Repository: cloud-custodian/cloud-custodian

Issue:
max-resources not being honored when using cached data
I was testing a new policy with c7n version 0.8.33.1 and it appears that `max-resources` is not being honored when it runs against the local cached data. The policy I'm testing with enables access logs for application ELBs and contains `max-resources: 50`.

When I provide `--cache-period 0`, it correctly fails because the count exceeds the max resource limit:
```
custodian run ./hourly.yml -p application-elb-require-logging-us-east-1 -s ./tmp --region us-east-1 --dryrun --cache-period 0
2019-01-30 10:11:38,016: custodian.policy:ERROR policy: application-elb-require-logging-us-east-1 exceeded resource limit: 50 found: 51
```

Then I run the same command from the local cache and it succeeds even though the count is above the max resource limit:
```
custodian run ./hourly.yml -p application-elb-require-logging-us-east-1 -s ./tmp --region us-east-1 --dryrun
2019-01-30 10:10:35,242: custodian.policy:INFO policy: application-elb-require-logging-us-east-1 resource:app-elb region:us-east-1 count:51 time:2.67
```

I've tried this with and without `--dryrun` and it behaves the same way. 

Here is the policy:
```
  - name: application-elb-require-logging-us-east-1
    resource: app-elb
    max-resources: 50
    region: us-east-1
    filters:
      - Type: application
      - type: is-not-logging
        bucket: *elb-logging-bucket-us-east-1
        prefix: *elb-logging-prefix
    actions:
      - type: set-s3-logging
        state: enabled
        bucket: *elb-logging-bucket-us-east-1
        prefix: *elb-logging-prefix
      - type: notify
        template: fs-default.html
        subject: "[custodian][{{ account }}] ELB Access Logging enabled"
        violation_desc: "Access logging has been enabled on the following ELB(s):"
        action_descs:
          - "No further action is required."
        policy_url: "N/A"
        <<: *notify_addresses
```


Discussion:
thanks for the bug report, pull-request forthcoming.

Resolving patch:
diff --git a/c7n/query.py b/c7n/query.py
--- a/c7n/query.py
+++ b/c7n/query.py
@@ -394,27 +394,27 @@ def get_cache_key(self, query):
         }
 
     def resources(self, query=None):
-        key = self.get_cache_key(query)
+        cache_key = self.get_cache_key(query)
+        resources = None
+
         if self._cache.load():
-            resources = self._cache.get(key)
+            resources = self._cache.get(cache_key)
             if resources is not None:
                 self.log.debug("Using cached %s: %d" % (
                     "%s.%s" % (self.__class__.__module__,
                                self.__class__.__name__),
                     len(resources)))
-                return self.filter_resources(resources)
-
-        if query is None:
-            query = {}
 
-        with self.ctx.tracer.subsegment('resource-fetch'):
-            resources = self.source.resources(query)
-        with self.ctx.tracer.subsegment('resource-augment'):
-            resources = self.augment(resources)
+        if resources is None:
+            if query is None:
+                query = {}
+            with self.ctx.tracer.subsegment('resource-fetch'):
+                resources = self.source.resources(query)
+            with self.ctx.tracer.subsegment('resource-augment'):
+                resources = self.augment(resources)
+            self._cache.save(cache_key, resources)
 
         resource_count = len(resources)
-        self._cache.save(key, resources)
-
         with self.ctx.tracer.subsegment('filter'):
             resources = self.filter_resources(resources)
 


Test patch: