Repository: cloud-custodian/cloud-custodian

Issue:
Wafv2 logging error when using cloudtrail mode
### Describe the bug

When my wafv2 logging policy runs after disabling logging I receive an error on a cloudtrail policy when using the DeleteLoggingConfiguration event.

### What did you expect to happen?

I expected the policy to match my resource.

### Cloud Provider

Amazon Web Services (AWS)

### Cloud Custodian version and dependency information

```shell
custodian version --debug

Please copy/paste the following info along with any bug reports:

Custodian:   0.9.21
Python:      3.8.0 (v3.8.0:fa919fdf25, Oct 14 2019, 10:23:27) 
             [Clang 6.0 (clang-600.0.57)]
Platform:    posix.uname_result(sysname='Darwin', nodename='kristen-MacBook-Pro', release='21.4.0', version='Darwin Kernel Version 21.4.0: Mon Feb 21 20:35:58 PST 2022; root:xnu-8020.101.4~2/RELEASE_ARM64_T6000', machine='x86_64')
Using venv:  True
Docker: False
Installed: 

argcomplete==2.0.0
attrs==22.1.0
boto3==1.26.30
botocore==1.29.30
docutils==0.17.1
importlib-metadata==4.13.0
importlib-resources==5.10.1
jmespath==1.0.1
jsonschema==4.17.3
pkgutil-resolve-name==1.3.10
pyrsistent==0.19.2
python-dateutil==2.8.2
pyyaml==6.0
s3transfer==0.6.0
six==1.16.0
tabulate==0.8.10
urllib3==1.26.13
zipp==3.11.0
```


### Policy

```shell
Policy example:

- name: wafv2-log-testing
  resource: aws.wafv2
  mode:
    role: arn:aws:iam::testing
    type: cloudtrail
    events: 
    - event: DeleteLoggingConfiguration
       ids: requestParameters.resourceArn
       source: wafv2.amazonaws.com
  filters: 
  - not:
      - type: logging
        key: ResourceArn
        value: present
```


### Relevant log/traceback output

```shell
Error when policy runs:


[ERROR]	2023-01-06T18:48:11.706Z	163a02a3-69d6-4d43-a307-365ddcb8ead7	error during policy executionTraceback (most recent call last):  File "/var/task/c7n/handler.py", line 165, in dispatch_event    p.push(event, context)  File "/var/task/c7n/policy.py", line 1288, in push    return mode.run(event, lambda_ctx)  File "/var/task/c7n/policy.py", line 487, in run    resources = self.resolve_resources(event)  File "/var/task/c7n/policy.py", line 691, in resolve_resources    return super().resolve_resources(event)  File "/var/task/c7n/policy.py", line 469, in resolve_resources    resources = self.policy.resource_manager.get_resources(resource_ids)  File "/var/task/c7n/query.py", line 576, in get_resources    resources = self.source.get_resources(ids)  File "/var/task/c7n/query.py", line 227, in get_resources    return self.query.get(self.manager, ids)  File "/var/task/c7n/query.py", line 100, in get    resources = self.filter(resource_manager, **params)  File "/var/task/c7n/query.py", line 79, in filter    return self._invoke_client_enum(  File "/var/task/c7n/query.py", line 60, in _invoke_client_enum    data = op(**params)  File "/var/runtime/botocore/client.py", line 391, in _api_call    return self._make_api_call(operation_name, kwargs)  File "/var/runtime/botocore/client.py", line 691, in _make_api_call    request_dict = self._convert_to_request_dict(  File "/var/runtime/botocore/client.py", line 739, in _convert_to_request_dict    request_dict = self._serializer.serialize_to_request(  File "/var/runtime/botocore/validate.py", line 360, in serialize_to_request    raise ParamValidationError(report=report.generate_report())botocore.exceptions.ParamValidationError: Parameter validation failed:Missing required parameter in input: "Scope" | [ERROR] 2023-01-06T18:48:11.706Z 163a02a3-69d6-4d43-a307-365ddcb8ead7 error during policy execution Traceback (most recent call last): File "/var/task/c7n/handler.py", line 165, in dispatch_event p.push(event, context) File "/var/task/c7n/policy.py", line 1288, in push return mode.run(event, lambda_ctx) File "/var/task/c7n/policy.py", line 487, in run resources = self.resolve_resources(event) File "/var/task/c7n/policy.py", line 691, in resolve_resources return super().resolve_resources(event) File "/var/task/c7n/policy.py", line 469, in resolve_resources resources = self.policy.resource_manager.get_resources(resource_ids) File "/var/task/c7n/query.py", line 576, in get_resources resources = self.source.get_resources(ids) File "/var/task/c7n/query.py", line 227, in get_resources return self.query.get(self.manager, ids) File "/var/task/c7n/query.py", line 100, in get resources = self.filter(resource_manager, **params) File "/var/task/c7n/query.py", line 79, in filter return self._invoke_client_enum( File "/var/task/c7n/query.py", line 60, in _invoke_client_enum data = op(**params) File "/var/runtime/botocore/client.py", line 391, in _api_call return self._make_api_call(operation_name, kwargs) File "/var/runtime/botocore/client.py", line 691, in _make_api_call request_dict = self._convert_to_request_dict( File "/var/runtime/botocore/client.py", line 739, in _convert_to_request_dict request_dict = self._serializer.serialize_to_request( File "/var/runtime/botocore/validate.py", line 360, in serialize_to_request raise ParamValidationError(report=report.generate_report()) botocore.exceptions.ParamValidationError: Parameter validation failed: Missing required parameter in input: "Scope"
-- | --
```


### Extra information or context

The pull mode version of this policy works fine.


Discussion:

Resolving patch:
diff --git a/c7n/resources/waf.py b/c7n/resources/waf.py
--- a/c7n/resources/waf.py
+++ b/c7n/resources/waf.py
@@ -27,6 +27,10 @@ def get_query_params(self, query):
             q = {'Scope': 'REGIONAL'}
         return q
 
+    def get_resources(self, ids):
+        resources = self.query.filter(self.manager, **self.get_query_params(None))
+        return [r for r in resources if r[self.manager.resource_type.id] in ids]
+
 
 @resources.register('waf')
 class WAF(QueryResourceManager):


Test patch:
diff --git a/tests/data/placebo/test_wafv2_resolve_resources/tagging.GetResources_1.json b/tests/data/placebo/test_wafv2_resolve_resources/tagging.GetResources_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_wafv2_resolve_resources/tagging.GetResources_1.json
@@ -0,0 +1,8 @@
+{
+    "status_code": 200,
+    "data": {
+        "PaginationToken": "",
+        "ResourceTagMappingList": [],
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_wafv2_resolve_resources/wafv2.ListWebACLs_1.json b/tests/data/placebo/test_wafv2_resolve_resources/wafv2.ListWebACLs_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_wafv2_resolve_resources/wafv2.ListWebACLs_1.json
@@ -0,0 +1,23 @@
+{
+    "status_code": 200,
+    "data": {
+        "NextMarker": "dont-match-me",
+        "WebACLs": [
+            {
+                "Name": "match-me",
+                "Id": "624e04d2-8b45-45ee-b4ad-e853dac6d070",
+                "Description": "",
+                "LockToken": "ad4ae4ab-aba8-4499-88e9-059d4f9a4c60",
+                "ARN": "arn:aws:wafv2:us-east-2:644160558196:regional/webacl/match-me/624e04d2-8b45-45ee-b4ad-e853dac6d070"
+            },
+            {
+                "Name": "dont-match-me",
+                "Id": "889cae83-d5e5-41e9-bb6f-00ea0f726637",
+                "Description": "",
+                "LockToken": "a33055a6-2e0a-4e5f-aa8c-abe3a5ce26d8",
+                "ARN": "arn:aws:wafv2:us-east-2:644160558196:regional/webacl/dont-match-me/889cae83-d5e5-41e9-bb6f-00ea0f726637"
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/test_waf.py b/tests/test_waf.py
--- a/tests/test_waf.py
+++ b/tests/test_waf.py
@@ -17,6 +17,19 @@ def test_waf_query(self):
         )
         self.assertEqual(resources[0]["DefaultAction"], {"Type": "BLOCK"})
 
+    def test_wafv2_resolve_resources(self):
+        session_factory = self.replay_flight_data(
+            "test_wafv2_resolve_resources",
+            region="us-east-2"
+        )
+        p = self.load_policy(
+            {"name": "wafv2test", "resource": "aws.wafv2"},
+            session_factory=session_factory,
+            config={"region": "us-east-2"}
+        )
+        resources = p.resource_manager.get_resources(["624e04d2-8b45-45ee-b4ad-e853dac6d070"])
+        assert len(resources) == 1
+
     def test_wafv2_logging_configuration(self):
         session_factory = self.replay_flight_data(
             'test_wafv2_logging_configuration')