Repository: cloud-custodian/cloud-custodian

Issue:
VPC flow logs and WAF deprecated fields fail validation even if not used
### Describe the bug

It looks like there are a few issues with the few field-level deprecations we have defined:

- They always fail `custodian validate --strict` because `get_deprecations()` doesn't look at the fields defined in the policy.
- The error message is a bit redundant (for example, field 'X is deprecated' has been deprecated...).
- There's no indication of which filter the deprecated field belongs to.

Here is sample output from `custodian validate --strict` in c7n 0.9.30 for sample WAF & VPC flow logs policies. Each policy uses 1 legacy field: 

```console
2023-09-06 09:30:17,871: custodian.commands:WARNING deprecated usage found in policy
policy 'alb-waf-legacy-syntax' (deprecation-test.yml:2)
  filters:
    field 'web-acl is deprecated' has been deprecated (replaced by Use the value filter attributes instead)
    field 'state is deprecated' has been deprecated (replaced by Use the value filter attributes instead)
    field 'web-acl is deprecated' has been deprecated (replaced by Use the value filter attributes instead)
    field 'state is deprecated' has been deprecated (replaced by Use the value filter attributes instead)
2023-09-06 09:30:17,932: custodian.commands:WARNING deprecated usage found in policy
policy 'vpc-flow-log-legacy-syntax' (deprecation-test.yml:10)
  filters:
    field 'enabled is deprecated' has been deprecated (replaced by use list-item style attrs and set operators)
    field 'op is deprecated' has been deprecated (replaced by use list-item style attrs and set operators)
    field 'set-op is deprecated' has been deprecated (replaced by use list-item style attrs and set operators)
    field 'status is deprecated' has been deprecated (replaced by use list-item style attrs and set operators)
    field 'deliver-status is deprecated' has been deprecated (replaced by use list-item style attrs and set operators)
    field 'destination is deprecated' has been deprecated (replaced by use list-item style attrs and set operators)
    field 'destination-type is deprecated' has been deprecated (replaced by use list-item style attrs and set operators)
    field 'traffic-type is deprecated' has been deprecated (replaced by use list-item style attrs and set operators)
    field 'log-format is deprecated' has been deprecated (replaced by use list-item style attrs and set operators)
    field 'log-group is deprecated' has been deprecated (replaced by use list-item style attrs and set operators)
  actions:
    field 'DeliverLogsPermissionArn is deprecated' has been deprecated (replaced by set DeliverLogsPermissionArn under attrs: block)
    field 'LogGroupName is deprecated' has been deprecated (replaced by set LogGroupName under attrs: block)
    field 'LogDestination is deprecated' has been deprecated (replaced by set LogDestination under attrs: block)
    field 'LogFormat is deprecated' has been deprecated (replaced by set LogFormat under attrs: block)
    field 'MaxAggregationInterval is deprecated' has been deprecated (replaced by set MaxAggregationInterval under attrs: block)
    field 'LogDestinationType is deprecated' has been deprecated (replaced by set LogDestinationType under attrs: block)
    field 'TrafficType is deprecated' has been deprecated (replaced by set TrafficType under attrs: block)
2023-09-06 09:30:17,932: custodian.commands:INFO Configuration valid: deprecation-test.yml
```

### What did you expect to happen?

I expect validation to...

- include the filter name when reporting deprecated fields
- only include deprecation details for legacy fields that are used in the policy
- minimize redundant content in the validation errors

### Cloud Provider

Amazon Web Services (AWS)

### Cloud Custodian version and dependency information

_No response_

### Policy

```shell
policies:
  - name: alb-waf-legacy-syntax
    resource: aws.app-elb
    filters:
      - type: waf-enabled
        state: false
      - type: wafv2-enabled
        state: false

  - name: vpc-flow-log-legacy-syntax
    resource: aws.vpc
    filters:
      - type: flow-logs
        enabled: true
    actions:
      - type: set-flow-log
        state: true
        LogGroupName: /custodian/vpc/flow-logs
```


### Relevant log/traceback output

_No response_

### Extra information or context

_No response_


Discussion:

Resolving patch:
diff --git a/c7n/filters/waf.py b/c7n/filters/waf.py
--- a/c7n/filters/waf.py
+++ b/c7n/filters/waf.py
@@ -100,9 +100,10 @@ def _load_associated_resources(self, web_acl, resource_type):
         return resource_arns
 
     def get_deprecations(self):
+        filter_name = self.data["type"]
         return [
-            DeprecatedField(f"{k} is deprecated", "Use the value filter attributes instead")
-            for k in ['web-acl', 'state']
+            DeprecatedField(f"{filter_name}.{k}", "Use the value filter attributes instead")
+            for k in {'web-acl', 'state'}.intersection(self.data)
         ]
 
     def get_web_acl_from_associations(self, resource_type, resource_arn):
@@ -266,9 +267,10 @@ def _get_associated_web_acl_cached(self, resource):
         return resource[self.cache_key]
 
     def get_deprecations(self):
+        filter_name = self.data["type"]
         return [
-            DeprecatedField(f"{k} is deprecated", "Use the value filter attributes instead")
-            for k in ['web-acl', 'state']
+            DeprecatedField(f"{filter_name}.{k}", "Use the value filter attributes instead")
+            for k in {'web-acl', 'state'}.intersection(self.data)
         ]
 
     # only needed for REGIONAL resources so no scope used as regional is default
diff --git a/c7n/resources/vpc.py b/c7n/resources/vpc.py
--- a/c7n/resources/vpc.py
+++ b/c7n/resources/vpc.py
@@ -206,9 +206,10 @@ class FlowLogv2Filter(ListItemFilter):
     flow_log_map = None
 
     def get_deprecations(self):
+        filter_name = self.data["type"]
         return [
-            DeprecatedField(f"{k} is deprecated", "use list-item style attrs and set operators")
-            for k in self.legacy_schema
+            DeprecatedField(f"{filter_name}.{k}", "use list-item style attrs and set operators")
+            for k in set(self.legacy_schema).intersection(self.data)
         ]
 
     def validate(self):
@@ -2824,9 +2825,10 @@ class SetFlowLogs(BaseAction):
     }
 
     def get_deprecations(self):
+        filter_name = self.data["type"]
         return [
-            DeprecatedField(f"{k} is deprecated", f"set {k} under attrs: block")
-            for k in self.legacy_schema
+            DeprecatedField(f"{filter_name}.{k}", f"set {k} under attrs: block")
+            for k in set(self.legacy_schema).intersection(self.data)
         ]
 
     def validate(self):


Test patch: