Repository: cloud-custodian/cloud-custodian

Issue:
AWS GovCloud c7n-org AuthFailure
### Describe the bug

IN GovCloud

Latest Release of c7n/c7n-org
```(tmp) [cloudcustodian@73770be69ed4 ~]$ c7n-org run-script -c tmp.yaml -s workdir/log/ aws sts get-caller-identity
Traceback (most recent call last):
  File "/home/cloudcustodian/tmp/bin/c7n-org", line 8, in <module>
    sys.exit(cli())
  File "/home/cloudcustodian/tmp/lib/python3.8/site-packages/click/core.py", line 1130, in __call__
    return self.main(*args, **kwargs)
  File "/home/cloudcustodian/tmp/lib/python3.8/site-packages/click/core.py", line 1055, in main
    rv = self.invoke(ctx)
  File "/home/cloudcustodian/tmp/lib/python3.8/site-packages/click/core.py", line 1657, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/home/cloudcustodian/tmp/lib/python3.8/site-packages/click/core.py", line 1404, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/home/cloudcustodian/tmp/lib/python3.8/site-packages/click/core.py", line 760, in invoke
    return __callback(*args, **kwargs)
  File "/home/cloudcustodian/tmp/lib/python3.8/site-packages/c7n_org/cli.py", line 508, in run_script
    for r in resolve_regions(region or a.get('regions', ()), a):
  File "/home/cloudcustodian/tmp/lib/python3.8/site-packages/c7n_org/cli.py", line 204, in resolve_regions
    return [region['RegionName'] for region in client.describe_regions()['Regions']]
  File "/home/cloudcustodian/tmp/lib/python3.8/site-packages/botocore/client.py", line 508, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/home/cloudcustodian/tmp/lib/python3.8/site-packages/botocore/client.py", line 915, in _make_api_call
    raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (AuthFailure) when calling the DescribeRegions operation: AWS was not able to validate the provided access credentials
```
Older Version of c7n/c7n-org (0.9.3)
```
(tmp) [cloudcustodian@73770be69ed4 ~]$ deactivate
[cloudcustodian@73770be69ed4 ~]$ c7n-org run-script -c tmp.yaml -s workdir/log/ aws sts get-caller-identity
2022-08-24 16:23:24,757: c7n_org:INFO running script on account:XYZ-tools-prod region:us-gov-west-1 script: `aws sts get-caller-identity`
2022-08-24 16:23:24,758: c7n_org:INFO running script on account:XYZ-tools-prod region:us-gov-east-1 script: `aws sts get-caller-identity`
2022-08-24 16:23:25,372: c7n_org:INFO ran script on account:XYZ-tools-prod region:us-gov-east-1 script: `aws sts get-caller-identity`
2022-08-24 16:23:25,612: c7n_org:INFO ran script on account:XYZ-tools-prod region:us-gov-west-1 script: `aws sts get-caller-identity
```
It does the same thing running policies too - not run-script

Maybe a defined region issue?  Not sure.



### What did you expect to happen?

Expected to auth and run policy/job.

### Cloud Provider

Amazon Web Services (AWS)

### Cloud Custodian version and dependency information

```shell
(tmp) [cloudcustodian@73770be69ed4 ~]$ custodian version --debug

Please copy/paste the following info along with any bug reports:

Custodian:   0.9.18
Python:      3.8.10 (default, May  6 2021, 00:05:59)
             [GCC 10.2.1 20201203]
Platform:    posix.uname_result(sysname='Linux', nodename='73770be69ed4', release='4.14.232-176.381.amzn2.aarch64', version='#1 SMP Wed May 19 00:32:11 UTC 2021', machine='aarch64')
Using venv:  True
Docker: True
Installed:

argcomplete==2.0.0
attrs==22.1.0
boto3==1.24.44
botocore==1.27.44
docutils==0.17.1
importlib-metadata==4.12.0
importlib-resources==5.9.0
jmespath==1.0.1
jsonschema==4.9.0
pkgutil-resolve-name==1.3.10
pyrsistent==0.18.1
python-dateutil==2.8.2
pyyaml==6.0
s3transfer==0.6.0
six==1.16.0
tabulate==0.8.10
typing-extensions==4.3.0
urllib3==1.26.11
zipp==3.8.1
```


### Policy

```shell
accounts:
- account_id: '1234567890'
  name: XYZ-tools-prod
  regions:
  - all
  role: arn:aws-us-gov:iam::1234567890:role/cloudcustodian-gov
  tags:
  - org:XYZGovCloudOrg
```


### Relevant log/traceback output

_No response_

### Extra information or context

_No response_


Discussion:
Should mention this works:
```
(tmp) [cloudcustodian@73770be69ed4 ~]$ c7n-org run-script -c tmp.yaml -s workdir/log/ aws sts get-caller-identity --region us-gov-west-1
2022-08-24 16:35:17,363: c7n_org:INFO running script on account:XYZ-tools-prod region:us-gov-west-1 script: `aws sts get-caller-identity`
2022-08-24 16:35:18,194: c7n_org:INFO ran script on account:XYZ-tools-prod region:us-gov-west-1 script: `aws sts get-caller-identity`

Resolving patch:
diff --git a/tools/c7n_org/c7n_org/cli.py b/tools/c7n_org/c7n_org/cli.py
--- a/tools/c7n_org/c7n_org/cli.py
+++ b/tools/c7n_org/c7n_org/cli.py
@@ -203,11 +203,13 @@ def resolve_regions(regions, account):
             client = session.client('ec2')
             return [region['RegionName'] for region in client.describe_regions()['Regions']]
         except ClientError as e:
-            if e.response['Error']['Code'] == 'AccessDenied':
-                log.warning('access denied listing available regions for account:%s',
-                    account['name'])
-                return []
-            raise
+            err = e.response['Error']
+            if err['Code'] not in ('AccessDenied', 'AuthFailure'):
+                raise
+            log.warning('error (%s) listing available regions for account:%s - %s',
+                err['Code'], account['name'], err['Message']
+            )
+            return []
     if not regions:
         return ('us-east-1', 'us-west-2')
 


Test patch: