Repository: cloud-custodian/cloud-custodian

Issue:
cross account filter traceback
```
2016-12-26 00:27:01,755 - ERROR - custodian.output - Error while executing policy
Traceback (most recent call last):
File "/usr/local/custodian/local/lib/python2.7/site-packages/c7n/policy.py", line 167, in run
resources = self.policy.resource_manager.resources()
File "/usr/local/custodian/local/lib/python2.7/site-packages/c7n/query.py", line 164, in resources
return self.filter_resources(resources)
File "/usr/local/custodian/local/lib/python2.7/site-packages/c7n/manager.py", line 63, in filter_resources
resources = f.process(resources, event)
File "/usr/local/custodian/local/lib/python2.7/site-packages/c7n/filters/iamaccess.py", line 54, in process
return super(CrossAccountAccessFilter, self).process(resources, event)
File "/usr/local/custodian/local/lib/python2.7/site-packages/c7n/filters/core.py", line 154, in process
return filter(self, resources)
File "/usr/local/custodian/local/lib/python2.7/site-packages/c7n/filters/iamaccess.py", line 72, in __call__
violations = check_cross_account(p, self.accounts)
File "/usr/local/custodian/local/lib/python2.7/site-packages/c7n/filters/iamaccess.py", line 205, in check_cross_account
v = s['Condition']['ArnLike']['aws:SourceArn']
KeyError: 'aws:SourceArn'
```


Discussion:

Resolving patch:
diff --git a/c7n/filters/iamaccess.py b/c7n/filters/iamaccess.py
--- a/c7n/filters/iamaccess.py
+++ b/c7n/filters/iamaccess.py
@@ -202,7 +202,10 @@ def check_cross_account(policy_text, allowed_accounts):
                         violations.append(s)
         if 'ArnLike' in s['Condition']:
             # Other valid arn equals? / are invalids allowed?
-            v = s['Condition']['ArnLike']['aws:SourceArn']
+            for k in ('aws:SourceArn', 'AWS:SourceArn'):
+                v = s['Condition']['ArnLike'].get(k)
+                if v:
+                    break
             v = isinstance(v, basestring) and (v,) or v
             principal_ok = True
             for arn in v:
diff --git a/tools/c7n_salactus/c7n_salactus/cli.py b/tools/c7n_salactus/c7n_salactus/cli.py
--- a/tools/c7n_salactus/c7n_salactus/cli.py
+++ b/tools/c7n_salactus/c7n_salactus/cli.py
@@ -112,7 +112,6 @@ def reset(dbpath):
         click.echo('Invalid input :(')
 
 
-
 @cli.command()
 def workers():
     counter = Counter()
diff --git a/tools/c7n_salactus/c7n_salactus/worker.py b/tools/c7n_salactus/c7n_salactus/worker.py
--- a/tools/c7n_salactus/c7n_salactus/worker.py
+++ b/tools/c7n_salactus/c7n_salactus/worker.py
@@ -552,15 +552,15 @@ def statm(prefix):
                 for s in list(s_prefix_set):
                     if strategy.is_depth_exceeded(prefix):
                         invoke(process_bucket_iterator,
-                            account_info, bucket, s)
+                               account_info, bucket, s)
                         s_prefix_set.remove(s)
 
                 if not s_prefix_set:
                     continue
                 invoke(process_bucket_partitions,
-                    account_info, bucket,
-                    prefix_set=s_prefix_set, partition=partition,
-                    strategy=strategy, limit=limit)
+                       account_info, bucket,
+                       prefix_set=s_prefix_set, partition=partition,
+                       strategy=strategy, limit=limit)
             prefix_queue = prefix_queue[:PARTITION_QUEUE_THRESHOLD-1]
 
     if keyset:


Test patch: