Repository: cloud-custodian/cloud-custodian

Issue:
ASG -Invalid filter is marking Community AMIs as Invalid
When running the ASG policy with just the -Invalid filter it is stating that Autoscaling groups using Community AMIs are invalid.

```
- name: asg-invalid-config
  resource: asg
  description: |
     Policy finds invalid ASG based on these checks: invalid subnets, invalid security groups, 
     invalid key pair name, invalid launch config volume snapshots, invalid amis, invalid health check elb
     It will then email the ASG owner and CloudCustodian to notify of bad setup which will prevent the 
     ASG from scaling out.  Most commonly the AMI has been deleted.
  filters:
   - invalid
  actions:
    - notify............
```

A couple community AMI examples that are being flagged as invalid:
ami-809f84e6
ami-ebd02392




Discussion:
bummer, i thought this had been resolved.

Resolving patch:
diff --git a/c7n/resources/asg.py b/c7n/resources/asg.py
--- a/c7n/resources/asg.py
+++ b/c7n/resources/asg.py
@@ -202,7 +202,7 @@ def initialize(self, asgs):
         self.elbs = self.get_elbs()
         self.appelb_target_groups = self.get_appelb_target_groups()
         self.snapshots = self.get_snapshots()
-        self.images = self.get_images()
+        self.images, self.image_snaps = self.get_images()
 
     def get_subnets(self):
         manager = self.manager.get_resource_manager('subnet')
@@ -227,21 +227,49 @@ def get_appelb_target_groups(self):
     def get_images(self):
         manager = self.manager.get_resource_manager('ami')
         images = set()
-        # Verify image snapshot validity, i've been told by a TAM this
-        # is a possibility, but haven't seen evidence of it, since
-        # snapshots are strongly ref'd by amis, but its negible cost
-        # to verify.
-        for a in manager.resources():
-            found = True
+        image_snaps = set()
+        image_ids = list({lc['ImageId'] for lc in self.configs.values()})
+
+        # Pull account images, we should be able to utilize cached values,
+        # drawn down the image population to just images not in the account.
+        account_images = [
+            i for i in manager.resources() if i['ImageId'] in image_ids]
+        account_image_ids = {i['ImageId'] for i in account_images}
+        image_ids = [image_id for image_id in image_ids
+                     if image_id not in account_image_ids]
+
+        # To pull third party images, we explicitly use a describe
+        # source without any cache.
+        #
+        # Can't use a config source since it won't have state for
+        # third party ami, we auto propagate source normally, so we
+        # explicitly pull a describe source. Can't use a cache either
+        # as their not in the account.
+        #
+        while image_ids:
+            try:
+                amis = manager.get_source('describe').get_resources(
+                    image_ids, cache=False)
+                account_images.extend(amis)
+                break
+            except ClientError as e:
+                msg = e.response['Error']['Message']
+                if e.response['Error']['Code'] != 'InvalidAMIID.NotFound':
+                    raise
+                for n in msg[msg.find('[') + 1: msg.find(']')].split(','):
+                    image_ids.remove(n.strip())
+
+        for a in account_images:
+            images.add(a['ImageId'])
+            # Capture any snapshots, images strongly reference their
+            # snapshots, and some of these will be third party in the
+            # case of a third party image.
             for bd in a.get('BlockDeviceMappings', ()):
                 if 'Ebs' not in bd or 'SnapshotId' not in bd['Ebs']:
                     continue
-                if bd['Ebs']['SnapshotId'].strip() not in self.snapshots:
-                    found = False
-                    break
-            if found:
-                images.add(a['ImageId'])
-        return images
+                image_snaps.add(bd['Ebs']['SnapshotId'].strip())
+
+        return images, image_snaps
 
     def get_snapshots(self):
         manager = self.manager.get_resource_manager('ebs-snapshot')
@@ -298,6 +326,8 @@ def get_asg_errors(self, asg):
             if 'Ebs' not in bd or 'SnapshotId' not in bd['Ebs']:
                 continue
             snapshot_id = bd['Ebs']['SnapshotId'].strip()
+            if snapshot_id in self.image_snaps:
+                continue
             if snapshot_id not in self.snapshots:
                 errors.append(('invalid-snapshot', bd['Ebs']['SnapshotId']))
         return errors


Test patch:
diff --git a/tests/data/placebo/test_asg_invalid_third_ami/autoscaling.DescribeAutoScalingGroups_1.json b/tests/data/placebo/test_asg_invalid_third_ami/autoscaling.DescribeAutoScalingGroups_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_asg_invalid_third_ami/autoscaling.DescribeAutoScalingGroups_1.json
@@ -0,0 +1,72 @@
+{
+    "status_code": 200, 
+    "data": {
+        "AutoScalingGroups": [
+            {
+                "AutoScalingGroupARN": "arn:aws:autoscaling:us-east-1:644160558196:autoScalingGroup:ecf0c638-9414-4943-8fcc-8474aa37ddcb:autoScalingGroupName/dev-cluster", 
+                "TargetGroupARNs": [], 
+                "SuspendedProcesses": [], 
+                "DesiredCapacity": 1, 
+                "Tags": [
+                    {
+                        "ResourceType": "auto-scaling-group", 
+                        "ResourceId": "dev-cluster", 
+                        "PropagateAtLaunch": true, 
+                        "Value": "dev-clustering", 
+                        "Key": "Name"
+                    }
+                ], 
+                "EnabledMetrics": [], 
+                "LoadBalancerNames": [], 
+                "AutoScalingGroupName": "dev-cluster", 
+                "DefaultCooldown": 300, 
+                "MinSize": 1, 
+                "Instances": [
+                    {
+                        "ProtectedFromScaleIn": false, 
+                        "AvailabilityZone": "us-east-1d", 
+                        "InstanceId": "i-059c99fe889f7593b", 
+                        "HealthStatus": "Healthy", 
+                        "LifecycleState": "InService", 
+                        "LaunchConfigurationName": "dev-cluster"
+                    }
+                ], 
+                "MaxSize": 1, 
+                "VPCZoneIdentifier": "subnet-3a334610,subnet-e3b194de", 
+                "HealthCheckGracePeriod": 300, 
+                "TerminationPolicies": [
+                    "Default"
+                ], 
+                "LaunchConfigurationName": "dev-cluster", 
+                "CreatedTime": {
+                    "hour": 7, 
+                    "__class__": "datetime", 
+                    "month": 10, 
+                    "second": 22, 
+                    "microsecond": 808000, 
+                    "year": 2017, 
+                    "day": 31, 
+                    "minute": 45
+                }, 
+                "AvailabilityZones": [
+                    "us-east-1d", 
+                    "us-east-1e"
+                ], 
+                "HealthCheckType": "EC2", 
+                "NewInstancesProtectedFromScaleIn": false
+            }
+        ], 
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "d84e61d6-be17-11e7-ae5c-d33169319fa6", 
+            "HTTPHeaders": {
+                "x-amzn-requestid": "d84e61d6-be17-11e7-ae5c-d33169319fa6", 
+                "vary": "Accept-Encoding", 
+                "content-length": "2272", 
+                "content-type": "text/xml", 
+                "date": "Tue, 31 Oct 2017 08:45:27 GMT"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_asg_invalid_third_ami/autoscaling.DescribeLaunchConfigurations_1.json b/tests/data/placebo/test_asg_invalid_third_ami/autoscaling.DescribeLaunchConfigurations_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_asg_invalid_third_ami/autoscaling.DescribeLaunchConfigurations_1.json
@@ -0,0 +1,222 @@
+{
+    "status_code": 200, 
+    "data": {
+        "LaunchConfigurations": [
+            {
+                "UserData": "", 
+                "EbsOptimized": false, 
+                "LaunchConfigurationARN": "arn:aws:autoscaling:us-east-1:644160558196:launchConfiguration:f5fefcf9-47da-41c9-b032-1e551c6c6fd9:launchConfigurationName/c7n-launchconfig-01", 
+                "InstanceMonitoring": {
+                    "Enabled": false
+                }, 
+                "ClassicLinkVPCSecurityGroups": [], 
+                "CreatedTime": {
+                    "hour": 18, 
+                    "__class__": "datetime", 
+                    "month": 11, 
+                    "second": 37, 
+                    "microsecond": 490000, 
+                    "year": 2016, 
+                    "day": 10, 
+                    "minute": 55
+                }, 
+                "BlockDeviceMappings": [
+                    {
+                        "DeviceName": "/dev/xvda", 
+                        "Ebs": {
+                            "DeleteOnTermination": true, 
+                            "VolumeSize": 8, 
+                            "VolumeType": "gp2"
+                        }
+                    }
+                ], 
+                "KeyName": "", 
+                "SecurityGroups": [
+                    "sg-6c7fa917"
+                ], 
+                "LaunchConfigurationName": "c7n-launchconfig-01", 
+                "KernelId": "", 
+                "RamdiskId": "", 
+                "ImageId": "ami-b73b63a0", 
+                "InstanceType": "t2.micro", 
+                "AssociatePublicIpAddress": false
+            }, 
+            {
+                "UserData": "", 
+                "EbsOptimized": false, 
+                "LaunchConfigurationARN": "arn:aws:autoscaling:us-east-1:644160558196:launchConfiguration:4b2500da-4b48-4318-817f-dfc04eee1318:launchConfigurationName/c7n-launchconfig-test-fail-01", 
+                "InstanceMonitoring": {
+                    "Enabled": false
+                }, 
+                "ClassicLinkVPCSecurityGroups": [], 
+                "CreatedTime": {
+                    "hour": 20, 
+                    "__class__": "datetime", 
+                    "month": 11, 
+                    "second": 31, 
+                    "microsecond": 736000, 
+                    "year": 2016, 
+                    "day": 14, 
+                    "minute": 9
+                }, 
+                "BlockDeviceMappings": [
+                    {
+                        "DeviceName": "/dev/xvda", 
+                        "Ebs": {
+                            "DeleteOnTermination": true, 
+                            "VolumeSize": 8, 
+                            "VolumeType": "gp2"
+                        }
+                    }
+                ], 
+                "KeyName": "", 
+                "SecurityGroups": [
+                    "sg-04eef27e"
+                ], 
+                "LaunchConfigurationName": "c7n-launchconfig-test-fail-01", 
+                "KernelId": "", 
+                "RamdiskId": "", 
+                "ImageId": "ami-b73b63a0", 
+                "InstanceType": "t2.micro", 
+                "AssociatePublicIpAddress": false
+            }, 
+            {
+                "UserData": "", 
+                "IamInstanceProfile": "CloudCustodianRole", 
+                "EbsOptimized": false, 
+                "LaunchConfigurationARN": "arn:aws:autoscaling:us-east-1:644160558196:launchConfiguration:2aeeb230-2482-4abc-8f5e-bab45fec5ef1:launchConfigurationName/dev-cluster", 
+                "InstanceMonitoring": {
+                    "Enabled": false
+                }, 
+                "ClassicLinkVPCSecurityGroups": [], 
+                "CreatedTime": {
+                    "hour": 7, 
+                    "__class__": "datetime", 
+                    "month": 10, 
+                    "second": 12, 
+                    "microsecond": 590000, 
+                    "year": 2017, 
+                    "day": 31, 
+                    "minute": 44
+                }, 
+                "BlockDeviceMappings": [
+                    {
+                        "DeviceName": "/dev/sda1", 
+                        "Ebs": {
+                            "DeleteOnTermination": true, 
+                            "SnapshotId": "snap-0cfc17b071e696816", 
+                            "VolumeSize": 8, 
+                            "VolumeType": "gp2"
+                        }
+                    }
+                ], 
+                "KeyName": "sonny", 
+                "SecurityGroups": [
+                    "sg-c63712b4"
+                ], 
+                "LaunchConfigurationName": "dev-cluster", 
+                "KernelId": "", 
+                "RamdiskId": "", 
+                "ImageId": "ami-cd0f5cb6", 
+                "InstanceType": "t2.micro"
+            }, 
+            {
+                "UserData": "", 
+                "EbsOptimized": false, 
+                "LaunchConfigurationARN": "arn:aws:autoscaling:us-east-1:644160558196:launchConfiguration:c27ada55-9bc6-4444-ab8c-c3b01d57dfd5:launchConfigurationName/foo-bar ", 
+                "InstanceMonitoring": {
+                    "Enabled": false
+                }, 
+                "ClassicLinkVPCSecurityGroups": [], 
+                "CreatedTime": {
+                    "hour": 5, 
+                    "__class__": "datetime", 
+                    "month": 2, 
+                    "second": 56, 
+                    "microsecond": 885000, 
+                    "year": 2017, 
+                    "day": 25, 
+                    "minute": 13
+                }, 
+                "BlockDeviceMappings": [
+                    {
+                        "DeviceName": "/dev/xvda", 
+                        "Ebs": {
+                            "DeleteOnTermination": true, 
+                            "VolumeSize": 8, 
+                            "VolumeType": "gp2"
+                        }
+                    }
+                ], 
+                "KeyName": "calvin-east-1", 
+                "SecurityGroups": [
+                    "sg-0b3d3377"
+                ], 
+                "LaunchConfigurationName": "foo-bar ", 
+                "KernelId": "", 
+                "RamdiskId": "", 
+                "ImageId": "ami-0b33d91d", 
+                "InstanceType": "t2.micro"
+            }, 
+            {
+                "UserData": "", 
+                "EbsOptimized": false, 
+                "LaunchConfigurationARN": "arn:aws:autoscaling:us-east-1:644160558196:launchConfiguration:7134ab7e-c1af-4711-bc2d-69351fbf2a24:launchConfigurationName/scot-test2", 
+                "InstanceMonitoring": {
+                    "Enabled": false
+                }, 
+                "ClassicLinkVPCSecurityGroups": [], 
+                "CreatedTime": {
+                    "hour": 5, 
+                    "__class__": "datetime", 
+                    "month": 2, 
+                    "second": 10, 
+                    "microsecond": 756000, 
+                    "year": 2017, 
+                    "day": 28, 
+                    "minute": 26
+                }, 
+                "BlockDeviceMappings": [
+                    {
+                        "DeviceName": "/dev/sdb", 
+                        "Ebs": {
+                            "DeleteOnTermination": false, 
+                            "SnapshotId": "snap-5d72a050 ", 
+                            "VolumeSize": 8, 
+                            "VolumeType": "gp2"
+                        }
+                    }, 
+                    {
+                        "DeviceName": "/dev/xvda", 
+                        "Ebs": {
+                            "DeleteOnTermination": true, 
+                            "VolumeSize": 8, 
+                            "VolumeType": "gp2"
+                        }
+                    }
+                ], 
+                "KeyName": "calvin-east-1", 
+                "SecurityGroups": [
+                    "sg-deafbda2"
+                ], 
+                "LaunchConfigurationName": "scot-test2", 
+                "KernelId": "", 
+                "RamdiskId": "", 
+                "ImageId": "ami-0b33d91d", 
+                "InstanceType": "t2.micro"
+            }
+        ], 
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "d861263a-be17-11e7-a049-697ce7b086e0", 
+            "HTTPHeaders": {
+                "x-amzn-requestid": "d861263a-be17-11e7-a049-697ce7b086e0", 
+                "vary": "Accept-Encoding", 
+                "content-length": "6656", 
+                "content-type": "text/xml", 
+                "date": "Tue, 31 Oct 2017 08:45:27 GMT"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_asg_invalid_third_ami/ec2.DescribeImages_1.json b/tests/data/placebo/test_asg_invalid_third_ami/ec2.DescribeImages_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_asg_invalid_third_ami/ec2.DescribeImages_1.json
@@ -0,0 +1,135 @@
+{
+    "status_code": 200, 
+    "data": {
+        "Images": [
+            {
+                "VirtualizationType": "hvm", 
+                "Description": "", 
+                "Hypervisor": "xen", 
+                "EnaSupport": true, 
+                "SriovNetSupport": "simple", 
+                "ImageId": "ami-0749e67d", 
+                "State": "available", 
+                "BlockDeviceMappings": [
+                    {
+                        "DeviceName": "/dev/sda1", 
+                        "Ebs": {
+                            "Encrypted": false, 
+                            "DeleteOnTermination": true, 
+                            "VolumeType": "gp2", 
+                            "VolumeSize": 8, 
+                            "SnapshotId": "snap-031e6c09f6598d374"
+                        }
+                    }, 
+                    {
+                        "DeviceName": "/dev/sdb", 
+                        "Ebs": {
+                            "Encrypted": false, 
+                            "DeleteOnTermination": false, 
+                            "VolumeType": "gp2", 
+                            "VolumeSize": 100, 
+                            "SnapshotId": "snap-0849969e30adfb2bf"
+                        }
+                    }
+                ], 
+                "Architecture": "x86_64", 
+                "ImageLocation": "644160558196/devabc", 
+                "RootDeviceType": "ebs", 
+                "OwnerId": "644160558196", 
+                "RootDeviceName": "/dev/sda1", 
+                "CreationDate": "2017-10-31T08:18:50.000Z", 
+                "Public": false, 
+                "ImageType": "machine", 
+                "Name": "devabc"
+            }, 
+            {
+                "VirtualizationType": "hvm", 
+                "Description": "[Copied ami-c772ddbd from us-east-1] devx", 
+                "Hypervisor": "xen", 
+                "EnaSupport": true, 
+                "SriovNetSupport": "simple", 
+                "ImageId": "ami-3848e742", 
+                "State": "available", 
+                "BlockDeviceMappings": [
+                    {
+                        "DeviceName": "/dev/sda1", 
+                        "Ebs": {
+                            "Encrypted": false, 
+                            "DeleteOnTermination": true, 
+                            "VolumeType": "gp2", 
+                            "VolumeSize": 8, 
+                            "SnapshotId": "snap-07be51844bd81659c"
+                        }
+                    }, 
+                    {
+                        "DeviceName": "/dev/sdb", 
+                        "VirtualName": "ephemeral0"
+                    }, 
+                    {
+                        "DeviceName": "/dev/sdc", 
+                        "VirtualName": "ephemeral1"
+                    }
+                ], 
+                "Architecture": "x86_64", 
+                "ImageLocation": "644160558196/devx2", 
+                "RootDeviceType": "ebs", 
+                "OwnerId": "644160558196", 
+                "RootDeviceName": "/dev/sda1", 
+                "CreationDate": "2017-10-31T08:17:04.000Z", 
+                "Public": false, 
+                "ImageType": "machine", 
+                "Name": "devx2"
+            }, 
+            {
+                "VirtualizationType": "hvm", 
+                "Description": "devx", 
+                "Hypervisor": "xen", 
+                "EnaSupport": true, 
+                "SriovNetSupport": "simple", 
+                "ImageId": "ami-c772ddbd", 
+                "State": "available", 
+                "BlockDeviceMappings": [
+                    {
+                        "DeviceName": "/dev/sda1", 
+                        "Ebs": {
+                            "Encrypted": false, 
+                            "DeleteOnTermination": true, 
+                            "VolumeType": "gp2", 
+                            "VolumeSize": 8, 
+                            "SnapshotId": "snap-03215737c84137756"
+                        }
+                    }, 
+                    {
+                        "DeviceName": "/dev/sdb", 
+                        "VirtualName": "ephemeral0"
+                    }, 
+                    {
+                        "DeviceName": "/dev/sdc", 
+                        "VirtualName": "ephemeral1"
+                    }
+                ], 
+                "Architecture": "x86_64", 
+                "ImageLocation": "644160558196/devx", 
+                "RootDeviceType": "ebs", 
+                "OwnerId": "644160558196", 
+                "RootDeviceName": "/dev/sda1", 
+                "CreationDate": "2017-10-31T08:13:54.000Z", 
+                "Public": false, 
+                "ImageType": "machine", 
+                "Name": "devx"
+            }
+        ], 
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "8341d08c-bf57-4c3b-99df-1d90a2c9d724", 
+            "HTTPHeaders": {
+                "transfer-encoding": "chunked", 
+                "vary": "Accept-Encoding", 
+                "server": "AmazonEC2", 
+                "content-type": "text/xml;charset=UTF-8", 
+                "date": "Tue, 31 Oct 2017 08:45:30 GMT"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_asg_invalid_third_ami/ec2.DescribeImages_2.json b/tests/data/placebo/test_asg_invalid_third_ami/ec2.DescribeImages_2.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_asg_invalid_third_ami/ec2.DescribeImages_2.json
@@ -0,0 +1,119 @@
+{
+    "status_code": 200, 
+    "data": {
+        "Images": [
+            {
+                "VirtualizationType": "hvm", 
+                "Description": "Amazon Linux AMI 2016.09.1.20170119 x86_64 HVM GP2", 
+                "Hypervisor": "xen", 
+                "ImageOwnerAlias": "amazon", 
+                "EnaSupport": true, 
+                "SriovNetSupport": "simple", 
+                "ImageId": "ami-0b33d91d", 
+                "State": "available", 
+                "BlockDeviceMappings": [
+                    {
+                        "DeviceName": "/dev/xvda", 
+                        "Ebs": {
+                            "Encrypted": false, 
+                            "DeleteOnTermination": true, 
+                            "VolumeType": "gp2", 
+                            "VolumeSize": 8, 
+                            "SnapshotId": "snap-037f1f9e6c8ea4d65"
+                        }
+                    }
+                ], 
+                "Architecture": "x86_64", 
+                "ImageLocation": "amazon/amzn-ami-hvm-2016.09.1.20170119-x86_64-gp2", 
+                "RootDeviceType": "ebs", 
+                "OwnerId": "137112412989", 
+                "RootDeviceName": "/dev/xvda", 
+                "CreationDate": "2017-01-20T23:39:56.000Z", 
+                "Public": true, 
+                "ImageType": "machine", 
+                "Name": "amzn-ami-hvm-2016.09.1.20170119-x86_64-gp2"
+            }, 
+            {
+                "VirtualizationType": "hvm", 
+                "Description": "Amazon Linux AMI 2016.09.0.20161028 x86_64 HVM GP2", 
+                "Hypervisor": "xen", 
+                "ImageOwnerAlias": "amazon", 
+                "EnaSupport": true, 
+                "SriovNetSupport": "simple", 
+                "ImageId": "ami-b73b63a0", 
+                "State": "available", 
+                "BlockDeviceMappings": [
+                    {
+                        "DeviceName": "/dev/xvda", 
+                        "Ebs": {
+                            "Encrypted": false, 
+                            "DeleteOnTermination": true, 
+                            "VolumeType": "gp2", 
+                            "VolumeSize": 8, 
+                            "SnapshotId": "snap-fe8a3c04"
+                        }
+                    }
+                ], 
+                "Architecture": "x86_64", 
+                "ImageLocation": "amazon/amzn-ami-hvm-2016.09.0.20161028-x86_64-gp2", 
+                "RootDeviceType": "ebs", 
+                "OwnerId": "137112412989", 
+                "RootDeviceName": "/dev/xvda", 
+                "CreationDate": "2016-10-29T00:49:47.000Z", 
+                "Public": true, 
+                "ImageType": "machine", 
+                "Name": "amzn-ami-hvm-2016.09.0.20161028-x86_64-gp2"
+            }, 
+            {
+                "VirtualizationType": "hvm", 
+                "Description": "Canonical, Ubuntu, 16.04 LTS, amd64 xenial image build on 2017-07-21", 
+                "Hypervisor": "xen", 
+                "EnaSupport": true, 
+                "SriovNetSupport": "simple", 
+                "ImageId": "ami-cd0f5cb6", 
+                "State": "available", 
+                "BlockDeviceMappings": [
+                    {
+                        "DeviceName": "/dev/sda1", 
+                        "Ebs": {
+                            "Encrypted": false, 
+                            "DeleteOnTermination": true, 
+                            "VolumeType": "gp2", 
+                            "VolumeSize": 8, 
+                            "SnapshotId": "snap-0cfc17b071e696816"
+                        }
+                    }, 
+                    {
+                        "DeviceName": "/dev/sdb", 
+                        "VirtualName": "ephemeral0"
+                    }, 
+                    {
+                        "DeviceName": "/dev/sdc", 
+                        "VirtualName": "ephemeral1"
+                    }
+                ], 
+                "Architecture": "x86_64", 
+                "ImageLocation": "099720109477/ubuntu/images/hvm-ssd/ubuntu-xenial-16.04-amd64-server-20170721", 
+                "RootDeviceType": "ebs", 
+                "OwnerId": "099720109477", 
+                "RootDeviceName": "/dev/sda1", 
+                "CreationDate": "2017-07-24T20:26:59.000Z", 
+                "Public": true, 
+                "ImageType": "machine", 
+                "Name": "ubuntu/images/hvm-ssd/ubuntu-xenial-16.04-amd64-server-20170721"
+            }
+        ], 
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "58a0b952-6aac-49bf-81a3-67387b00fbf7", 
+            "HTTPHeaders": {
+                "transfer-encoding": "chunked", 
+                "vary": "Accept-Encoding", 
+                "server": "AmazonEC2", 
+                "content-type": "text/xml;charset=UTF-8", 
+                "date": "Tue, 31 Oct 2017 08:45:31 GMT"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_asg_invalid_third_ami/ec2.DescribeKeyPairs_1.json b/tests/data/placebo/test_asg_invalid_third_ami/ec2.DescribeKeyPairs_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_asg_invalid_third_ami/ec2.DescribeKeyPairs_1.json
@@ -0,0 +1,27 @@
+{
+    "status_code": 200, 
+    "data": {
+        "KeyPairs": [
+            {
+                "KeyName": "sonny", 
+                "KeyFingerprint": "7c:08:f5:95:13:82:86:dd:51:49:77:28:95:9d:09:b8:7a:0d:95:63"
+            }, 
+            {
+                "KeyName": "test", 
+                "KeyFingerprint": "ee:95:bf:69:ce:24:ac:f1:88:1a:23:40:62:90:13:f2:4e:c2:d4:f3"
+            }
+        ], 
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "cbcff485-08b1-483a-9f21-76665430e266", 
+            "HTTPHeaders": {
+                "transfer-encoding": "chunked", 
+                "vary": "Accept-Encoding", 
+                "server": "AmazonEC2", 
+                "content-type": "text/xml;charset=UTF-8", 
+                "date": "Tue, 31 Oct 2017 08:45:28 GMT"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_asg_invalid_third_ami/ec2.DescribeSecurityGroups_1.json b/tests/data/placebo/test_asg_invalid_third_ami/ec2.DescribeSecurityGroups_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_asg_invalid_third_ami/ec2.DescribeSecurityGroups_1.json
@@ -0,0 +1,388 @@
+{
+    "status_code": 200, 
+    "data": {
+        "SecurityGroups": [
+            {
+                "IpPermissionsEgress": [
+                    {
+                        "IpProtocol": "-1", 
+                        "PrefixListIds": [], 
+                        "IpRanges": [
+                            {
+                                "CidrIp": "0.0.0.0/0"
+                            }
+                        ], 
+                        "UserIdGroupPairs": [], 
+                        "Ipv6Ranges": []
+                    }
+                ], 
+                "Description": "Created from the RDS Management Console", 
+                "IpPermissions": [
+                    {
+                        "PrefixListIds": [], 
+                        "FromPort": 3306, 
+                        "IpRanges": [
+                            {
+                                "CidrIp": "204.63.44.142/32"
+                            }
+                        ], 
+                        "ToPort": 3306, 
+                        "IpProtocol": "tcp", 
+                        "UserIdGroupPairs": [], 
+                        "Ipv6Ranges": []
+                    }
+                ], 
+                "GroupName": "rds-launch-wizard", 
+                "VpcId": "vpc-d2d616b5", 
+                "OwnerId": "644160558196", 
+                "GroupId": "sg-29ee3e5a"
+            }, 
+            {
+                "IpPermissionsEgress": [
+                    {
+                        "IpProtocol": "-1", 
+                        "PrefixListIds": [], 
+                        "IpRanges": [
+                            {
+                                "CidrIp": "0.0.0.0/0"
+                            }
+                        ], 
+                        "UserIdGroupPairs": [], 
+                        "Ipv6Ranges": []
+                    }
+                ], 
+                "Description": "launch-wizard-2 created 2017-10-26T15:16:21.145-04:00", 
+                "IpPermissions": [
+                    {
+                        "PrefixListIds": [], 
+                        "FromPort": 22, 
+                        "IpRanges": [
+                            {
+                                "CidrIp": "0.0.0.0/0"
+                            }
+                        ], 
+                        "ToPort": 22, 
+                        "IpProtocol": "tcp", 
+                        "UserIdGroupPairs": [], 
+                        "Ipv6Ranges": []
+                    }
+                ], 
+                "GroupName": "launch-wizard-2", 
+                "VpcId": "vpc-d2d616b5", 
+                "OwnerId": "644160558196", 
+                "GroupId": "sg-30f4b842"
+            }, 
+            {
+                "IpPermissionsEgress": [
+                    {
+                        "IpProtocol": "-1", 
+                        "PrefixListIds": [], 
+                        "IpRanges": [
+                            {
+                                "CidrIp": "0.0.0.0/0"
+                            }
+                        ], 
+                        "UserIdGroupPairs": [], 
+                        "Ipv6Ranges": []
+                    }
+                ], 
+                "Description": "launch-wizard-1 created 2017-09-14T22:02:43.877-04:00", 
+                "IpPermissions": [
+                    {
+                        "PrefixListIds": [], 
+                        "FromPort": 22, 
+                        "IpRanges": [
+                            {
+                                "CidrIp": "0.0.0.0/0"
+                            }
+                        ], 
+                        "ToPort": 22, 
+                        "IpProtocol": "tcp", 
+                        "UserIdGroupPairs": [], 
+                        "Ipv6Ranges": []
+                    }
+                ], 
+                "GroupName": "launch-wizard-1", 
+                "VpcId": "vpc-d2d616b5", 
+                "OwnerId": "644160558196", 
+                "GroupId": "sg-3839ec4b"
+            }, 
+            {
+                "IpPermissionsEgress": [
+                    {
+                        "IpProtocol": "-1", 
+                        "PrefixListIds": [], 
+                        "IpRanges": [
+                            {
+                                "CidrIp": "10.0.0.0/10"
+                            }
+                        ], 
+                        "UserIdGroupPairs": [], 
+                        "Ipv6Ranges": []
+                    }
+                ], 
+                "Description": "Created from the RDS Management Console", 
+                "IpPermissions": [
+                    {
+                        "PrefixListIds": [], 
+                        "FromPort": 5432, 
+                        "IpRanges": [
+                            {
+                                "CidrIp": "209.43.102.90/32"
+                            }
+                        ], 
+                        "ToPort": 5432, 
+                        "IpProtocol": "tcp", 
+                        "UserIdGroupPairs": [], 
+                        "Ipv6Ranges": []
+                    }
+                ], 
+                "GroupName": "rds-launch-wizard-7", 
+                "VpcId": "vpc-d2d616b5", 
+                "OwnerId": "644160558196", 
+                "GroupId": "sg-3e9ef441"
+            }, 
+            {
+                "IpPermissionsEgress": [
+                    {
+                        "IpProtocol": "-1", 
+                        "PrefixListIds": [], 
+                        "IpRanges": [
+                            {
+                                "CidrIp": "0.0.0.0/0"
+                            }
+                        ], 
+                        "UserIdGroupPairs": [], 
+                        "Ipv6Ranges": []
+                    }
+                ], 
+                "Description": "default VPC security group", 
+                "IpPermissions": [
+                    {
+                        "IpProtocol": "-1", 
+                        "PrefixListIds": [], 
+                        "IpRanges": [], 
+                        "UserIdGroupPairs": [
+                            {
+                                "UserId": "644160558196", 
+                                "GroupId": "sg-4b9ada34"
+                            }
+                        ], 
+                        "Ipv6Ranges": []
+                    }
+                ], 
+                "GroupName": "default", 
+                "VpcId": "vpc-f1516b97", 
+                "OwnerId": "644160558196", 
+                "GroupId": "sg-4b9ada34"
+            }, 
+            {
+                "IpPermissionsEgress": [
+                    {
+                        "IpProtocol": "-1", 
+                        "PrefixListIds": [], 
+                        "IpRanges": [
+                            {
+                                "CidrIp": "0.0.0.0/0"
+                            }
+                        ], 
+                        "UserIdGroupPairs": [], 
+                        "Ipv6Ranges": []
+                    }
+                ], 
+                "Description": "default VPC security group", 
+                "Tags": [
+                    {
+                        "Value": "", 
+                        "Key": "Name"
+                    }, 
+                    {
+                        "Value": "c7n-test-val", 
+                        "Key": "c7n-test-tag"
+                    }
+                ], 
+                "IpPermissions": [
+                    {
+                        "IpProtocol": "-1", 
+                        "PrefixListIds": [], 
+                        "IpRanges": [
+                            {
+                                "CidrIp": "108.56.181.242/32"
+                            }
+                        ], 
+                        "UserIdGroupPairs": [
+                            {
+                                "UserId": "644160558196", 
+                                "GroupId": "sg-6c7fa917"
+                            }
+                        ], 
+                        "Ipv6Ranges": []
+                    }
+                ], 
+                "GroupName": "default", 
+                "VpcId": "vpc-d2d616b5", 
+                "OwnerId": "644160558196", 
+                "GroupId": "sg-6c7fa917"
+            }, 
+            {
+                "IpPermissionsEgress": [
+                    {
+                        "IpProtocol": "-1", 
+                        "PrefixListIds": [], 
+                        "IpRanges": [
+                            {
+                                "CidrIp": "0.0.0.0/0"
+                            }
+                        ], 
+                        "UserIdGroupPairs": [], 
+                        "Ipv6Ranges": []
+                    }
+                ], 
+                "Description": "Created from the RDS Management Console", 
+                "IpPermissions": [
+                    {
+                        "PrefixListIds": [], 
+                        "FromPort": 5432, 
+                        "IpRanges": [
+                            {
+                                "CidrIp": "108.45.72.12/32"
+                            }
+                        ], 
+                        "ToPort": 5432, 
+                        "IpProtocol": "tcp", 
+                        "UserIdGroupPairs": [], 
+                        "Ipv6Ranges": []
+                    }
+                ], 
+                "GroupName": "rds-launch-wizard-1", 
+                "VpcId": "vpc-d2d616b5", 
+                "OwnerId": "644160558196", 
+                "GroupId": "sg-837620f1"
+            }, 
+            {
+                "IpPermissionsEgress": [
+                    {
+                        "IpProtocol": "-1", 
+                        "PrefixListIds": [], 
+                        "IpRanges": [
+                            {
+                                "CidrIp": "0.0.0.0/0"
+                            }
+                        ], 
+                        "UserIdGroupPairs": [], 
+                        "Ipv6Ranges": []
+                    }
+                ], 
+                "Description": "Created from the RDS Management Console", 
+                "IpPermissions": [
+                    {
+                        "PrefixListIds": [], 
+                        "FromPort": 5432, 
+                        "IpRanges": [
+                            {
+                                "CidrIp": "209.43.102.90/32"
+                            }
+                        ], 
+                        "ToPort": 5432, 
+                        "IpProtocol": "tcp", 
+                        "UserIdGroupPairs": [], 
+                        "Ipv6Ranges": []
+                    }
+                ], 
+                "GroupName": "rds-launch-wizard-6", 
+                "VpcId": "vpc-d2d616b5", 
+                "OwnerId": "644160558196", 
+                "GroupId": "sg-8c84eef3"
+            }, 
+            {
+                "IpPermissionsEgress": [
+                    {
+                        "IpProtocol": "-1", 
+                        "PrefixListIds": [], 
+                        "IpRanges": [
+                            {
+                                "CidrIp": "0.0.0.0/0"
+                            }
+                        ], 
+                        "UserIdGroupPairs": [], 
+                        "Ipv6Ranges": []
+                    }
+                ], 
+                "Description": "internal", 
+                "Tags": [
+                    {
+                        "Value": "internal", 
+                        "Key": "Name"
+                    }
+                ], 
+                "IpPermissions": [
+                    {
+                        "PrefixListIds": [], 
+                        "FromPort": 0, 
+                        "IpRanges": [], 
+                        "ToPort": 65535, 
+                        "IpProtocol": "tcp", 
+                        "UserIdGroupPairs": [
+                            {
+                                "UserId": "644160558196", 
+                                "GroupId": "sg-9a5386e9"
+                            }
+                        ], 
+                        "Ipv6Ranges": []
+                    }
+                ], 
+                "GroupName": "internal", 
+                "VpcId": "vpc-d2d616b5", 
+                "OwnerId": "644160558196", 
+                "GroupId": "sg-9a5386e9"
+            }, 
+            {
+                "IpPermissionsEgress": [
+                    {
+                        "IpProtocol": "-1", 
+                        "PrefixListIds": [], 
+                        "IpRanges": [
+                            {
+                                "CidrIp": "0.0.0.0/0"
+                            }
+                        ], 
+                        "UserIdGroupPairs": [], 
+                        "Ipv6Ranges": []
+                    }
+                ], 
+                "Description": "AutoScaling-Security-Group-1 (2017-10-31 03:43:54.856-04:00)", 
+                "IpPermissions": [
+                    {
+                        "PrefixListIds": [], 
+                        "FromPort": 22, 
+                        "IpRanges": [
+                            {
+                                "CidrIp": "0.0.0.0/0"
+                            }
+                        ], 
+                        "ToPort": 22, 
+                        "IpProtocol": "tcp", 
+                        "UserIdGroupPairs": [], 
+                        "Ipv6Ranges": []
+                    }
+                ], 
+                "GroupName": "AutoScaling-Security-Group-1", 
+                "VpcId": "vpc-d2d616b5", 
+                "OwnerId": "644160558196", 
+                "GroupId": "sg-c63712b4"
+            }
+        ], 
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "b8f49835-2016-45dc-8154-41af19e59638", 
+            "HTTPHeaders": {
+                "transfer-encoding": "chunked", 
+                "vary": "Accept-Encoding", 
+                "server": "AmazonEC2", 
+                "content-type": "text/xml;charset=UTF-8", 
+                "date": "Tue, 31 Oct 2017 08:45:28 GMT"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_asg_invalid_third_ami/ec2.DescribeSnapshots_1.json b/tests/data/placebo/test_asg_invalid_third_ami/ec2.DescribeSnapshots_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_asg_invalid_third_ami/ec2.DescribeSnapshots_1.json
@@ -0,0 +1,131 @@
+{
+    "status_code": 200, 
+    "data": {
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "04eb9a7a-2268-43d3-8bfb-adc23e5fca5b", 
+            "HTTPHeaders": {
+                "transfer-encoding": "chunked", 
+                "vary": "Accept-Encoding", 
+                "server": "AmazonEC2", 
+                "content-type": "text/xml;charset=UTF-8", 
+                "date": "Tue, 31 Oct 2017 08:45:29 GMT"
+            }
+        }, 
+        "Snapshots": [
+            {
+                "Description": "Created by CreateImage(i-03e133224641146ae) for ami-0749e67d from vol-055ec795ddbff496a", 
+                "Encrypted": false, 
+                "VolumeId": "vol-055ec795ddbff496a", 
+                "State": "completed", 
+                "VolumeSize": 8, 
+                "StartTime": {
+                    "hour": 8, 
+                    "__class__": "datetime", 
+                    "month": 10, 
+                    "second": 2, 
+                    "microsecond": 0, 
+                    "year": 2017, 
+                    "day": 31, 
+                    "minute": 19
+                }, 
+                "Progress": "100%", 
+                "OwnerId": "644160558196", 
+                "SnapshotId": "snap-031e6c09f6598d374"
+            }, 
+            {
+                "Description": "Created by CreateImage(i-059c99fe889f7593b) for ami-c772ddbd from vol-085e11f8bf260e467", 
+                "Encrypted": false, 
+                "VolumeId": "vol-085e11f8bf260e467", 
+                "State": "completed", 
+                "VolumeSize": 8, 
+                "StartTime": {
+                    "hour": 8, 
+                    "__class__": "datetime", 
+                    "month": 10, 
+                    "second": 6, 
+                    "microsecond": 0, 
+                    "year": 2017, 
+                    "day": 31, 
+                    "minute": 14
+                }, 
+                "Progress": "100%", 
+                "OwnerId": "644160558196", 
+                "SnapshotId": "snap-03215737c84137756"
+            }, 
+            {
+                "Description": "Copied for DestinationAmi ami-3848e742 from SourceAmi ami-c772ddbd for SourceSnapshot snap-03215737c84137756. Task created on 1,509,437,824,580.", 
+                "Encrypted": false, 
+                "VolumeId": "vol-ffffffff", 
+                "State": "completed", 
+                "VolumeSize": 8, 
+                "StartTime": {
+                    "hour": 8, 
+                    "__class__": "datetime", 
+                    "month": 10, 
+                    "second": 6, 
+                    "microsecond": 0, 
+                    "year": 2017, 
+                    "day": 31, 
+                    "minute": 17
+                }, 
+                "Progress": "100%", 
+                "OwnerId": "644160558196", 
+                "SnapshotId": "snap-07be51844bd81659c"
+            }, 
+            {
+                "Description": "", 
+                "Tags": [
+                    {
+                        "Value": "dev-2", 
+                        "Key": "Name"
+                    }
+                ], 
+                "Encrypted": false, 
+                "VolumeId": "vol-09ae1ffb76a5334b5", 
+                "State": "completed", 
+                "VolumeSize": 100, 
+                "StartTime": {
+                    "hour": 8, 
+                    "__class__": "datetime", 
+                    "month": 10, 
+                    "second": 55, 
+                    "microsecond": 0, 
+                    "year": 2017, 
+                    "day": 31, 
+                    "minute": 1
+                }, 
+                "Progress": "100%", 
+                "OwnerId": "644160558196", 
+                "SnapshotId": "snap-0849969e30adfb2bf"
+            }, 
+            {
+                "Description": "", 
+                "Tags": [
+                    {
+                        "Value": "c7n-dev", 
+                        "Key": "Name"
+                    }
+                ], 
+                "Encrypted": false, 
+                "VolumeId": "vol-085e11f8bf260e467", 
+                "State": "completed", 
+                "VolumeSize": 8, 
+                "StartTime": {
+                    "hour": 8, 
+                    "__class__": "datetime", 
+                    "month": 10, 
+                    "second": 10, 
+                    "microsecond": 0, 
+                    "year": 2017, 
+                    "day": 31, 
+                    "minute": 0
+                }, 
+                "Progress": "100%", 
+                "OwnerId": "644160558196", 
+                "SnapshotId": "snap-0ee44da6abc3a536f"
+            }
+        ]
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_asg_invalid_third_ami/ec2.DescribeSubnets_1.json b/tests/data/placebo/test_asg_invalid_third_ami/ec2.DescribeSubnets_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_asg_invalid_third_ami/ec2.DescribeSubnets_1.json
@@ -0,0 +1,151 @@
+{
+    "status_code": 200, 
+    "data": {
+        "Subnets": [
+            {
+                "AvailabilityZone": "us-east-1d", 
+                "Tags": [
+                    {
+                        "Value": "FancyTestSubnetD", 
+                        "Key": "Name"
+                    }
+                ], 
+                "AvailableIpAddressCount": 27, 
+                "DefaultForAz": false, 
+                "Ipv6CidrBlockAssociationSet": [], 
+                "VpcId": "vpc-f1516b97", 
+                "State": "available", 
+                "MapPublicIpOnLaunch": false, 
+                "SubnetId": "subnet-71bda45c", 
+                "CidrBlock": "10.0.42.96/27", 
+                "AssignIpv6AddressOnCreation": false
+            }, 
+            {
+                "AvailabilityZone": "us-east-1b", 
+                "Tags": [
+                    {
+                        "Value": "FancyTestSubnetPrivate", 
+                        "Key": "Name"
+                    }, 
+                    {
+                        "Value": "Private", 
+                        "Key": "NetworkLocation"
+                    }
+                ], 
+                "AvailableIpAddressCount": 27, 
+                "DefaultForAz": false, 
+                "Ipv6CidrBlockAssociationSet": [], 
+                "VpcId": "vpc-f1516b97", 
+                "State": "available", 
+                "MapPublicIpOnLaunch": false, 
+                "SubnetId": "subnet-6f273034", 
+                "CidrBlock": "10.0.42.32/27", 
+                "AssignIpv6AddressOnCreation": false
+            }, 
+            {
+                "AvailabilityZone": "us-east-1d", 
+                "AvailableIpAddressCount": 4088, 
+                "DefaultForAz": true, 
+                "Ipv6CidrBlockAssociationSet": [], 
+                "VpcId": "vpc-d2d616b5", 
+                "State": "available", 
+                "MapPublicIpOnLaunch": true, 
+                "SubnetId": "subnet-3a334610", 
+                "CidrBlock": "172.31.48.0/20", 
+                "AssignIpv6AddressOnCreation": false
+            }, 
+            {
+                "AvailabilityZone": "us-east-1b", 
+                "AvailableIpAddressCount": 4091, 
+                "DefaultForAz": true, 
+                "Ipv6CidrBlockAssociationSet": [], 
+                "VpcId": "vpc-d2d616b5", 
+                "State": "available", 
+                "MapPublicIpOnLaunch": true, 
+                "SubnetId": "subnet-efbcccb7", 
+                "CidrBlock": "172.31.16.0/20", 
+                "AssignIpv6AddressOnCreation": false
+            }, 
+            {
+                "AvailabilityZone": "us-east-1c", 
+                "Tags": [
+                    {
+                        "Value": "tagfanncyvalue", 
+                        "Key": "tagfancykey"
+                    }, 
+                    {
+                        "Value": "FancyTestSubnetC", 
+                        "Key": "Name"
+                    }
+                ], 
+                "AvailableIpAddressCount": 27, 
+                "DefaultForAz": false, 
+                "Ipv6CidrBlockAssociationSet": [], 
+                "VpcId": "vpc-f1516b97", 
+                "State": "available", 
+                "MapPublicIpOnLaunch": false, 
+                "SubnetId": "subnet-05cf9b60", 
+                "CidrBlock": "10.0.42.64/27", 
+                "AssignIpv6AddressOnCreation": false
+            }, 
+            {
+                "AvailabilityZone": "us-east-1a", 
+                "Tags": [
+                    {
+                        "Value": "Public", 
+                        "Key": "NetworkLocation"
+                    }, 
+                    {
+                        "Value": "FancyTestSubnetPublic", 
+                        "Key": "Name"
+                    }
+                ], 
+                "AvailableIpAddressCount": 27, 
+                "DefaultForAz": false, 
+                "Ipv6CidrBlockAssociationSet": [], 
+                "VpcId": "vpc-f1516b97", 
+                "State": "available", 
+                "MapPublicIpOnLaunch": false, 
+                "SubnetId": "subnet-ecfb30a4", 
+                "CidrBlock": "10.0.42.0/27", 
+                "AssignIpv6AddressOnCreation": false
+            }, 
+            {
+                "AvailabilityZone": "us-east-1e", 
+                "AvailableIpAddressCount": 4090, 
+                "DefaultForAz": true, 
+                "Ipv6CidrBlockAssociationSet": [], 
+                "VpcId": "vpc-d2d616b5", 
+                "State": "available", 
+                "MapPublicIpOnLaunch": true, 
+                "SubnetId": "subnet-e3b194de", 
+                "CidrBlock": "172.31.32.0/20", 
+                "AssignIpv6AddressOnCreation": false
+            }, 
+            {
+                "AvailabilityZone": "us-east-1a", 
+                "AvailableIpAddressCount": 4091, 
+                "DefaultForAz": true, 
+                "Ipv6CidrBlockAssociationSet": [], 
+                "VpcId": "vpc-d2d616b5", 
+                "State": "available", 
+                "MapPublicIpOnLaunch": true, 
+                "SubnetId": "subnet-914763e7", 
+                "CidrBlock": "172.31.0.0/20", 
+                "AssignIpv6AddressOnCreation": false
+            }
+        ], 
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "9b167585-a99e-4fcb-b680-eebcad5e3763", 
+            "HTTPHeaders": {
+                "transfer-encoding": "chunked", 
+                "vary": "Accept-Encoding", 
+                "server": "AmazonEC2", 
+                "content-type": "text/xml;charset=UTF-8", 
+                "date": "Tue, 31 Oct 2017 08:45:28 GMT"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_asg_invalid_third_ami/elasticloadbalancing.DescribeLoadBalancers_1.json b/tests/data/placebo/test_asg_invalid_third_ami/elasticloadbalancing.DescribeLoadBalancers_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_asg_invalid_third_ami/elasticloadbalancing.DescribeLoadBalancers_1.json
@@ -0,0 +1,17 @@
+{
+    "status_code": 200, 
+    "data": {
+        "LoadBalancerDescriptions": [], 
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "d94e6c6a-be17-11e7-810a-8bad8245d7bf", 
+            "HTTPHeaders": {
+                "x-amzn-requestid": "d94e6c6a-be17-11e7-810a-8bad8245d7bf", 
+                "date": "Tue, 31 Oct 2017 08:45:29 GMT", 
+                "content-length": "335", 
+                "content-type": "text/xml"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_asg_invalid_third_ami/elasticloadbalancing.DescribeTags_1.json b/tests/data/placebo/test_asg_invalid_third_ami/elasticloadbalancing.DescribeTags_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_asg_invalid_third_ami/elasticloadbalancing.DescribeTags_1.json
@@ -0,0 +1,26 @@
+{
+    "status_code": 200, 
+    "data": {
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "d98b27ad-be17-11e7-a343-7d848f086ed9", 
+            "HTTPHeaders": {
+                "x-amzn-requestid": "d98b27ad-be17-11e7-a343-7d848f086ed9", 
+                "date": "Tue, 31 Oct 2017 08:45:29 GMT", 
+                "content-length": "662", 
+                "content-type": "text/xml"
+            }
+        }, 
+        "TagDescriptions": [
+            {
+                "ResourceArn": "arn:aws:elasticloadbalancing:us-east-1:644160558196:targetgroup/test1target/05aed671d733ae95", 
+                "Tags": []
+            }, 
+            {
+                "ResourceArn": "arn:aws:elasticloadbalancing:us-east-1:644160558196:targetgroup/test2target/d25fe039e7171dcb", 
+                "Tags": []
+            }
+        ]
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_asg_invalid_third_ami/elasticloadbalancing.DescribeTargetGroups_1.json b/tests/data/placebo/test_asg_invalid_third_ami/elasticloadbalancing.DescribeTargetGroups_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_asg_invalid_third_ami/elasticloadbalancing.DescribeTargetGroups_1.json
@@ -0,0 +1,59 @@
+{
+    "status_code": 200, 
+    "data": {
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "d9683634-be17-11e7-ad79-774d9b254ac0", 
+            "HTTPHeaders": {
+                "x-amzn-requestid": "d9683634-be17-11e7-ad79-774d9b254ac0", 
+                "vary": "Accept-Encoding", 
+                "content-length": "2216", 
+                "content-type": "text/xml", 
+                "date": "Tue, 31 Oct 2017 08:45:29 GMT"
+            }
+        }, 
+        "TargetGroups": [
+            {
+                "HealthCheckPath": "/", 
+                "HealthCheckIntervalSeconds": 30, 
+                "VpcId": "vpc-d2d616b5", 
+                "Protocol": "HTTP", 
+                "HealthCheckTimeoutSeconds": 5, 
+                "TargetType": "instance", 
+                "HealthCheckProtocol": "HTTP", 
+                "LoadBalancerArns": [
+                    "arn:aws:elasticloadbalancing:us-east-1:644160558196:loadbalancer/app/testing/1e0e18b15fe2aefa"
+                ], 
+                "UnhealthyThresholdCount": 2, 
+                "HealthyThresholdCount": 5, 
+                "TargetGroupArn": "arn:aws:elasticloadbalancing:us-east-1:644160558196:targetgroup/test1target/05aed671d733ae95", 
+                "Matcher": {
+                    "HttpCode": "200"
+                }, 
+                "HealthCheckPort": "traffic-port", 
+                "Port": 80, 
+                "TargetGroupName": "test1target"
+            }, 
+            {
+                "HealthCheckPath": "/", 
+                "HealthCheckIntervalSeconds": 30, 
+                "VpcId": "vpc-d2d616b5", 
+                "Protocol": "HTTP", 
+                "HealthCheckTimeoutSeconds": 5, 
+                "TargetType": "instance", 
+                "HealthCheckProtocol": "HTTP", 
+                "LoadBalancerArns": [], 
+                "UnhealthyThresholdCount": 2, 
+                "HealthyThresholdCount": 5, 
+                "TargetGroupArn": "arn:aws:elasticloadbalancing:us-east-1:644160558196:targetgroup/test2target/d25fe039e7171dcb", 
+                "Matcher": {
+                    "HttpCode": "200"
+                }, 
+                "HealthCheckPort": "traffic-port", 
+                "Port": 8080, 
+                "TargetGroupName": "test2target"
+            }
+        ]
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_asg_invalid_third_ami/elasticloadbalancing.DescribeTargetHealth_1.json b/tests/data/placebo/test_asg_invalid_third_ami/elasticloadbalancing.DescribeTargetHealth_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_asg_invalid_third_ami/elasticloadbalancing.DescribeTargetHealth_1.json
@@ -0,0 +1,17 @@
+{
+    "status_code": 200, 
+    "data": {
+        "TargetHealthDescriptions": [], 
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "d97c334e-be17-11e7-a900-9bfd5a9d7e8a", 
+            "HTTPHeaders": {
+                "x-amzn-requestid": "d97c334e-be17-11e7-a900-9bfd5a9d7e8a", 
+                "date": "Tue, 31 Oct 2017 08:45:29 GMT", 
+                "content-length": "331", 
+                "content-type": "text/xml"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_asg_invalid_third_ami/elasticloadbalancing.DescribeTargetHealth_2.json b/tests/data/placebo/test_asg_invalid_third_ami/elasticloadbalancing.DescribeTargetHealth_2.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_asg_invalid_third_ami/elasticloadbalancing.DescribeTargetHealth_2.json
@@ -0,0 +1,17 @@
+{
+    "status_code": 200, 
+    "data": {
+        "TargetHealthDescriptions": [], 
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "d97c0c18-be17-11e7-95df-6d927c0562e4", 
+            "HTTPHeaders": {
+                "x-amzn-requestid": "d97c0c18-be17-11e7-95df-6d927c0562e4", 
+                "date": "Tue, 31 Oct 2017 08:45:29 GMT", 
+                "content-length": "331", 
+                "content-type": "text/xml"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/tests/test_asg.py b/tests/test_asg.py
--- a/tests/test_asg.py
+++ b/tests/test_asg.py
@@ -308,6 +308,15 @@ def test_asg_resume(self):
                 'AutoScalingGroups'].pop()
         self.assertFalse(result['SuspendedProcesses'])
 
+    def test_asg_third_ami_filter(self):
+        factory = self.replay_flight_data('test_asg_invalid_third_ami')
+        p = self.load_policy({
+            'name': 'asg-invalid-filter-3ami',
+            'resource': 'asg',
+            'filters': ['invalid']}, session_factory=factory)
+        resources = p.run()
+        self.assertEqual(len(resources), 0)
+
     def test_asg_invalid_filter_good(self):
         factory = self.replay_flight_data('test_asg_invalid_filter_good')
         p = self.load_policy({