Repository: cloud-custodian/cloud-custodian

Issue:
ungraceful error suspected due to resource type Config does not support currently
The following policy 
```
policies:
  - name: post-ebs-snapshot-public
    resource: ebs-snapshot
    mode:
      type: config-rule
      role: arn:aws:iam::{account_id}:role/CloudCustodian
      packages: [botocore, boto3, urllib3]
    filters:
      - type: cross-account
```
is causing the following error, which I suspect is due to AWS Config not supporting EBS-Snapshots as a resource-type, yet.  Would be nice to get a more graceful error in the meantime.
```
2019-09-08 00:51:14,884: custodian.policy:INFO Provisioning policy lambda post-ebs-snapshot-public
2019-09-08 00:51:26,813: custodian.output:ERROR Error while executing policy
Traceback (most recent call last):
  File "/usr/local/lib/python3.7/site-packages/c7n/policy.py", line 494, in provision
    role=self.policy.options.assume_role)
  File "/usr/local/lib/python3.7/site-packages/c7n/mu.py", line 322, in publish
    if e.add(func):
  File "/usr/local/lib/python3.7/site-packages/c7n/mu.py", line 1556, in add
    return self.client.put_config_rule(ConfigRule=params)
  File "/usr/local/lib/python3.7/site-packages/botocore/client.py", line 357, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/usr/local/lib/python3.7/site-packages/botocore/client.py", line 634, in _make_api_call
    api_params, operation_model, context=request_context)
  File "/usr/local/lib/python3.7/site-packages/botocore/client.py", line 682, in _convert_to_request_dict
    api_params, operation_model)
  File "/usr/local/lib/python3.7/site-packages/botocore/validate.py", line 297, in serialize_to_request
    raise ParamValidationError(report=report.generate_report())
botocore.exceptions.ParamValidationError: Parameter validation failed:
Invalid type for parameter ConfigRule.Scope.ComplianceResourceTypes[0], value: None, type: <class 'NoneType'>, valid types: <class 'str'>
2019-09-08 00:51:26,815: custodian.commands:ERROR Error while executing policy post-ebs-snapshot-public, continuing
```


Discussion:
this should be failing in validation

Resolving patch:
diff --git a/c7n/policy.py b/c7n/policy.py
--- a/c7n/policy.py
+++ b/c7n/policy.py
@@ -700,6 +700,13 @@ class ConfigRuleMode(LambdaMode):
     cfg_event = None
     schema = utils.type_schema('config-rule', rinherit=LambdaMode.schema)
 
+    def validate(self):
+        super(ConfigRuleMode, self).validate()
+        if not self.policy.resource_manager.resource_type.config_type:
+            raise PolicyValidationError(
+                "policy:%s AWS Config does not support resource-type:%s" % (
+                    self.policy.name, self.policy.resource_type))
+
     def resolve_resources(self, event):
         source = self.policy.resource_manager.get_source('config')
         return [source.load_resource(self.cfg_event['configurationItem'])]


Test patch:
diff --git a/tests/test_config.py b/tests/test_config.py
--- a/tests/test_config.py
+++ b/tests/test_config.py
@@ -13,6 +13,7 @@
 # limitations under the License.
 from __future__ import absolute_import, division, print_function, unicode_literals
 
+from c7n.exceptions import PolicyValidationError
 from .common import BaseTest
 
 
@@ -55,6 +56,17 @@ def test_compliance(self):
 
 class ConfigRuleTest(BaseTest):
 
+    def test_validate(self):
+        with self.assertRaises(PolicyValidationError) as ecm:
+            self.load_policy({
+                'name': 'rule',
+                'resource': 'ebs-snapshot',
+                'mode': {
+                    'role': 'arn:aws:iam',
+                    'type': 'config-rule'}})
+        self.assertIn('AWS Config does not support resource-type:ebs-snapshot',
+                      str(ecm.exception))
+
     def test_status(self):
         session_factory = self.replay_flight_data("test_config_rule_status")
         p = self.load_policy(