Repository: cloud-custodian/cloud-custodian

Issue:
aws - glue-catalog filter 'or' comparison error
**Describe the bug**
The glue-catalog filters seem to fail when an `-or` comparison is in use.

**To Reproduce**
Perform a dry run of a policy using `-or` on resource glue-catalog (see policy below).

**Expected behavior**
Glue: [get_data_catalog_encryption_settings](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/glue.html#Glue.Client.get_data_catalog_encryption_settings) returns the following:

```
{
    'DataCatalogEncryptionSettings': {
        'EncryptionAtRest': {
            'CatalogEncryptionMode': 'DISABLED'|'SSE-KMS',
            'SseAwsKmsKeyId': 'string'
        },
        'ConnectionPasswordEncryption': {
            'ReturnConnectionPasswordEncrypted': True|False,
            'AwsKmsKeyId': 'string'
        }
    }
}
```
I expect to be able to filter for either CatalogEncryptionMode:DISABLED or ReturnConnectionPasswordEncrypted:False. 

The policy is successful when I remove `-or` and filter for only one of the properties.

**Background (please complete the following information):**
 - OS: OSX 10.14
 - Python Version: 3.7.6
 - Custodian Version: 0.9.1
 - Tool Version: [N/A]
 - Cloud Provider: aws
 - Policy: 
```yaml
policies:
  - name: glue-catalog-encrypted
    resource: glue-catalog
    tags:
      - "whatever"
      - "whateverwhatever"
    description:
      Enable data at rest encryption for AWS Glue data catalog if the setting is disabled
    filters:
      - or:
        - type: value
          key: DataCatalogEncryptionSettings.EncryptionAtRest.CatalogEncryptionMode
          op: eq
          value: DISABLED
        - type: value
          key: DataCatalogEncryptionSettings.ConnectionPasswordEncryption.ReturnConnectionPasswordEncrypted
          op: eq
          value: false
```
 - Traceback: [if applicable, please exclude sensitive/account information]
```
2020-05-01 15:49:42,509: custodian.output:ERROR Error while executing policy
Traceback (most recent call last):
  File "c:\users\username\.virtualenvs\c7n-0.9.1-4h5kzyle\lib\site-packages\c7n\policy.py", line 291, in run
    resources = self.policy.resource_manager.resources()
  File "c:\users\username\.virtualenvs\c7n-0.9.1-4h5kzyle\lib\site-packages\c7n\resources\glue.py", line 516, in resources
    return self.filter_resources(self._get_catalog_encryption_settings())
  File "c:\users\username\.virtualenvs\c7n-0.9.1-4h5kzyle\lib\site-packages\c7n\manager.py", line 109, in filter_resources
    resources = f.process(resources, event)
  File "c:\users\username\.virtualenvs\c7n-0.9.1-4h5kzyle\lib\site-packages\c7n\filters\core.py", line 258, in process
    return self.process_set(resources, event)
  File "c:\users\username\.virtualenvs\c7n-0.9.1-4h5kzyle\lib\site-packages\c7n\filters\core.py", line 270, in process_set
    resource_map = {r[rtype_id]: r for r in resources}
  File "c:\users\username\.virtualenvs\c7n-0.9.1-4h5kzyle\lib\site-packages\c7n\filters\core.py", line 270, in <dictcomp>
    resource_map = {r[rtype_id]: r for r in resources}
KeyError: 'CatalogId'
2020-05-01 15:49:42,512: custodian.commands:ERROR Error while executing policy glue-catalog-encrypted, continuing
Traceback (most recent call last):
  File "c:\users\username\.virtualenvs\c7n-0.9.1-4h5kzyle\lib\site-packages\c7n\commands.py", line 281, in run
    policy()
  File "c:\users\username\.virtualenvs\c7n-0.9.1-4h5kzyle\lib\site-packages\c7n\policy.py", line 1056, in __call__
    resources = PullMode(self).run()
  File "c:\users\username\.virtualenvs\c7n-0.9.1-4h5kzyle\lib\site-packages\c7n\policy.py", line 291, in run
    resources = self.policy.resource_manager.resources()
  File "c:\users\username\.virtualenvs\c7n-0.9.1-4h5kzyle\lib\site-packages\c7n\resources\glue.py", line 516, in resources
    return self.filter_resources(self._get_catalog_encryption_settings())
  File "c:\users\username\.virtualenvs\c7n-0.9.1-4h5kzyle\lib\site-packages\c7n\manager.py", line 109, in filter_resources
    resources = f.process(resources, event)
  File "c:\users\username\.virtualenvs\c7n-0.9.1-4h5kzyle\lib\site-packages\c7n\filters\core.py", line 258, in process
    return self.process_set(resources, event)
  File "c:\users\username\.virtualenvs\c7n-0.9.1-4h5kzyle\lib\site-packages\c7n\filters\core.py", line 270, in process_set
    resource_map = {r[rtype_id]: r for r in resources}
  File "c:\users\username\.virtualenvs\c7n-0.9.1-4h5kzyle\lib\site-packages\c7n\filters\core.py", line 270, in <dictcomp>
    resource_map = {r[rtype_id]: r for r in resources}
KeyError: 'CatalogId'
```

 - `custodian version --debug` output
```
Custodian:   0.9.1
Python:      3.8.2 (tags/v3.8.2:7b3ab59, Feb 25 2020, 23:03:10) [MSC v.1916 64 bit (AMD64)]
Platform:   win32
Using venv:  True
Docker: False
Installed:

argcomplete==1.11.1
attrs==19.3.0
boto3==1.12.47
botocore==1.15.47
docutils==0.15.2
importlib-metadata==1.6.0
jmespath==0.9.5
jsonschema==3.2.0
pyrsistent==0.16.0
python-dateutil==2.8.1
pyyaml==5.3.1
s3transfer==0.3.3
setuptools==46.1.3
six==1.14.0
tabulate==0.8.7
urllib3==1.25.9
zipp==3.1.0
```
**Additional context**
Add any other context about the problem here.



Discussion:

Resolving patch:
diff --git a/c7n/resources/account.py b/c7n/resources/account.py
--- a/c7n/resources/account.py
+++ b/c7n/resources/account.py
@@ -1533,7 +1533,20 @@ def process(self, resources):
 
 
 class GlueCatalogEncryptionEnabled(MultiAttrFilter):
+    """ Filter glue catalog by its glue encryption status and KMS key
 
+    :example:
+
+    .. code-block:: yaml
+
+      policies:
+        - name: glue-catalog-security-config
+          resource: aws.glue-catalog
+          filters:
+            - type: glue-security-config
+              SseAwsKmsKeyId: alias/aws/glue
+
+    """
     retry = staticmethod(QueryResourceManager.retry)
 
     schema = {
@@ -1541,7 +1554,7 @@ class GlueCatalogEncryptionEnabled(MultiAttrFilter):
         'additionalProperties': False,
         'properties': {
             'type': {'enum': ['glue-security-config']},
-            'CatalogEncryptionMode': {'type': 'string'},
+            'CatalogEncryptionMode': {'enum': ['DISABLED', 'SSE-KMS']},
             'SseAwsKmsKeyId': {'type': 'string'},
             'ReturnConnectionPasswordEncrypted': {'type': 'boolean'},
             'AwsKmsKeyId': {'type': 'string'}
@@ -1572,18 +1585,18 @@ def get_target(self, resource):
                 'DataCatalogEncryptionSettings')
         resource[self.annotation] = encryption_setting.get('EncryptionAtRest')
         resource[self.annotation].update(encryption_setting.get('ConnectionPasswordEncryption'))
-
-        for kmskey in self.data:
-            if not self.data[kmskey].startswith('alias'):
+        key_attrs = ('SseAwsKmsKeyId', 'AwsKmsKeyId')
+        for encrypt_attr in key_attrs:
+            if encrypt_attr not in self.data or not self.data[encrypt_attr].startswith('alias'):
                 continue
-            key = resource[self.annotation].get(kmskey)
-            vfd = {'c7n:AliasName': self.data[kmskey]}
+            key = resource[self.annotation].get(encrypt_attr)
+            vfd = {'c7n:AliasName': self.data[encrypt_attr]}
             vf = KmsRelatedFilter(vfd, self.manager)
             vf.RelatedIdsExpression = 'KmsKeyId'
             vf.annotate = False
             if not vf.process([{'KmsKeyId': key}]):
                 return []
-            resource[self.annotation][kmskey] = self.data[kmskey]
+            resource[self.annotation][encrypt_attr] = self.data[encrypt_attr]
         return resource[self.annotation]
 
 
diff --git a/c7n/resources/glue.py b/c7n/resources/glue.py
--- a/c7n/resources/glue.py
+++ b/c7n/resources/glue.py
@@ -13,7 +13,6 @@
 # limitations under the License.
 from botocore.exceptions import ClientError
 from concurrent.futures import as_completed
-from .aws import shape_validate
 from c7n.manager import resources, ResourceManager
 from c7n.query import QueryResourceManager, TypeInfo
 from c7n.utils import local_session, chunks, type_schema
@@ -520,6 +519,7 @@ def get_model(self):
     def _get_catalog_encryption_settings(self):
         client = utils.local_session(self.session_factory).client('glue')
         settings = client.get_data_catalog_encryption_settings()
+        settings['CatalogId'] = self.config.account_id
         settings.pop('ResponseMetadata', None)
         return [settings]
 
@@ -548,25 +548,43 @@ class GlueDataCatalogEncryption(BaseAction):
                 actions:
                   - type: set-encryption
                     attributes:
-                        EncryptionAtRest:
-                            CatalogEncryptionMode: SSE-KMS
-                            SseAwsKmsKeyId: alias/aws/glue
+                      EncryptionAtRest:
+                        CatalogEncryptionMode: SSE-KMS
+                        SseAwsKmsKeyId: alias/aws/glue
     """
 
     schema = type_schema(
         'set-encryption',
-        attributes={'type': 'object', "minItems": 1},
-        required=('attributes',))
+        required=['attributes'],
+        attributes={
+            'type': 'object',
+            'additionalProperties': False,
+            'properties': {
+                'EncryptionAtRest': {
+                    'type': 'object',
+                    'additionalProperties': False,
+                    'required': ['CatalogEncryptionMode'],
+                    'properties': {
+                        'CatalogEncryptionMode': {'enum': ['DISABLED', 'SSE-KMS']},
+                        'SseAwsKmsKeyId': {'type': 'string'}
+                    }
+                },
+                'ConnectionPasswordEncryption': {
+                    'type': 'object',
+                    'additionalProperties': False,
+                    'required': ['ReturnConnectionPasswordEncrypted'],
+                    'properties': {
+                        'ReturnConnectionPasswordEncrypted': {'type': 'boolean'},
+                        'AwsKmsKeyId': {'type': 'string'}
+                    }
+                }
+            }
+        }
+    )
 
     permissions = ('glue:PutDataCatalogEncryptionSettings',)
-    shape = 'PutDataCatalogEncryptionSettingsRequest'
 
-    def validate(self):
-        attrs = {}
-        attrs['DataCatalogEncryptionSettings'] = self.data['attributes']
-        return shape_validate(attrs, self.shape, 'glue')
-
-    def process(self, catalog):
+    def process(self, resources):
         client = local_session(self.manager.session_factory).client('glue')
         # there is one glue data catalog per account
         client.put_data_catalog_encryption_settings(
@@ -575,7 +593,7 @@ def process(self, catalog):
 
 @GlueDataCatalog.filter_registry.register('glue-security-config')
 class GlueCatalogEncryptionFilter(GlueCatalogEncryptionEnabled):
-    """Filter aws account by its glue encryption status and KMS key
+    """Filter glue catalog by its glue encryption status and KMS key
 
     :example:
 


Test patch: