Repository: cloud-custodian/cloud-custodian

Issue:
OpsCenterInvalidArgumentException: Filter 'OperationalDataValue': 'f0612cbe18a5cb0656de3835738431c4' - length of the value must be between 4 and 20
post-item is currently broken.  The AWS API side is throwing an exception indicating one of the filter parameters must be under 20 characters while on 2019-08-10T03:07:28Z the same Cloud Custodian Policy worked, and the OpsItem is still viewable is my account.  Please assess if Cloud Custodian logic can be changed to have a dedup value under 20 characters or if you think it's worth pushing back on the API for throwing a breaking change.

```
{
    "eventVersion": "1.05",
    "userIdentity": {
        "type": "AssumedRole",
        "principalId": "AROATS2TOV7TA3LL4BETM:custodian-PostOpsItem",
        "arn": "arn:aws:sts::246598774758:assumed-role/CloudCustodian/custodian-PostOpsItem",
        "accountId": "246598774758",
        "accessKeyId": "ASIATS2TOV7TEXQRYW56",
        "sessionContext": {
            "sessionIssuer": {
                "type": "Role",
                "principalId": "AROATS2TOV7TA3LL4BETM",
                "arn": "arn:aws:iam::246598774758:role/CloudCustodian",
                "accountId": "246598774758",
                "userName": "CloudCustodian"
            },
            "webIdFederationData": {},
            "attributes": {
                "mfaAuthenticated": "false",
                "creationDate": "2019-11-04T07:41:58Z"
            }
        }
    },
    "eventTime": "2019-11-04T07:50:03Z",
    "eventSource": "ssm.amazonaws.com",
    "eventName": "DescribeOpsItems",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "3.230.119.174",
    "userAgent": "CloudCustodian(PostOpsItem)/0.8.45.1 Python/3.7.4 Linux/4.14.133-97.112.amzn2.x86_64 exec-env/AWS_Lambda_python3.7 Botocore/1.13.7",
    "errorCode": "OpsCenterInvalidArgumentException",
    "errorMessage": "Filter 'OperationalDataValue': 'f0612cbe18a5cb0656de3835738431c4' - length of the value must be between 4 and 20.",
    "requestParameters": {
        "opsItemFilters": [
            {
                "key": "OperationalDataValue",
                "values": [
                    "f0612cbe18a5cb0656de3835738431c4"
                ],
                "operator": "Contains"
            },
            {
                "key": "OperationalDataKey",
                "values": [
                    "/custodian/dedup"
                ],
                "operator": "Equal"
            },
            {
                "key": "Status",
                "values": [
                    "Open"
                ],
                "operator": "Equal"
            },
            {
                "key": "Source",
                "values": [
                    "Cloud Custodian"
                ],
                "operator": "Equal"
            }
        ]
    },
    "responseElements": null,
    "requestID": "64bcf342-0a38-405f-9146-4af3eb6a74cb",
    "eventID": "bbd55b82-a0d6-4141-8d65-86f2021ffa57",
    "eventType": "AwsApiCall",
    "recipientAccountId": "246598774758"
}
```
policy:
```
  - name: PostOpsItem
    description: Posts an Item to Systems Manager OpsCenter 
    resource: ec2
    mode:
        type: hub-action
        role: arn:aws:iam::{account_id}:role/CloudCustodian
        memory: 128
        packages: [botocore, boto3, urllib3]
        tags:
          CostCenter: SecurityHubWorkshop
          CreatedBy: CloudCustodian
    actions: 
      - type: post-item
        priority: 3

```


Discussion:

Resolving patch:
diff --git a/c7n/resources/ssm.py b/c7n/resources/ssm.py
--- a/c7n/resources/ssm.py
+++ b/c7n/resources/ssm.py
@@ -546,7 +546,8 @@ def get_item_template(self):
             self.manager.type,
             self.manager.config.region,
             self.manager.config.account_id)).encode('utf8')
-        dedup = hashlib.md5(dedup).hexdigest()
+        # size restrictions on this value is 4-20, digest is 32
+        dedup = hashlib.md5(dedup).hexdigest()[:20]
 
         i = dict(
             Title=title,


Test patch: