Repository: cloud-custodian/cloud-custodian

Issue:
CodeCommit tags missing
### Discussed in https://github.com/orgs/cloud-custodian/discussions/7955

<div type='discussions-op-text'>

<sup>Originally posted by **marcusit** November  1, 2022</sup>
We can't seem to get tags out of our CodeCommit repositories. When we run the exact same filter against other resources we do get a list of tags back. Our repos have tags attached to them.

<br>

**Install command:**
```
python3 -m venv custodian
source custodian/bin/activate
pip install c7n c7n-org
c7n-org run -c Accounts/aws-accounts.yml -s comp -u Policies/tag-compliance.yml -r us-east-1
```

**Filter (tag-compliance.yml):**
```
vars:
  tag-filters: &tag-compliance-filters
        - type: value
          key: "tag:my-tag"
          op: regex-case
          value: ^[a-z A-Z0-9_\\-]+$
policies:
  - name: codecommit
    resource: aws.codecommit
    filters:
      - not:
        - and: *tag-compliance-filters
```


**Output:**
```
 {
    "accountId": "1234567890",
    "repositoryId": "abc123-abc123-abc123-abc123-abc123",
    "repositoryName": "my-repo-name",
    "repositoryDescription": "This is a codecommit repository",
    "defaultBranch": "main",
    "lastModifiedDate": "2022-10-28T12:39:27.098000+00:00",
    "creationDate": "2022-03-08T16:08:21.915000+00:00",
    "cloneUrlHttp": "https://git-codecommit.us-east-1.amazonaws.com/v1/repos/my-repo-name",
    "cloneUrlSsh": "ssh://git-codecommit.us-east-1.amazonaws.com/v1/repos/my-repo-name",
    "Arn": "arn:aws:codecommit:us-east-1: 1234567890:my-repo-name"
  },
```


Discussion:

Resolving patch:
diff --git a/c7n/resources/code.py b/c7n/resources/code.py
--- a/c7n/resources/code.py
+++ b/c7n/resources/code.py
@@ -29,6 +29,16 @@ class resource_type(TypeInfo):
         cfn_type = 'AWS::CodeCommit::Repository'
         universal_taggable = object()
 
+    def augment(self, resources):
+        """Fetch tags after picking up batch details
+
+        We need ARNs to bulk-fetch tags, but don't know
+        ARNs until after the base augment fires.
+        """
+
+        resources = super().augment(resources)
+        return universal_augment(self, resources)
+
     def get_resources(self, ids, cache=True):
         return universal_augment(self, self.augment([{'repositoryName': i} for i in ids]))
 


Test patch:
diff --git a/tests/data/placebo/test_codecommit/codecommit.BatchGetRepositories_1.json b/tests/data/placebo/test_codecommit/codecommit.BatchGetRepositories_1.json
--- a/tests/data/placebo/test_codecommit/codecommit.BatchGetRepositories_1.json
+++ b/tests/data/placebo/test_codecommit/codecommit.BatchGetRepositories_1.json
@@ -1,47 +1,38 @@
 {
-    "status_code": 200, 
+    "status_code": 200,
     "data": {
         "repositories": [
             {
-                "repositoryName": "custodian-config-repo", 
-                "cloneUrlSsh": "ssh://git-codecommit.us-east-2.amazonaws.com/v1/repos/custodian-config-repo", 
+                "accountId": "644160558196",
+                "repositoryId": "3a297b68-8c6d-4170-a5b5-7bd220840980",
+                "repositoryName": "demo-policies",
+                "defaultBranch": "main",
                 "lastModifiedDate": {
-                    "hour": 23, 
-                    "__class__": "datetime", 
-                    "month": 1, 
-                    "second": 48, 
-                    "microsecond": 447000, 
-                    "year": 2017, 
-                    "day": 2, 
-                    "minute": 14
-                }, 
-                "repositoryId": "44b2224c-7f2a-497c-a6c8-b70013069b59", 
-                "cloneUrlHttp": "https://git-codecommit.us-east-2.amazonaws.com/v1/repos/custodian-config-repo", 
+                    "__class__": "datetime",
+                    "year": 2022,
+                    "month": 4,
+                    "day": 14,
+                    "hour": 1,
+                    "minute": 34,
+                    "second": 37,
+                    "microsecond": 764000
+                },
                 "creationDate": {
-                    "hour": 23, 
-                    "__class__": "datetime", 
-                    "month": 1, 
-                    "second": 48, 
-                    "microsecond": 447000, 
-                    "year": 2017, 
-                    "day": 2, 
-                    "minute": 14
-                }, 
-                "Arn": "arn:aws:codecommit:us-east-2:644160558196:custodian-config-repo", 
-                "accountId": "644160558196"
+                    "__class__": "datetime",
+                    "year": 2022,
+                    "month": 4,
+                    "day": 14,
+                    "hour": 1,
+                    "minute": 12,
+                    "second": 51,
+                    "microsecond": 632000
+                },
+                "cloneUrlHttp": "https://git-codecommit.us-east-2.amazonaws.com/v1/repos/demo-policies",
+                "cloneUrlSsh": "ssh://git-codecommit.us-east-2.amazonaws.com/v1/repos/demo-policies",
+                "Arn": "arn:aws:codecommit:us-east-2:644160558196:demo-policies"
             }
-        ], 
-        "repositoriesNotFound": [], 
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "b70eb477-d17d-11e6-a4d0-2b02666d9cf9", 
-            "HTTPHeaders": {
-                "x-amzn-requestid": "b70eb477-d17d-11e6-a4d0-2b02666d9cf9", 
-                "date": "Tue, 03 Jan 2017 06:27:35 GMT", 
-                "content-length": "495", 
-                "content-type": "application/x-amz-json-1.1"
-            }
-        }
+        ],
+        "repositoriesNotFound": [],
+        "ResponseMetadata": {}
     }
 }
\ No newline at end of file
diff --git a/tests/data/placebo/test_codecommit/codecommit.ListRepositories_1.json b/tests/data/placebo/test_codecommit/codecommit.ListRepositories_1.json
--- a/tests/data/placebo/test_codecommit/codecommit.ListRepositories_1.json
+++ b/tests/data/placebo/test_codecommit/codecommit.ListRepositories_1.json
@@ -1,22 +1,12 @@
 {
-    "status_code": 200, 
+    "status_code": 200,
     "data": {
         "repositories": [
             {
-                "repositoryName": "custodian-config-repo", 
-                "repositoryId": "44b2224c-7f2a-497c-a6c8-b70013069b59"
+                "repositoryName": "demo-policies",
+                "repositoryId": "3a297b68-8c6d-4170-a5b5-7bd220840980"
             }
-        ], 
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "b6eb2635-d17d-11e6-bdc1-53f524badcfc", 
-            "HTTPHeaders": {
-                "x-amzn-requestid": "b6eb2635-d17d-11e6-bdc1-53f524badcfc", 
-                "date": "Tue, 03 Jan 2017 06:27:35 GMT", 
-                "content-length": "115", 
-                "content-type": "application/x-amz-json-1.1"
-            }
-        }
+        ],
+        "ResponseMetadata": {}
     }
 }
\ No newline at end of file
diff --git a/tests/data/placebo/test_codecommit/tagging.GetResources_1.json b/tests/data/placebo/test_codecommit/tagging.GetResources_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_codecommit/tagging.GetResources_1.json
@@ -0,0 +1,18 @@
+{
+    "status_code": 200,
+    "data": {
+        "PaginationToken": "",
+        "ResourceTagMappingList": [
+            {
+                "ResourceARN": "arn:aws:codecommit:us-east-2:644160558196:demo-policies",
+                "Tags": [
+                    {
+                        "Key": "Owner",
+                        "Value": "aj@stacklet.io"
+                    }
+                ]
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_codecommit_delete/tagging.GetResources_1.json b/tests/data/placebo/test_codecommit_delete/tagging.GetResources_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_codecommit_delete/tagging.GetResources_1.json
@@ -0,0 +1,8 @@
+{
+    "status_code": 200,
+    "data": {
+        "PaginationToken": "",
+        "ResourceTagMappingList": [],
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/test_code.py b/tests/test_code.py
--- a/tests/test_code.py
+++ b/tests/test_code.py
@@ -43,15 +43,19 @@ def test_cross_account_and_delete_repo(self):
 class CodeCommit(BaseTest):
 
     def test_query_repos(self):
-        factory = self.replay_flight_data("test_codecommit")
+        factory = self.replay_flight_data("test_codecommit", region="us-east-2")
         p = self.load_policy(
-            {"name": "get-repos", "resource": "codecommit"}, session_factory=factory
+            {"name": "get-repos", "resource": "codecommit", "filters": [
+                {"type": "value", "key": "tag:Owner", "value": "aj@stacklet.io"},
+            ]},
+            session_factory=factory,
+            config={"region": "us-east-2"},
         )
         resources = p.run()
         self.assertEqual(len(resources), 1)
         self.assertEqual(
             resources[0]["cloneUrlSsh"],
-            "ssh://git-codecommit.us-east-2.amazonaws.com/v1/repos/custodian-config-repo",
+            "ssh://git-codecommit.us-east-2.amazonaws.com/v1/repos/demo-policies",
         )
 
     def test_get_repo_resources(self):