Repository: cloud-custodian/cloud-custodian

Issue:
[EC2] Force Terminate does not work when `disableApiStop` is set
### Describe the bug

When `disableApiStop` is set to True on an Instance, force termination fails because `disableApiStop` is set to `Enabled`.

### What did you expect to happen?

I expected my instances to be terminated.

### Cloud Provider

Amazon Web Services (AWS)

### Cloud Custodian version and dependency information

```shell
Custodian:   0.9.14
Python:      3.8.5 (default, Sep  4 2020, 07:30:14) 
             [GCC 7.3.0]
Platform:    posix.uname_result(sysname='Linux', nodename='<redacted>', release='5.13.0-1022-aws', version='#24~20.04.1-Ubuntu SMP Thu Apr 7 22:10:15 UTC 2022', machine='x86_64')
Using venv:  False
Docker: False
Installed: 

argcomplete==1.12.3
attrs==None
boto3==1.16.52
botocore==1.19.52
docutils==0.17.1
importlib-metadata==4.8.1
jmespath==0.10.0
jsonschema==3.2.0
pyrsistent==None
python-dateutil==2.8.2
pyyaml==5.4.1
s3transfer==0.3.7
setuptools==44.1.1
six==1.16.0
tabulate==0.8.9
typing-extensions==3.10.0.2
urllib3==1.26.7
zipp==3.6.0
```


### Policy

```shell
policies:
  - name: "something"
    mode: &cron-lambda
      type: periodic
      schedule: "rate(5 minutes)"
      role: CustodianForEC2
    resource: aws.ec2
    filters:
      - type: value
        key: "State.Name"
        op: in
        value:
          - running
          - stopped
          - stopping
      - type: value
        key: LaunchTime
        value_type: age
        value: 0.050
        op: greater-than
      # & not protected from termination
      - not:
        - type: termination-protected
    actions:
      - type: terminate
        force: true
```


### Relevant log/traceback output

```shell
[ERROR] ClientError: An error occurred (OperationNotPermitted) when calling the TerminateInstances operation: The instance 'i-<redacted-id>' may not be terminated. Modify its 'disableApiStop' instance attribute and try again.
Traceback (most recent call last):
  File "/var/task/custodian_policy.py", line 4, in run
    return handler.dispatch_event(event, context)
  File "/var/task/c7n/handler.py", line 166, in dispatch_event
    p.push(event, context)
  File "/var/task/c7n/policy.py", line 1134, in push
    return mode.run(event, lambda_ctx)
  File "/var/task/c7n/policy.py", line 522, in run
    return PullMode.run(self)
  File "/var/task/c7n/policy.py", line 313, in run
    results = a.process(resources)
  File "/var/task/c7n/resources/ec2.py", line 1543, in process
    self.manager.retry(
  File "/var/task/c7n/utils.py", line 363, in _retry
    return func(*args, **kw)
  File "/var/runtime/botocore/client.py", line 391, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/var/runtime/botocore/client.py", line 719, in _make_api_call
    raise error_class(parsed_response, operation_name)
```
```


### Extra information or context

_No response_


Discussion:

Resolving patch:
diff --git a/c7n/resources/ec2.py b/c7n/resources/ec2.py
--- a/c7n/resources/ec2.py
+++ b/c7n/resources/ec2.py
@@ -1502,7 +1502,7 @@ class Terminate(BaseAction):
     with api deletion termination protection, so we can't use the bulk call
     reliabily, we need to process the instances individually. Additionally
     If we're configured with 'force' then we'll turn off instance termination
-    protection.
+    and stop protection.
 
     :Example:
 
@@ -1547,18 +1547,22 @@ def process(self, instances):
 
     def disable_deletion_protection(self, client, instances):
 
-        def process_instance(i):
+        def modify_instance(i, attribute):
             try:
                 self.manager.retry(
                     client.modify_instance_attribute,
                     InstanceId=i['InstanceId'],
-                    Attribute='disableApiTermination',
+                    Attribute=attribute,
                     Value='false')
             except ClientError as e:
                 if e.response['Error']['Code'] == 'IncorrectInstanceState':
                     return
                 raise
 
+        def process_instance(i):
+            modify_instance(i, 'disableApiTermination')
+            modify_instance(i, 'disableApiStop')
+
         with self.executor_factory(max_workers=2) as w:
             list(w.map(process_instance, instances))
 


Test patch:
diff --git a/tests/data/placebo/test_ec2_terminate/ec2.ModifyInstanceAttribute_2.json b/tests/data/placebo/test_ec2_terminate/ec2.ModifyInstanceAttribute_2.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_ec2_terminate/ec2.ModifyInstanceAttribute_2.json
@@ -0,0 +1,17 @@
+{
+    "status_code": 200, 
+    "data": {
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "78141786-395b-4939-b462-d76986f2dff5", 
+            "HTTPHeaders": {
+                "transfer-encoding": "chunked", 
+                "vary": "Accept-Encoding", 
+                "server": "AmazonEC2", 
+                "content-type": "text/xml;charset=UTF-8", 
+                "date": "Sun, 06 Nov 2016 11:36:08 GMT"
+            }
+        }
+    }
+}
\ No newline at end of file