Repository: cloud-custodian/cloud-custodian

Issue:
c7n policy deployed as lambda crash
Hello, we recently deployed a c7n policy as a lambda yesterday and are seeing a crash every time we try to run the policy lambda:

```
[ERROR] NameError: name 'BaseSafeDumper' is not defined
Traceback (most recent call last):
  File "/var/lang/lib/python3.7/imp.py", line 234, in load_module
    return load_source(name, filename, file)
  File "/var/lang/lib/python3.7/imp.py", line 171, in load_source
    module = _load(spec)
  File "<frozen importlib._bootstrap>", line 696, in _load
  File "<frozen importlib._bootstrap>", line 677, in _load_unlocked
  File "<frozen importlib._bootstrap_external>", line 728, in exec_module
  File "<frozen importlib._bootstrap>", line 219, in _call_with_frames_removed
  File "/var/task/custodian_policy.py", line 1, in <module>
    from c7n import handler
  File "/var/task/c7n/handler.py", line 27, in <module>
    from c7n.policy import PolicyCollection
  File "/var/task/c7n/policy.py", line 29, in <module>
    from c7n.ctx import ExecutionContext
  File "/var/task/c7n/ctx.py", line 21, in <module>
    from c7n.output import (
  File "/var/task/c7n/output.py", line 36, in <module>
    from c7n.utils import parse_url_config
  File "/var/task/c7n/utils.py", line 52, in <module>
    if BaseSafeDumper:
```

We are using `c7n-org` docker image to deploy policies in our CI/CD pipeline and it looks like it only has the `latest` tag. I looked back through recent changes to this project and found [this](https://github.com/cloud-custodian/cloud-custodian/commit/873d19c775789c7a88cef4ed7e91183e6e727692#diff-e88bdc0ba2a4a183a43a33610a91530e) commit 2 days ago that seems to have added a possibly related bug.

For reference here is our policy (redacted for our ARN's):
```
policies:
  - name: aws-cis-1-16
    description: Ensure IAM policies are attached only to groups or roles
    tags: [nonprod]
    resource: iam-user
    region: us-east-1
    filters:
      - type: policy
        key: PolicyName
        value: "*"
        op: glob
      - type: value
        key: "tag:soc-exception-evaluation"
        value: "1.16"
        op: not-equal
    actions:
      - type: notify
        to:
          - contact
        transport:
          type: sqs
          queue: "{notify_queue_arn}"
      - type: delete
        options:
          - attached-user-policies
          - inline-user-policies
    mode:
      type: periodic
      schedule: "rate(1 day)"
      role: <redacted>
```

Here is the full command we use to deploy this policy using `c7n-org`:
```
c7n-org run --config accounts.yml --tags nonprod --policytags nonprod --output-dir ./output --use $MERGED_POLICIES
```

We don't seem to see the crash when we run custodian or c7n-org locally (we drop the `mode` policy key in our pipeline in branches) and the policy executes as we expect. I can see the `version.py` in the lambda has `0.8.43.1` but that is only the latest tag on master currently and i can still see the commit i referenced above in the `utils.py` in the lambda as well.


Discussion:

Resolving patch:
diff --git a/c7n/utils.py b/c7n/utils.py
--- a/c7n/utils.py
+++ b/c7n/utils.py
@@ -35,6 +35,9 @@
 
 # Try to place nice in lambda exec environment
 # where we don't require yaml
+
+BaseSafeDumper = None
+
 try:
     import yaml
 except ImportError:  # pragma: no cover


Test patch: