Repository: cloud-custodian/cloud-custodian

Issue:
c7n report for resource 'log-group' missing tags in 0.9.8
policy:
```
policies:
  - name: report-resources
    resource: log-group
    comment: |
      Reports on log-group for account
    filters:
    - not:
      - "tag:custodian:skip": "True"
```
reports with c7n==0.9.2
```
  {
    "logGroupName": "some_name",
    "creationTime": 1585573052081,
    "retentionInDays": 90,
    "metricFilterCount": 0,
    "arn": "some_arn",
    "storedBytes": 0,
    "Tags": []  # here comes list of tags for the log-group
  },
```
from c7n==0.9.8 json element, holding list of tags for the log group is missing for each element in report file




Discussion:
thanks for reporting it looks like tag augmentation for log groups was removed in #6126  @tjstansell I assume that was inadvertent? We should restore it and add a functional test for it so its part of the nightly functional test run.

Resolving patch:
diff --git a/c7n/resources/cw.py b/c7n/resources/cw.py
--- a/c7n/resources/cw.py
+++ b/c7n/resources/cw.py
@@ -154,6 +154,8 @@ class resource_type(TypeInfo):
         universal_taggable = True
         cfn_type = 'AWS::Logs::LogGroup'
 
+    augment = universal_augment
+
     def get_arns(self, resources):
         # log group arn in resource describe has ':*' suffix, not all
         # apis can use that form, so normalize to standard arn.


Test patch:
diff --git a/tests/data/placebo/test_log_group_tag_delete/logs.DeleteLogGroup_1.json b/tests/data/placebo/test_log_group_tag_delete/logs.DeleteLogGroup_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_log_group_tag_delete/logs.DeleteLogGroup_1.json
@@ -0,0 +1,6 @@
+{
+    "status_code": 200,
+    "data": {
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_log_group_tag_delete/logs.DescribeLogGroups_1.json b/tests/data/placebo/test_log_group_tag_delete/logs.DescribeLogGroups_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_log_group_tag_delete/logs.DescribeLogGroups_1.json
@@ -0,0 +1,22 @@
+{
+    "status_code": 200,
+    "data": {
+        "logGroups": [
+            {
+                "logGroupName": "/aws/lambda/myIOTFunction",
+                "creationTime": 1607516251881,
+                "metricFilterCount": 0,
+                "arn": "arn:aws:logs:us-west-2:644160558196:log-group:/aws/lambda/myIOTFunction:*",
+                "storedBytes": 0
+            },
+            {
+                "logGroupName": "Yada",
+                "creationTime": 1607516375678,
+                "metricFilterCount": 0,
+                "arn": "arn:aws:logs:us-west-2:644160558196:log-group:Yada:*",
+                "storedBytes": 0
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_log_group_tag_delete/logs.DescribeLogGroups_2.json b/tests/data/placebo/test_log_group_tag_delete/logs.DescribeLogGroups_2.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_log_group_tag_delete/logs.DescribeLogGroups_2.json
@@ -0,0 +1,7 @@
+{
+    "status_code": 200,
+    "data": {
+        "logGroups": [],
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_log_group_tag_delete/tagging.GetResources_1.json b/tests/data/placebo/test_log_group_tag_delete/tagging.GetResources_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_log_group_tag_delete/tagging.GetResources_1.json
@@ -0,0 +1,22 @@
+{
+    "status_code": 200,
+    "data": {
+        "PaginationToken": "",
+        "ResourceTagMappingList": [
+            {
+                "ResourceARN": "arn:aws:logs:us-west-2:644160558196:log-group:Yada",
+                "Tags": [
+                    {
+                        "Key": "App",
+                        "Value": "Foie"
+                    },
+                    {
+                        "Key": "Environment",
+                        "Value": "production"
+                    }
+                ]
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/terraform/log_delete/main.tf b/tests/terraform/log_delete/main.tf
new file mode 100644
--- /dev/null
+++ b/tests/terraform/log_delete/main.tf
@@ -0,0 +1,8 @@
+resource "aws_cloudwatch_log_group" "test_group" {
+  name = "Yada"
+
+  tags = {
+    Environment = "production"
+    App = "Foie"
+  }
+}
diff --git a/tests/terraform/log_delete/tf_resources.json b/tests/terraform/log_delete/tf_resources.json
new file mode 100644
--- /dev/null
+++ b/tests/terraform/log_delete/tf_resources.json
@@ -0,0 +1,20 @@
+{
+    "pytest-terraform": 1,
+    "outputs": {},
+    "resources": {
+        "aws_cloudwatch_log_group": {
+            "test_group": {
+                "arn": "arn:aws:logs:us-west-2:644160558196:log-group:Yada",
+                "id": "Yada",
+                "kms_key_id": "",
+                "name": "Yada",
+                "name_prefix": null,
+                "retention_in_days": 0,
+                "tags": {
+                    "App": "Foie",
+                    "Environment": "production"
+                }
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/tests/test_cwl.py b/tests/test_cwl.py
--- a/tests/test_cwl.py
+++ b/tests/test_cwl.py
@@ -5,6 +5,31 @@
 from .common import BaseTest, functional
 from unittest.mock import MagicMock
 
+from pytest_terraform import terraform
+
+
+@terraform('log_delete', teardown=terraform.TEARDOWN_IGNORE)
+def test_tagged_log_group_delete(test, log_delete):
+    factory = test.replay_flight_data(
+        'test_log_group_tag_delete', region="us-west-2")
+
+    p = test.load_policy({
+        'name': 'group-delete',
+        'resource': 'aws.log-group',
+        'filters': [{
+            'tag:App': 'Foie'}],
+        'actions': ['delete']},
+        session_factory=factory, config={'region': 'us-west-2'})
+
+    resources = p.run()
+    assert len(resources) == 1
+    assert resources[0]['logGroupName'] == log_delete[
+        'aws_cloudwatch_log_group.test_group.name']
+    client = factory().client('logs')
+    assert client.describe_log_groups(
+        logGroupNamePrefix=resources[0]['logGroupName']).get(
+            'logGroups') == []
+
 
 class LogGroupTest(BaseTest):