Repository: cloud-custodian/cloud-custodian

Issue:
include policy exception stack trace in blob output
**Describe the bug**
When a policy exception occurs, the blob output only contains a metric that a policy exception happened.  The stack trace or any other details are not included in the uploaded output files.

**To Reproduce**
Generate a policy exception while configured to upload logs to s3.

**Expected behavior**
I would expect to find the `custodian.output:ERROR` in the logs in s3.

**Example**
An example output for a policy run throwing an exception:
```
2021-05-19 20:52:25,411: custodian.output:DEBUG metric:PolicyException Count:1 policy:daily-aws-std-kms-01-audit restype:kms-key
2021-05-19 20:52:25,411: custodian.output:DEBUG metric:ApiCalls Count:23 policy:daily-aws-std-kms-01-audit restype:kms-key
2021-05-19 20:52:25,412: custodian.output:ERROR Error while executing policy
Traceback (most recent call last):
  File "/codebuild/output/src731/src/s3/00/c7n/policy.py", line 285, in run
    resources = self.policy.resource_manager.resources()
  File "/codebuild/output/src731/src/s3/00/c7n/query.py", line 517, in resources
    resources = self.augment(resources)
  File "/codebuild/output/src731/src/s3/00/c7n/query.py", line 573, in augment
    return self.source.augment(resources)
  File "/codebuild/output/src731/src/s3/00/c7n/resources/kms.py", line 78, in augment
    return universal_augment(self.manager, resources)
  File "/codebuild/output/src731/src/s3/00/c7n/tags.py", line 89, in universal_augment
    zip(self.get_arns(rfetch), rfetch), 100):
  File "/codebuild/output/src731/src/s3/00/c7n/query.py", line 604, in get_arns
    arns.append(r[arn_key])
KeyError: 'Arn'
2021-05-19 20:52:25,413: custodian.output.blob:DEBUG s3: uploading policy logs
2021-05-19 20:52:25,588: custodian.output.blob:DEBUG s3: policy logs uploaded
```
Check the uploaded `custodian-run.log.gz` output and it does not include the exception details:
```
$ aws s3 cp s3://$bucket/$path/custodian-run.log.gz - | gunzip -c
2021-05-19 20:52:25,005 - custodian.policy - DEBUG - Running policy:daily-aws-std-kms-01-audit resource:kms-key region:us-west-2 c7n:0.9.11
2021-05-19 20:52:25,019 - custodian.cache - DEBUG - Using cache file /tmp/cloud-custodian.cache
2021-05-19 20:52:25,088 - custodian.cache - DEBUG - Using cache file /tmp/cloud-custodian.cache
2021-05-19 20:52:25,153 - custodian.resources.keyalias - DEBUG - Filtered from 19 to 19 keyalias
2021-05-19 20:52:25,223 - custodian.resources.key - WARNING - Access denied when describing key:<redacted>
2021-05-19 20:52:25,233 - custodian.resources.key - WARNING - Access denied when describing key:<redacted>
2021-05-19 20:52:25,253 - custodian.resources.key - WARNING - Access denied when describing key:<redacted>
2021-05-19 20:52:25,274 - custodian.resources.key - WARNING - Access denied when describing key:<redacted>
2021-05-19 20:52:25,320 - custodian.resources.key - WARNING - Access denied when describing key:<redacted>
2021-05-19 20:52:25,332 - custodian.resources.key - WARNING - Access denied when describing key:<redacted>
2021-05-19 20:52:25,361 - custodian.resources.key - WARNING - Access denied when describing key:<redacted>
2021-05-19 20:52:25,411 - custodian.output - DEBUG - metric:PolicyException Count:1 policy:daily-aws-std-kms-01-audit restype:kms-key
2021-05-19 20:52:25,411 - custodian.output - DEBUG - metric:ApiCalls Count:23 policy:daily-aws-std-kms-01-audit restype:kms-key
```


Discussion:
that's odd

Resolving patch:
diff --git a/c7n/output.py b/c7n/output.py
--- a/c7n/output.py
+++ b/c7n/output.py
@@ -330,9 +330,9 @@ def __enter__(self):
         return self
 
     def __exit__(self, exc_type=None, exc_value=None, exc_traceback=None):
-        self.leave_log()
         if exc_type is not None:
             log.exception("Error while executing policy")
+        self.leave_log()
 
     def join_log(self):
         self.handler = self.get_handler()


Test patch: