Repository: cloud-custodian/cloud-custodian

Issue:
aws.lambda network-location filter causes KeyError
**Describe the bug**
Attempting to use the `network-location` filter with either `resource/security-group` or `subnet/security-group` causes a `KeyError`

**To Reproduce**
Execute example policy below.

**Expected behavior**
Custodian should execute the policy successfully.


**Background (please complete the following information):**
 - OS: Windows10
 - Python Version: Python 3.8.2
 - Custodian Version: 0.9.2
 - Tool Version: NA
 - Cloud Provider: aws
 - Policy: 
```yaml
policies:

  - name: lambda-sg-subnet-tag-compare
    resource: aws.lambda
    filters:
      - type: value
        key: VpcConfig.SecurityGroupIds[]
        op: ge
        value: 1
        value_type: size
      - not:
          - type: network-location
            key: tag:foobar
            match: equal
            compare:
              - subnet
              - security-group

  - name: lambda-resource-sg-tag-compare
    resource: aws.lambda
    filters:
      - type: value
        key: VpcConfig.SecurityGroupIds[]
        op: ge
        value: 1
        value_type: size
      - not:
          - type: network-location
            key: tag:foobar
            match: equal
            compare:
              - resource
              - security-group
```
 - Traceback:
```bash
2020-06-25 19:30:26,879: custodian.output:ERROR Error while executing policy
Traceback (most recent call last):
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\policy.py", line 291, in run
    resources = self.policy.resource_manager.resources()
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\query.py", line 508, in resources
    resources = self.filter_resources(resources)
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\manager.py", line 121, in filter_resources
    resources = f.process(resources, event)
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\filters\core.py", line 330, in process
    return self.process_set(resources, event)
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\filters\core.py", line 349, in process_set
    resources = f.process(resources, event)
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\filters\vpc.py", line 176, in process
    [related_sg[sid] for sid in self.sg.get_related_ids([r])])
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\filters\vpc.py", line 176, in <listcomp>
    [related_sg[sid] for sid in self.sg.get_related_ids([r])])
KeyError: 'sg-aaaaaaa'
2020-06-25 19:30:26,886: custodian.commands:ERROR Error while executing policy lambda-sg-subnet-tag-compare, continuing
Traceback (most recent call last):
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\commands.py", line 282, in run
    policy()
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\policy.py", line 1170, in __call__
    resources = PullMode(self).run()
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\policy.py", line 291, in run
    resources = self.policy.resource_manager.resources()
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\query.py", line 508, in resources
    resources = self.filter_resources(resources)
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\manager.py", line 121, in filter_resources
    resources = f.process(resources, event)
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\filters\core.py", line 330, in process
    return self.process_set(resources, event)
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\filters\core.py", line 349, in process_set
    resources = f.process(resources, event)
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\filters\vpc.py", line 176, in process
    [related_sg[sid] for sid in self.sg.get_related_ids([r])])
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\filters\vpc.py", line 176, in <listcomp>
    [related_sg[sid] for sid in self.sg.get_related_ids([r])])
KeyError: 'sg-aaaaaaa'
2020-06-25 19:30:34,951: custodian.output:ERROR Error while executing policy
Traceback (most recent call last):
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\policy.py", line 291, in run
    resources = self.policy.resource_manager.resources()
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\query.py", line 508, in resources
    resources = self.filter_resources(resources)
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\manager.py", line 121, in filter_resources
    resources = f.process(resources, event)
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\filters\core.py", line 330, in process
    return self.process_set(resources, event)
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\filters\core.py", line 349, in process_set
    resources = f.process(resources, event)
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\filters\vpc.py", line 176, in process
    [related_sg[sid] for sid in self.sg.get_related_ids([r])])
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\filters\vpc.py", line 176, in <listcomp>
    [related_sg[sid] for sid in self.sg.get_related_ids([r])])
KeyError: 'sg-aaaaaaa'
2020-06-25 19:30:34,953: custodian.commands:ERROR Error while executing policy lambda-resource-sg-tag-compare, continuing
Traceback (most recent call last):
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\commands.py", line 282, in run
    policy()
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\policy.py", line 1170, in __call__
    resources = PullMode(self).run()
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\policy.py", line 291, in run
    resources = self.policy.resource_manager.resources()
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\query.py", line 508, in resources
    resources = self.filter_resources(resources)
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\manager.py", line 121, in filter_resources
    resources = f.process(resources, event)
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\filters\core.py", line 330, in process
    return self.process_set(resources, event)
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\filters\core.py", line 349, in process_set
    resources = f.process(resources, event)
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\filters\vpc.py", line 176, in process
    [related_sg[sid] for sid in self.sg.get_related_ids([r])])
  File "c:\users\waldo\.local\pipx\venvs\c7n\lib\site-packages\c7n\filters\vpc.py", line 176, in <listcomp>
    [related_sg[sid] for sid in self.sg.get_related_ids([r])])
KeyError: 'sg-aaaaaaa'
2020-06-25 19:30:34,955: custodian.commands:ERROR The following policies had errors while executing
 - lambda-sg-subnet-tag-compare
 - lambda-resource-sg-tag-compare
```
 - `custodian version --debug` output

```bash
$ custodian version --debug

Please copy/paste the following info along with any bug reports:

Custodian:   0.9.2
Python:      3.8.2 (tags/v3.8.2:7b3ab59, Feb 25 2020, 22:45:29) [MSC v.1916 32 bit (Intel)]
Platform:   win32
Using venv:  True
Docker: False
Installed:

argcomplete==1.11.1
attrs==19.3.0
boto3==1.14.8
botocore==1.17.8
docutils==0.15.2
importlib-metadata==1.6.1
jmespath==0.10.0
jsonschema==3.2.0
pyrsistent==0.16.0
python-dateutil==2.8.1
pyyaml==5.3.1
s3transfer==0.3.3
setuptools==47.3.1
six==1.15.0
tabulate==0.8.7
urllib3==1.25.9
zipp==3.1.0

```
**Additional context**
Add any other context about the problem here.



Discussion:
does the security group referenced exist in the account? sg-aaaaaaa
> does the security group referenced exist in the account? sg-aaaaaaa

Yes. I've renamed the sg in the traceback to a dummy value.
could be related to this #5892 . might just be hitting an edge case where the resource doesn't exists

Resolving patch:
diff --git a/c7n/filters/vpc.py b/c7n/filters/vpc.py
--- a/c7n/filters/vpc.py
+++ b/c7n/filters/vpc.py
@@ -163,9 +163,10 @@ def process(self, resources, event=None):
         results = []
         for r in resources:
             resource_sgs = self.filter_ignored(
-                [related_sg[sid] for sid in self.sg.get_related_ids([r])])
-            resource_subnets = self.filter_ignored([
-                related_subnet[sid] for sid in self.subnet.get_related_ids([r])])
+                [related_sg[sid] for sid in self.sg.get_related_ids([r]) if sid in related_sg])
+            resource_subnets = self.filter_ignored(
+                [related_subnet[sid] for sid in self.subnet.get_related_ids([r])
+                if sid in related_subnet])
             found = self.process_resource(r, resource_sgs, resource_subnets, key)
             if found:
                 results.append(found)


Test patch: