resource:aws.ebs region:us-east-1 count:1118 time:5.02
2020-07-21 15:47:05,964: custodian.output:DEBUG metric:ResourceCount Count:1118 policy:aws-copy-tags-from-instance-to-ebs-volume restype:aws.ebs scope:policy
2020-07-21 15:47:05,965: custodian.output:DEBUG metric:PolicyException Count:1 policy:aws-copy-tags-from-instance-to-ebs-volume restype:aws.ebs
2020-07-21 15:47:05,965: custodian.output:DEBUG metric:ApiCalls Count:4 policy:aws-copy-tags-from-instance-to-ebs-volume restype:aws.ebs
2020-07-21 15:47:05,968: custodian.output:ERROR Error while executing policy
Traceback (most recent call last):
  File "/home/gshelby/.local/lib/python3.8/site-packages/c7n/policy.py", line 323, in run
    results = a.process(resources)
  File "/home/gshelby/.local/lib/python3.8/site-packages/c7n/tags.py", line 1046, in process
    elif self.process_resource(
  File "/home/gshelby/.local/lib/python3.8/site-packages/c7n/tags.py", line 1071, in process_resource
    tag_action.process_resource_set(
  File "/home/gshelby/.local/lib/python3.8/site-packages/c7n/tags.py", line 430, in process_resource_set
    self.manager.retry(
  File "/home/gshelby/.local/lib/python3.8/site-packages/c7n/utils.py", line 373, in _retry
    return func(*args, **kw)
  File "/home/gshelby/.local/lib/python3.8/site-packages/botocore/client.py", line 316, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/home/gshelby/.local/lib/python3.8/site-packages/botocore/client.py", line 635, in _make_api_call
    raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (InvalidParameterValue) when calling the CreateTags operation: Value ( aws:autoscaling:groupName ) for parameter key is invalid. Tag keys starting with 'aws:' are reserved for internal use
2020-07-21 15:47:05,971: custodian.commands:ERROR Error while executing policy aws-copy-tags-from-instance-to-ebs-volume, continuing
Traceback (most recent call last):
  File "/home/gshelby/.local/lib/python3.8/site-packages/c7n/commands.py", line 282, in run
    policy()
  File "/home/gshelby/.local/lib/python3.8/site-packages/c7n/policy.py", line 1176, in __call__
    resources = mode.run()
  File "/home/gshelby/.local/lib/python3.8/site-packages/c7n/policy.py", line 323, in run
    results = a.process(resources)
  File "/home/gshelby/.local/lib/python3.8/site-packages/c7n/tags.py", line 1046, in process
    elif self.process_resource(
  File "/home/gshelby/.local/lib/python3.8/site-packages/c7n/tags.py", line 1071, in process_resource
    tag_action.process_resource_set(
  File "/home/gshelby/.local/lib/python3.8/site-packages/c7n/tags.py", line 430, in process_resource_set
    self.manager.retry(
  File "/home/gshelby/.local/lib/python3.8/site-packages/c7n/utils.py", line 373, in _retry
    return func(*args, **kw)
  File "/home/gshelby/.local/lib/python3.8/site-packages/botocore/client.py", line 316, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/home/gshelby/.local/lib/python3.8/site-packages/botocore/client.py", line 635, in _make_api_call
    raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (InvalidParameterValue) when calling the CreateTags operation: Value ( aws:autoscaling:groupName ) for parameter key is invalid. Tag keys starting with 'aws:' are reserved for internal use
2020-07-21 15:47:05,985: custodian.commands:ERROR The following policies had errors while executing
 - aws-copy-tags-from-instance-to-ebs-volume

# Fixed code
def process_resource(self, client, r, related_tags, tag_keys, tag_action):
    tags = {}
    resource_tags = {
        t["Key"]: t["Value"]
        for t in r.get("Tags", [])
        if not t["Key"].startswith("aws:")
    }

    if tag_keys == "*":
        tags = {
            k: v
            for k, v in related_tags.items()
            if resource_tags.get(k) != v and not k.startswith("aws:")
        }
    else:
        tags = {
            k: v
            for k, v in related_tags.items()
            if k in tag_keys and resource_tags.get(k) != v
        }
    if not tags:
        return
    if not isinstance(tag_action, UniversalTag):
        tags = [{"Key": k, "Value": v} for k, v in tags.items()]
    tag_action.process_resource_set(client, resource_set=[r], tags=tags)
    return True