# Buggy code
def initialize_policies(self, policy_collection, options):
    """Return a set of policies targetted to the given regions.

    Supports symbolic regions like 'all'. This will automatically
    filter out policies if their being targetted to a region that
    does not support the service. Global services will target a
    single region (us-east-1 if only all specified, else first
    region in the list).

    Note for region partitions (govcloud and china) an explicit
    region from the partition must be passed in.
    """
    from c7n.policy import Policy, PolicyCollection

    policies = []
    service_region_map, resource_service_map = get_service_region_map(
        options.regions, policy_collection.resource_types
    )

    for p in policy_collection:
        if "aws." in p.resource_type:
            _, resource_type = p.resource_type.split(".", 1)
        else:
            resource_type = p.resource_type
        available_regions = service_region_map.get(
            resource_service_map.get(resource_type), ()
        )

        # its a global service/endpoint, use user provided region
        # or us-east-1.
        if not available_regions and options.regions:
            candidates = [r for r in options.regions if r != "all"]
            candidate = candidates and candidates[0] or "us-east-1"
            svc_regions = [candidate]
        elif "all" in options.regions:
            svc_regions = available_regions
        else:
            svc_regions = options.regions

        for region in svc_regions:
            if available_regions and region not in available_regions:
                level = "all" in options.regions and logging.DEBUG or logging.WARNING
                # TODO: fixme
                policy_collection.log.log(
                    level,
                    "policy:%s resources:%s not available in region:%s",
                    p.name,
                    p.resource_type,
                    region,
                )
                continue
            options_copy = copy.copy(options)
            options_copy.region = str(region)

            if (
                len(options.regions) > 1
                or "all" in options.regions
                and getattr(options, "output_dir", None)
            ):
                options_copy.output_dir = (
                    options.output_dir.rstrip("/") + "/%s" % region
                )
            policies.append(
                Policy(
                    p.data,
                    options_copy,
                    session_factory=policy_collection.session_factory(),
                )
            )

    return PolicyCollection(
        # order policies by region to minimize local session invalidation.
        # note relative ordering of policies must be preserved, python sort
        # is stable.
        sorted(policies, key=operator.attrgetter("options.region")),
        options,
    )


# Traceback (botocore.exceptions.ClientError)
$ python --version
Python 3.7.3

$ pip --version
pip 19.1.1 from /home/ec2-user/custodian/lib/python3.7/site-packages/pip (python 3.7)

$ pip list|grep c7n
c7n                0.8.44.2
c7n-org            0.5.3

$ custodian run -s ~/output -r all list-ec2-instances.yaml --cache-period 0

2019-06-29 02:53:26,186: custodian.output:ERROR Error while executing policy
Traceback (most recent call last):
File "/home/ec2-user/custodian/lib/python3.7/site-packages/c7n/policy.py", line 229, in run
resources = self.policy.resource_manager.resources()
File "/home/ec2-user/custodian/lib/python3.7/site-packages/c7n/resources/ec2.py", line 92, in resources
return super(EC2, self).resources(query=query)
File "/home/ec2-user/custodian/lib/python3.7/site-packages/c7n/query.py", line 453, in resources
resources = self.source.resources(query)
File "/home/ec2-user/custodian/lib/python3.7/site-packages/c7n/query.py", line 230, in resources
return self.query.filter(self.manager, **query)
File "/home/ec2-user/custodian/lib/python3.7/site-packages/c7n/query.py", line 90, in filter
getattr(resource_manager, 'retry', None)) or []
File "/home/ec2-user/custodian/lib/python3.7/site-packages/c7n/query.py", line 69, in _invoke_client_enum
data = results.build_full_result()
File "/home/ec2-user/custodian/lib/python3.7/site-packages/botocore/paginate.py", line 449, in build_full_result
for response in self:
File "/home/ec2-user/custodian/lib/python3.7/site-packages/botocore/paginate.py", line 255, in __iter__
response = self._make_request(current_kwargs)
File "/home/ec2-user/custodian/lib/python3.7/site-packages/c7n/query.py", line 679, in _make_request
return self.retry(self._method, **current_kwargs)
File "/home/ec2-user/custodian/lib/python3.7/site-packages/c7n/utils.py", line 383, in _retry
return func(*args, **kw)
File "/home/ec2-user/custodian/lib/python3.7/site-packages/botocore/client.py", line 357, in _api_call
return self._make_api_call(operation_name, kwargs)
File "/home/ec2-user/custodian/lib/python3.7/site-packages/botocore/client.py", line 661, in _make_api_call
raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (AuthFailure) when calling the DescribeInstances operation: AWS was not able to validate the provided access credentials
2019-06-29 02:53:26,187: custodian.commands:ERROR Error while executing policy list-ec2-instances, continuing
Traceback (most recent call last):
File "/home/ec2-user/custodian/lib/python3.7/site-packages/c7n/commands.py", line 269, in run
policy()
File "/home/ec2-user/custodian/lib/python3.7/site-packages/c7n/policy.py", line 945, in __call__
resources = mode.run()
File "/home/ec2-user/custodian/lib/python3.7/site-packages/c7n/policy.py", line 229, in run
resources = self.policy.resource_manager.resources()
File "/home/ec2-user/custodian/lib/python3.7/site-packages/c7n/resources/ec2.py", line 92, in resources
return super(EC2, self).resources(query=query)
File "/home/ec2-user/custodian/lib/python3.7/site-packages/c7n/query.py", line 453, in resources
resources = self.source.resources(query)
File "/home/ec2-user/custodian/lib/python3.7/site-packages/c7n/query.py", line 230, in resources
return self.query.filter(self.manager, **query)
File "/home/ec2-user/custodian/lib/python3.7/site-packages/c7n/query.py", line 90, in filter
getattr(resource_manager, 'retry', None)) or []
File "/home/ec2-user/custodian/lib/python3.7/site-packages/c7n/query.py", line 69, in _invoke_client_enum
data = results.build_full_result()
File "/home/ec2-user/custodian/lib/python3.7/site-packages/botocore/paginate.py", line 449, in build_full_result
for response in self:
File "/home/ec2-user/custodian/lib/python3.7/site-packages/botocore/paginate.py", line 255, in __iter__
response = self._make_request(current_kwargs)
File "/home/ec2-user/custodian/lib/python3.7/site-packages/c7n/query.py", line 679, in _make_request
return self.retry(self._method, **current_kwargs)
File "/home/ec2-user/custodian/lib/python3.7/site-packages/c7n/utils.py", line 383, in _retry
return func(*args, **kw)
File "/home/ec2-user/custodian/lib/python3.7/site-packages/botocore/client.py", line 357, in _api_call
return self._make_api_call(operation_name, kwargs)
File "/home/ec2-user/custodian/lib/python3.7/site-packages/botocore/client.py", line 661, in _make_api_call
raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (AuthFailure) when calling the DescribeInstances operation: AWS was not able to validate the provided access credentials
2019-06-29 02:53:26,834: custodian.policy:INFO policy:list-ec2-instances resource:ec2 region:ap-northeast-1 count:0 time:0.63
2019-06-29 02:53:27,456: custodian.policy:INFO policy:list-ec2-instances resource:ec2 region:ap-northeast-2 count:0 time:0.60
2019-06-29 02:53:28,463: custodian.policy:INFO policy:list-ec2-instances resource:ec2 region:ap-south-1 count:0 time:0.99
2019-06-29 02:53:29,238: custodian.policy:INFO policy:list-ec2-instances resource:ec2 region:ap-southeast-1 count:0 time:0.76
2019-06-29 02:53:30,093: custodian.policy:INFO policy:list-ec2-instances resource:ec2 region:ap-southeast-2 count:0 time:0.84
2019-06-29 02:53:30,505: custodian.policy:INFO policy:list-ec2-instances resource:ec2 region:ca-central-1 count:0 time:0.39
2019-06-29 02:53:31,297: custodian.policy:INFO policy:list-ec2-instances resource:ec2 region:eu-central-1 count:0 time:0.77
2019-06-29 02:53:32,292: custodian.policy:INFO policy:list-ec2-instances resource:ec2 region:eu-north-1 count:0 time:0.97
2019-06-29 02:53:32,955: custodian.policy:INFO policy:list-ec2-instances resource:ec2 region:eu-west-1 count:0 time:0.64
2019-06-29 02:53:33,677: custodian.policy:INFO policy:list-ec2-instances resource:ec2 region:eu-west-2 count:0 time:0.70
2019-06-29 02:53:34,443: custodian.policy:INFO policy:list-ec2-instances resource:ec2 region:eu-west-3 count:0 time:0.75
2019-06-29 02:53:35,446: custodian.policy:INFO policy:list-ec2-instances resource:ec2 region:sa-east-1 count:0 time:0.98
2019-06-29 02:53:35,984: custodian.policy:INFO policy:list-ec2-instances resource:ec2 region:us-east-1 count:0 time:0.52
2019-06-29 02:53:36,393: custodian.policy:INFO policy:list-ec2-instances resource:ec2 region:us-east-2 count:0 time:0.39
2019-06-29 02:53:36,611: custodian.policy:INFO policy:list-ec2-instances resource:ec2 region:us-west-1 count:0 time:0.20
2019-06-29 02:53:36,756: custodian.policy:INFO policy:list-ec2-instances resource:ec2 region:us-west-2 count:2 time:0.13

# Fixed code
def initialize_policies(self, policy_collection, options):
    """Return a set of policies targetted to the given regions.

    Supports symbolic regions like 'all'. This will automatically
    filter out policies if their being targetted to a region that
    does not support the service. Global services will target a
    single region (us-east-1 if only all specified, else first
    region in the list).

    Note for region partitions (govcloud and china) an explicit
    region from the partition must be passed in.
    """
    from c7n.policy import Policy, PolicyCollection

    policies = []
    service_region_map, resource_service_map = get_service_region_map(
        options.regions, policy_collection.resource_types
    )
    if "all" in options.regions:
        enabled_regions = set(
            [
                r["RegionName"]
                for r in get_profile_session(options)
                .client("ec2")
                .describe_regions(
                    Filters=[
                        {
                            "Name": "opt-in-status",
                            "Values": ["opt-in-not-required", "opted-in"],
                        }
                    ]
                )
                .get("Regions")
            ]
        )
    for p in policy_collection:
        if "aws." in p.resource_type:
            _, resource_type = p.resource_type.split(".", 1)
        else:
            resource_type = p.resource_type
        available_regions = service_region_map.get(
            resource_service_map.get(resource_type), ()
        )

        # its a global service/endpoint, use user provided region
        # or us-east-1.
        if not available_regions and options.regions:
            candidates = [r for r in options.regions if r != "all"]
            candidate = candidates and candidates[0] or "us-east-1"
            svc_regions = [candidate]
        elif "all" in options.regions:
            svc_regions = list(set(available_regions).intersection(enabled_regions))
        else:
            svc_regions = options.regions

        for region in svc_regions:
            if available_regions and region not in available_regions:
                level = "all" in options.regions and logging.DEBUG or logging.WARNING
                # TODO: fixme
                policy_collection.log.log(
                    level,
                    "policy:%s resources:%s not available in region:%s",
                    p.name,
                    p.resource_type,
                    region,
                )
                continue
            options_copy = copy.copy(options)
            options_copy.region = str(region)

            if (
                len(options.regions) > 1
                or "all" in options.regions
                and getattr(options, "output_dir", None)
            ):
                options_copy.output_dir = (
                    options.output_dir.rstrip("/") + "/%s" % region
                )
            policies.append(
                Policy(
                    p.data,
                    options_copy,
                    session_factory=policy_collection.session_factory(),
                )
            )

    return PolicyCollection(
        # order policies by region to minimize local session invalidation.
        # note relative ordering of policies must be preserved, python sort
        # is stable.
        sorted(policies, key=operator.attrgetter("options.region")),
        options,
    )