# Buggy code
def get_resource_tag_targets(resource, target_tag_keys):
    if "Tags" not in resource:
        return []
    tags = {tag["Key"]: tag["Value"] for tag in resource["Tags"]}
    targets = []
    for target_tag_key in target_tag_keys:
        if target_tag_key in tags:
            targets.append(tags[target_tag_key])
    return targets


# Traceback (TypeError)
policies:


- name: msk-enforce-encryption-status
  description: |
    Deletes Non TLS only in-transit encrypted Kafka clusters and notifies customer.
  resource: kafka
  mode:
      type: periodic
      schedule: "rate(30 minutes)"
      packages:
        - botocore
        - boto3
        - urllib3
        - certifi
      tags:
          ResourceContact: "AGTAutomatedCloudConfigurationStandards@transamerica.com"
          ResourcePurpose: "Managed by AGT Automated Cloud Configuration Standards - ACCS"
          Channel: AGT
          BillingCostCenter: "0701-97290010 AGT"
          Division: agt
          Environment: prd
          AGTManaged: "true"
  filters:
    - type: value
      key: "EncryptionInfo.EncryptionInTransit.ClientBroker"
      op: ne
      value: "TLS"
    - type: value
      value_type: date
      key: CreationTime
      op: greater-than
      value: "2020/02/20"
  actions:
    - type: delete
    - type: notify
      template: default.html
      comments: |
        The below Kafka cluster is not TLS encrypted and therefore it did not meet
        Kafka encrption requirements.
      priority_header: 1
      subject: "Kafka - Kafka Cluster Deleted - [custodian {{ account }} - {{ region }}]"
      violation_desc: |
          Kafka clusters are required to only allow TLS encrypted data.
      action_desc: "Actions Taken: The below Kafka cluster has been deleted.  Please create new Kafka Cluster with Only TLS encrypted traffic allowed option."
      owner_absent_contact:
        - "{missingcontact}"
      to:
        - ouremail@company.com
        - resource-owner
      transport:
        type: sqs
        queue: https://sqs.us-east-1.amazonaws.com/123456789000/cloud-custodian-mailer
        region: us-east-1
    - type: put-metric
      key: ClusterName
      namespace: OurNamespace
      metric_name: Kafka-Cluster-Unencrypted-Delete
      op: count
      units: Count


Mailer Log:

[DEBUG] 2020-02-28T20:15:10.991Z 63d4cdff-ddcf-443c-963f-aebd7cdeb1cf Message id: 62171941-8278-41ed-a75d-01d3bb4e08fd received {'mtype': {'StringValue': 'maidmsg/1.0', 'DataType': 'String'}}
14:15:10
[DEBUG] 2020-02-28T20:15:10.992Z 63d4cdff-ddcf-443c-963f-aebd7cdeb1cf Got account:ouraccount message:62171941-8278-41ed-a75d-01d3bb4e08fd kafka:2 policy:msk-enforce-encryption recipients:Ouremail@company.com, resource-owner, event-owner
14:15:11
[INFO] 2020-02-28T20:15:11.457Z 63d4cdff-ddcf-443c-963f-aebd7cdeb1cf no aws username in event
14:15:11
[ERROR] 2020-02-28T20:15:11.457Z 63d4cdff-ddcf-443c-963f-aebd7cdeb1cf Error starting mailer MailerSqsQueueProcessor().
14:15:11
Error: string indices must be integers
14:15:11
Traceback (most recent call last):
14:15:11
File "/var/task/c7n_mailer/handle.py", line 46, in start_c7n_mailer
14:15:11
mailer_sqs_queue_processor.run(parallel)
14:15:11
File "/var/task/c7n_mailer/sqs_queue_processor.py", line 130, in run
14:15:11
self.process_sqs_message(sqs_message)
14:15:11
File "/var/task/c7n_mailer/sqs_queue_processor.py", line 162, in process_sqs_message
14:15:11
to_addrs_to_email_messages_map = email_delivery.get_to_addrs_email_messages_map(sqs_message)
14:15:11
File "/var/task/c7n_mailer/email_delivery.py", line 194, in get_to_addrs_email_messages_map
14:15:11
to_addrs_to_resources_map = self.get_email_to_addrs_to_resources_map(sqs_message)
14:15:11
File "/var/task/c7n_mailer/email_delivery.py", line 167, in get_email_to_addrs_to_resources_map
14:15:11
resource
14:15:11
File "/var/task/c7n_mailer/email_delivery.py", line 80, in get_ldap_emails_from_resource
14:15:11
ldap_uid_tag_values = get_resource_tag_targets(resource, ldap_uid_tag_keys)
14:15:11
File "/var/task/c7n_mailer/utils.py", line 93, in get_resource_tag_targets
14:15:11
tags = {tag['Key']: tag['Value'] for tag in resource['Tags']}
14:15:11
File "/var/task/c7n_mailer/utils.py", line 93, in <dictcomp>
14:15:11
tags = {tag['Key']: tag['Value'] for tag in resource['Tags']}
14:15:11
TypeError: string indices must be integers
14:15:11
END RequestId: 63d4cdff-ddcf-443c-963f-aebd7cdeb1cf

# Fixed code
def get_resource_tag_targets(resource, target_tag_keys):
    if "Tags" not in resource:
        return []
    if isinstance(resource["Tags"], dict):
        tags = resource["Tags"]
    else:
        tags = {tag["Key"]: tag["Value"] for tag in resource["Tags"]}
    targets = []
    for target_tag_key in target_tag_keys:
        if target_tag_key in tags:
            targets.append(tags[target_tag_key])
    return targets