Repository: cloud-custodian/cloud-custodian

Issue:
[aws.ebs.action.copy-related-tag] Copy all tags from ec2 fails because 'aws:' are reserved for internal use
**Describe the bug**
`aws.ebs.action.copy-related-tag` throws `botocore.exceptions.ClientError`, `InvalidParameterValue` when attempting to copy _all_ tags from the related instance to the ebs volume. 

See https://github.com/cloud-custodian/cloud-custodian/blob/63121e9273ceb5fbe04338520835c2964a6cef24/c7n/tags.py#L1062

**To Reproduce**
Steps to reproduce the behavior: 

1. Copy/paste the policy from below
2. Run: `custodian run --verbose --region us-east-1 -p aws-copy-tags-from-instance-to-ebs-volume -s . [policy-from-below].yml`
3. See the error: `botocore.exceptions.ClientError: An error occurred (InvalidParameterValue) when calling the CreateTags operation: Value ( aws:autoscaling:groupName ) for parameter key is invalid. Tag keys starting with 'aws:' are reserved for internal use`

**Expected behavior**
All extant tags from the instance beginning with `aws:` should cause the [for loop](https://github.com/cloud-custodian/cloud-custodian/blob/1f618b3f530be64cfda02ae1f8143e02d46262ed/c7n/resources/ebs.py#L887) to continue (skip the tag and go to the next one).


**Background (please complete the following information):**
 - OS: Ubuntu 18.04.4 LTS
 - Python Version: Python 3.8.3
 - Custodian Version: 0.9.4
 - Cloud Provider: aws
 - Policy:
```yaml
policies: 
  - name: aws-copy-tags-from-instance-to-ebs-volume
    description: Copy tags from an instance to its associated ebs volume(s).
    resource: aws.ebs
    filters:
        - type: value
          key: Attachments[0].Device
          value: not-null
    actions:
        - type: copy-related-tag
          resource: ec2
          skip_missing: True
          key: Attachments[].InstanceId | [0]
          tags: '*'
```
 - Traceback: https://gist.github.com/gshel/a06f0202f4e87e9a5b3e6951f9f6dc8a
 - `custodian version --debug` output:
```
Please copy/paste the following info along with any bug reports:

Custodian:   0.9.4
Python:      3.8.3 (default, May 14 2020, 20:11:43) 
             [GCC 7.5.0]
Platform:    posix.uname_result(sysname='Linux', nodename='123456.corp.myjob.com', release='4.15.0-111-generic', version='#112-Ubuntu SMP Thu Jul 9 20:32:34 UTC 2020', machine='x86_64')
Using venv:  False
Docker: False
Installed: 

argcomplete==1.11.1
attrs==19.3.0
boto3==1.13.24
botocore==1.16.24
docutils==0.15.2
importlib-metadata==1.6.1
jmespath==0.10.0
jsonschema==3.2.0
pyrsistent==0.16.0
python-dateutil==2.8.1
pyyaml==5.3.1
s3transfer==0.3.3
setuptools==39.0.1
six==1.15.0
tabulate==0.8.7
urllib3==1.25.9
zipp==3.1.0
```

**Additional context**
Brought up in gitter.



Discussion:

Resolving patch:
diff --git a/c7n/tags.py b/c7n/tags.py
--- a/c7n/tags.py
+++ b/c7n/tags.py
@@ -1060,7 +1060,7 @@ def process_resource(self, client, r, related_tags, tag_keys, tag_action):
 
         if tag_keys == '*':
             tags = {k: v for k, v in related_tags.items()
-                    if resource_tags.get(k) != v}
+                    if resource_tags.get(k) != v and not k.startswith('aws:')}
         else:
             tags = {k: v for k, v in related_tags.items()
                     if k in tag_keys and resource_tags.get(k) != v}


Test patch: