Repository: cloud-custodian/cloud-custodian

Issue:
Request Feature: Request for cloud Trail events for Lambda
Hello , 
The following policy is giving me the error :2018-12-18 14:24:39,580: custodian.commands:ERROR Policy: lambda-tag-compliance is invalid: event shortcut not defined: CreateFunction
 policy ---
```
- name: lambda-tag-compliance
    resource: lambda
    mode:
      type: cloudtrail  #### cloud trail not possible
      role: arn:aws:iam::acctnumber:role/acctname
      events: 
         - CreateFunction
    filters:
      - "tag:custodian": absent
```
i changed the policy to the following based on the cc docs and the got the following error 
```
- name: lambda-tag-compliance
    resource: lambda
    mode:
      type: cloudtrail  #### cloud trail not possible
      role: arn:aws:iam::acctnum:role/acctname
      event: CreateFunction
      ids: "requestParameters.functionName"
    filters:
      - "tag:custodian": absent
```
error ---- 2018-12-18 14:33:41,697: custodian.commands:ERROR Configuration invalid: Policy.yml
2018-12-18 14:33:41,704: custodian.commands:ERROR {'type': 'cloudtrail', 'role': 'arn:aws:iam::acctnum:role/acctname', 'event': 'CreateFunction', 'ids': 'requestParameters.functionName'} is not valid under any of the given schemas

can you add the shortcut to cloud-custodian/c7n/cwe.py ... or is there anything else that we can do resolve this ?

Thank you 


Discussion:
you can specify any event if you specify the full syntax for event,  per the docs
https://cloudcustodian.io/docs/policy/lambda.html#cloudwatch-events

so rewriting your policy...

```yaml
- name: lambda-tag-compliance
    resource: lambda
    mode:
      type: cloudtrail  #### cloud trail not possible
      role: arn:aws:iam::245930108294:role/CloudCustodian-mipoc
      events: 
        - event: CreateFunction
          ids: "requestParameters.functionName"
          source: lambda.amazonaws.com
    filters:
      - "tag:custodian": absent
```


@kapilt : Thank you for the quick response. Tried the above and the following error came up when validating 

```
yaml.scanner.ScannerError: mapping values are not allowed here
  in "<string>", line 10, column 15:
               ids: "requestParameters.functionName"
                  ^
```
its an indentation issue the array under events should be a mapping with name, source, and ids.
thank you  was about to post the new error
```
2018-12-18 12:40:51,835: custodian.commands:ERROR Configuration invalid: policy.yml
2018-12-18 12:40:51,845: custodian.commands:ERROR {'type': 'cloudtrail', 'role': 'arn:aws:iam::acctnum:role/acctname',
 'events': [{'source': 'lambda.amazonaws.com', 'name': 'CreateFunction', 'ids': 
'requestParameters.functionName'}]} is not valid under any of the given schemas

Failed validating u'anyOf' in schema[66][u'allOf'][0][u'properties'][u'mode']:
    {u'anyOf': [{u'additionalProperties': False,
                 u'properties': {u'dead_letter_config': {u'type': u'object'},
                                 u'environment': {u'type': u'object'},
                                 'events': {u'items': {u'enum': [u'pending',
                                                                 u'running',
                                                                 u'shutting-down',
                                                                 u'stopped',
                                                                 u'stopping',
                                                                 u'terminated']},
                                            u'type': u'array'},
                                 u'execution-options': {u'type': u'object'},
                                 u'function-prefix': {u'type': u'string'},
                                 u'kms_key_arn': {u'type': u'string'},
                                 u'member-role': {u'type': u'string'},
                                 u'memory': {u'type': u'number'},
                                 u'packages': {u'type': u'array'},
                                 u'role': {u'type': u'string'},
                                 u'runtime': {u'enum': [u'python2.7',
                                                        u'python3.6']},
                                 u'security_groups': {u'type': u'array'},
                                 u'subnets': {u'type': u'array'},
                                 u'tags': {u'type': u'object'},
                                 u'timeout': {u'type': u'number'},
                                 u'tracing_config': {u'type': u'object'},
                                 u'type': {u'enum': [u'ec2-instance-state']}},
                 u'required': [u'type'],
                 u'type': u'object'},
                {u'additionalProperties': False,
                 u'properties': {u'type': {u'enum': [u'pull']}},
                 u'required': [u'type'],
                 u'type': u'object'},
                {u'additionalProperties': False,
                 u'properties': {u'dead_letter_config': {u'type': u'object'},
                                 u'environment': {u'type': u'object'},
                                 'events': {u'items': {u'enum': [u'launch-success',
                                                                 u'launch-failure',
                                                                 u'terminate-success',
                                                                 u'terminate-failure']},
                                            u'type': u'array'},
                                 u'execution-options': {u'type': u'object'},
                                 u'function-prefix': {u'type': u'string'},
                                 u'kms_key_arn': {u'type': u'string'},
                                 u'member-role': {u'type': u'string'},
                                 u'memory': {u'type': u'number'},
                                 u'packages': {u'type': u'array'},
                                 u'role': {u'type': u'string'},
                                 u'runtime': {u'enum': [u'python2.7',
                                                        u'python3.6']},
                                 u'security_groups': {u'type': u'array'},
                                 u'subnets': {u'type': u'array'},
                                 u'tags': {u'type': u'object'},
                                 u'timeout': {u'type': u'number'},
                                 u'tracing_config': {u'type': u'object'},
                                 u'type': {u'enum': [u'asg-instance-state']}},
                 u'required': [u'type'],
                 u'type': u'object'},
                {u'additionalProperties': False,
                 u'properties': {u'dead_letter_config': {u'type': u'object'},
                                 u'environment': {u'type': u'object'},
                                 'events': {u'items': {u'oneOf': [{u'type': u'string'},
                                                                  {u'properties': {u'event': {u'type': u'string'},
                                                                                   u'ids': {u'type': u'string'},
                                                                                   u'source': {u'type': u'string'}},
                                                                   u'required': [u'event',
                                                                                 u'source',
                                                                                 u'ids'],
                                                                   u'type': u'object'}]},
                                            u'type': u'array'},
                                 u'execution-options': {u'type': u'object'},
                                 u'function-prefix': {u'type': u'string'},
                                 u'kms_key_arn': {u'type': u'string'},
                                 u'member-role': {u'type': u'string'},
                                 u'memory': {u'type': u'number'},
                                 u'packages': {u'type': u'array'},
                                 u'role': {u'type': u'string'},
                                 u'runtime': {u'enum': [u'python2.7',
                                                        u'python3.6']},
                                 u'security_groups': {u'type': u'array'},
                                 u'subnets': {u'type': u'array'},
                                 u'tags': {u'type': u'object'},
                                 u'timeout': {u'type': u'number'},
                                 u'tracing_config': {u'type': u'object'},
                                 u'type': {u'enum': [u'cloudtrail']}},
                 u'required': [u'type'],
                 u'type': u'object'},
                {u'additionalProperties': False,
                 u'properties': {u'dead_letter_config': {u'type': u'object'},
                                 u'environment': {u'type': u'object'},
                                 u'execution-options': {u'type': u'object'},
                                 u'function-prefix': {u'type': u'string'},
                                 u'kms_key_arn': {u'type': u'string'},
                                 u'member-role': {u'type': u'string'},
                                 u'memory': {u'type': u'number'},
                                 u'packages': {u'type': u'array'},
                                 u'role': {u'type': u'string'},
                                 u'runtime': {u'enum': [u'python2.7',
                                                        u'python3.6']},
                                 u'security_groups': {u'type': u'array'},
                                 u'subnets': {u'type': u'array'},
                                 u'tags': {u'type': u'object'},
                                 u'timeout': {u'type': u'number'},
                                 u'tracing_config': {u'type': u'object'},
                                 u'type': {u'enum': [u'config-rule']}},
                 u'required': [u'type'],
                 u'type': u'object'},
                {u'additionalProperties': False,
                 u'properties': {u'dead_letter_config': {u'type': u'object'},
                                 u'environment': {u'type': u'object'},
                                 u'execution-options': {u'type': u'object'},
                                 u'function-prefix': {u'type': u'string'},
                                 u'kms_key_arn': {u'type': u'string'},
                                 u'member-role': {u'type': u'string'},
                                 u'memory': {u'type': u'number'},
                                 u'packages': {u'type': u'array'},
                                 u'role': {u'type': u'string'},
                                 u'runtime': {u'enum': [u'python2.7',
                                                        u'python3.6']},
                                 'schedule': {u'type': u'string'},
                                 u'security_groups': {u'type': u'array'},
                                 u'subnets': {u'type': u'array'},
                                 u'tags': {u'type': u'object'},
                                 u'timeout': {u'type': u'number'},
                                 u'tracing_config': {u'type': u'object'},
                                 u'type': {u'enum': [u'periodic']}},
                 u'required': [u'type'],
                 u'type': u'object'},
                {u'additionalProperties': False,
                 u'properties': {u'dead_letter_config': {u'type': u'object'},
                                 u'environment': {u'type': u'object'},
                                 u'execution-options': {u'type': u'object'},
                                 u'function-prefix': {u'type': u'string'},
                                 u'kms_key_arn': {u'type': u'string'},
                                 u'member-role': {u'type': u'string'},
                                 u'memory': {u'type': u'number'},
                                 u'packages': {u'type': u'array'},
                                 u'role': {u'type': u'string'},
                                 u'runtime': {u'enum': [u'python2.7',
                                                        u'python3.6']},
                                 u'security_groups': {u'type': u'array'},
                                 u'subnets': {u'type': u'array'},
                                 u'tags': {u'type': u'object'},
                                 u'timeout': {u'type': u'number'},
                                 u'tracing_config': {u'type': u'object'},
                                 u'type': {u'enum': [u'guard-duty']}},
                 u'required': [u'type'],
                 u'type': u'object'}]}

On instance[u'mode']:
    {'events': [{'ids': 'requestParameters.functionName',
                 'name': 'CreateFunction',
                 'source': 'lambda.amazonaws.com'}],
     'role': 'arn:aws:iam::acctnum:role/acctname',
     'type': 'cloudtrail'}
2018-12-18 12:40:51,845: custodian.commands:ERROR lambda-tag-compliance

```
s/name/event per the error message, again the docs have an example, and I've updated the one in this issue.
Lambda events are odd.  If you look at Cloudtrail you will see that the event isn't `CreateFunction`.  You will need to use
```
- name: lambda-tag-compliance
    resource: lambda
    mode:
      type: cloudtrail  #### cloud trail not possible
      role: arn:aws:iam::245930108294:role/CloudCustodian-mipoc
      events:
        - event: CreateFunction20150331
          source: "lambda.amazonaws.com"
          ids: "requestParameters.functionName"
    filters:
      - "tag:custodian": absent
```
it does feel like we should go ahead and add support here for the alias on lambda, given this is non-obvious , although i wonder if that means we need to carry forward on the various api date versions to ensure coverage.

Resolving patch:
diff --git a/c7n/cwe.py b/c7n/cwe.py
--- a/c7n/cwe.py
+++ b/c7n/cwe.py
@@ -79,6 +79,11 @@ class CloudWatchEvents(object):
             'ids': 'requestParameters.tableName',
             'source': 'dynamodb.amazonaws.com'},
 
+        'CreateFunction': {
+            'event': 'CreateFunction20150331',
+            'source': 'lambda.amazonaws.com',
+            'ids': 'requestParameters.functionName'},
+
         'RunInstances': {
             'ids': 'responseElements.instancesSet.items[].instanceId',
             'source': 'ec2.amazonaws.com'}}


Test patch: