Repository: cloud-custodian/cloud-custodian

Issue:
app-elb filter 'is-not-logging' only seems to work for app-elb and not nlb
I am using the following policy:
```yaml
  - name: app-elb-sharedservices-us-west-2-enable-s3-logging
    description: |
      This policy is triggered when a new elb is created
    resource: app-elb
    filters:
      - type: is-not-logging
      - type: event
        key: account
        value: '123456789012'
      - type: event
        key: region
        value: 'us-west-2'
    mode:
      packages: [boto3, botocore, urllib3]
      type: cloudtrail
      events:
        - source: elasticloadbalancing.amazonaws.com
          event: CreateLoadBalancer
          ids: responseElements.loadBalancers[].loadBalancerArn
      execution-options:
        region: us-west-2
      role: arn:aws:iam::{account_id}:role/cloud-custodian-role
      member-role: arn:aws:iam::{account_id}:role/cloud-custodian-role
    actions:
      - type: set-s3-logging
        bucket: 123456789012-us-west-2-elb-access-logs
        prefix: default/{account_id}/{LoadBalancerName}
        state: enabled
```

The purpose of the policy is to enable access logs and save them into an S3 bucket. The issue I am having is that this policy works fine when I create an App ELB but does not work when I create an NLB. Any suggestions on what could I be doing wrong? When creating an NLB I get the following:

```
[INFO]	2020-02-07T21:36:02.420Z	75e8d874-46ab-4943-b3cc-bafb9d33285e	Filtering resources with [<c7n.resources.appelb.IsNotLoggingFilter object at 0x7f97822f8350>, <c7n.filters.core.EventFilter object at 0x7f97822f8450>, <c7n.filters.core.EventFilter object at 0x7f97822f5a90>]

[DEBUG]	2020-02-07T21:18:39.10Z	edb5a137-f1c2-4971-9df2-a9b99f04f580	applied filter <c7n.resources.appelb.AppELBListenerFilter object at 0x7fe63f2f3d90> 1->0

[DEBUG]	2020-02-07T21:36:02.497Z	75e8d874-46ab-4943-b3cc-bafb9d33285e	applied filter <c7n.resources.appelb.IsNotLoggingFilter object at 0x7f97822f8350> 1->0

[INFO]	2020-02-07T21:36:02.497Z	75e8d874-46ab-4943-b3cc-bafb9d33285e	policy:app-elb-sharedservices-us-west-2-enable-s3-logging resources:app-elb no resources matched
```

So the filter is unable to find matching resources. I do not know why given that events from app elb and nlb look the same. I can't figure out what's wrong. I also tried not using the 'is-not-logging' filter and using instead:
```yaml
- type: value
        key: Attributes."access_logs.s3.enabled"
        value: false
```

When I create an app elb instead of an nlb I  get a successful outcome:
```
[INFO]	2020-02-07T07:05:44.661Z	a9857d24-eeba-4ba8-8db4-5f4d94a89f8e	Filtering resources with [<c7n.resources.appelb.IsNotLoggingFilter object at 0x7fa32d86e990>, <c7n.filters.core.EventFilter object at 0x7fa32d86e090>, <c7n.filters.core.EventFilter object at 0x7fa32d86e310>]

[DEBUG]	2020-02-07T07:05:44.803Z	a9857d24-eeba-4ba8-8db4-5f4d94a89f8e	applied filter <c7n.resources.appelb.IsNotLoggingFilter object at 0x7fa32d86e990> 1->1

[DEBUG]	2020-02-07T07:05:44.803Z	a9857d24-eeba-4ba8-8db4-5f4d94a89f8e	applied filter <c7n.filters.core.EventFilter object at 0x7fa32d86e090> 1->1

[DEBUG]	2020-02-07T07:05:44.803Z	a9857d24-eeba-4ba8-8db4-5f4d94a89f8e	applied filter <c7n.filters.core.EventFilter object at 0x7fa32d86e310> 1->1

[DEBUG]	2020-02-07T07:05:44.803Z	a9857d24-eeba-4ba8-8db4-5f4d94a89f8e	Filtered from 1 to 1 appelb

[DEBUG]	2020-02-07T07:05:44.804Z	a9857d24-eeba-4ba8-8db4-5f4d94a89f8e	Storing output with <LogFile file:///tmp/4c02f6dd-e6cb-44ee-a4b7-396495818407/app-elb-sharedservices-us-west-2-enable-s3-logging/custodian-run.log>

[INFO]	2020-02-07T07:05:44.805Z	a9857d24-eeba-4ba8-8db4-5f4d94a89f8e	policy:app-elb-sharedservices-us-west-2-enable-s3-logging invoking action:sets3logging resources:1
```

My understanding is that the filters of app-elb should work with nlb too but that's not the case. Neither option works. Any advice would be great.


Discussion:

Resolving patch:
diff --git a/c7n/resources/appelb.py b/c7n/resources/appelb.py
--- a/c7n/resources/appelb.py
+++ b/c7n/resources/appelb.py
@@ -614,12 +614,11 @@ def process(self, resources, event=None):
         bucket_prefix = self.data.get('prefix', None)
 
         return [alb for alb in resources
-                if alb['Type'] == 'application' and (
-                    not alb['Attributes']['access_logs.s3.enabled'] or (
-                        bucket_name and bucket_name != alb['Attributes'].get(
-                            'access_logs.s3.bucket', None)) or (
-                        bucket_prefix and bucket_prefix != alb['Attributes'].get(
-                            'access_logs.s3.prefix', None)))]
+                if not alb['Attributes']['access_logs.s3.enabled'] or
+                (bucket_name and bucket_name != alb['Attributes'].get(
+                    'access_logs.s3.bucket', None)) or
+                (bucket_prefix and bucket_prefix != alb['Attributes'].get(
+                    'access_logs.s3.prefix', None))]
 
 
 class AppELBTargetGroupFilterBase:


Test patch: