Repository: cloud-custodian/cloud-custodian

Issue:
c7n-org increase error verbosity
Can the error messages on c7n-org be made more verbose, like it is on "custodian run" ?

```
[Container] 2019/06/10 14:58:51 Running command c7n-org run --dryrun -c c7n-org-policies/accounts.yml -s output -u c7n-org-policies/organization-policies.yml --region us-east-1 --region ca-central-1 --verbose 
2019-06-10 14:58:52,326: c7n_org:DEBUG Running policy:rds-unused-databases-notify-step1 account:AccountNameSecurity region:us-east-1 
<stripped>
2019-06-10 14:58:52,734: c7n_org:WARNING Access denied account:AccountNameMember1 region:ca-central-1 
<stripped>
2019-06-10 14:58:53,014: c7n_org:DEBUG Running policy:rds-unused-databases-notify-step2 account:AccountNameSecurity region:us-east-1 
<stripped>
2019-06-10 14:58:53,074: c7n_org:INFO Policy resource counts Counter({'rds-unused-databases-delete-step4': 0, 'rds-unused-databases-unmark': 0, 'rds-unused-databases-notify-step1': 0, 'rds-unused-databases-stop-and-nag-hourly-step3': 0, 'rds-unused-databases-notify-step2': 0}) 
[Container] 2019/06/10 14:58:53 Command did not exit successfully c7n-org run --dryrun -c c7n-org-policies/accounts.yml -s output -u c7n-org-policies/organization-policies.yml --region us-east-1 --region ca-central-1 --verbose exit status 1 
[Container] 2019/06/10 14:58:53 Phase complete: BUILD State: FAILED 
[Container] 2019/06/10 14:58:53 Phase context status code: COMMAND_EXECUTION_ERROR Message: Error while executing command: c7n-org run --dryrun -c c7n-org-policies/accounts.yml -s output -u c7n-org-policies/organization-policies.yml --region us-east-1 --region ca-central-1 --verbose. Reason: exit status 1 
```
I don't get any information on what is actually the error and the user/role that got denied.

-----
For reference, while running custodian run, we get this kind of error:

```
2019-06-10 03:28:49,851: custodian.commands:ERROR Error while executing policy high-risk-security-groups-remediate, continuing 
Traceback (most recent call last): 
  File "/usr/local/lib/python2.7/si... <STRIPPED>
ClientError: An error occurred (AccessDeniedException) when calling the DescribeLogGroups operation: User: arn:aws:sts::<accountid>:assumed-role/CloudCustodianPolicyDeploymentProjectRole/AWSCodeBuild-796e2aea-abb5-4a17-a2c8-373bc7e15d1d is not authorized to perform: logs:DescribeLogGroups on resource: arn:aws:logs:us-east-1:<accountid>:log-group::log-stream: 
```


Discussion:

Resolving patch:
diff --git a/tools/c7n_org/c7n_org/cli.py b/tools/c7n_org/c7n_org/cli.py
--- a/tools/c7n_org/c7n_org/cli.py
+++ b/tools/c7n_org/c7n_org/cli.py
@@ -553,8 +553,8 @@ def run_account(account, region, policies_config, output_path,
             except ClientError as e:
                 success = False
                 if e.response['Error']['Code'] == 'AccessDenied':
-                    log.warning('Access denied account:%s region:%s',
-                                account['name'], region)
+                    log.warning('Access denied api:%s policy:%s account:%s region:%s',
+                                e.operation_name, p.name, account['name'], region)
                     return policy_counts, success
                 log.error(
                     "Exception running policy:%s account:%s region:%s error:%s",


Test patch: