Repository: cloud-custodian/cloud-custodian

Issue:
unable to report from S3 populated by lambda
I'm unable to run a report from s3 bucket generated with the built in lambda provider. 

Key structure lambda is creating `s3://bucket/policy/year/month/day/hour/resources.json.gz`

From a gitter discussion with @kapilt (thanks for the help). 

> report is looking for year/month/day
> there's a flag for specifying hour though
> but its not exposed afaics

So it looks like `report` doesn't know about the hour key.

Example Policy
```yaml
policies:
  - name: delete-expired-instances
    resource: ec2
    comments: |
      Terminate testing instances older than 2 days
    mode:
      type: periodic
      schedule: "rate(5 minutes)"
      role: arn:aws:iam::xxxxxxx:role/custodian
      execution-options:
        metrics_enabled: false
        output_dir: s3://custodian-reports-eng
    filters:
      - type: instance-age
        days: 2
      - or:
        - "tag:Owner": absent
        - "tag:DoNotDelete": absent
```

Example custodian run with output

```plain
custodian report --profile=eng -t ec2 --region us-east-2 -s s3://custodian-reports-eng --format simple --days=3 --verbose ./custodian.yml 
```


Discussion:
Looks like maybe just reporting to s3 is adding the hour key. Using c7n-org with an s3 target has the same issue.
thats odd, i tried a policy locally and it worked out of the box..

```yaml
policies:

  - name: lambda
    resource: log-group
    mode:
      type: periodic
      schedule: "rate(5 minutes)"
      role: CloudCustodianRole
```

deployed with 
```shell
custodian run -c check.yml -s s3://c7n-test-bucket/lambda-policy -v
```

and reported on with 
```shell
$ custodian report -c check.yml -s s3://c7n-test-bucket/lambda-policy
2019-04-21 15:26:13,359: custodian.reports:INFO Fetched 52 records across 1 files                      
arn,logGroupName,creationTime                                                              
arn:aws:logs:us-east-1:1222111222:log-group:/aws/batch/job:*,/aws/batch/job,1548711324629
arn:aws:logs:us-east-1:1222111222:log-group:/aws/codebuild/custodian-python-2-7:*,/aws/codebuild/custodian-python-2-7,1549026698237
arn:aws:logs:us-east-1:1222111222:log-group:/aws/codebuild/envoy:*,/aws/codebuild/envoy,1550597266971
arn:aws:logs:us-east-1:1222111222:log-group:/aws/lambda/config-events-test-handler:*,/aws/lambda/config-events-test-handler,1531160839189
arn:aws:logs:us-east-1:1222111222:log-group:/aws/lambda/custodian-all-snaps:*,/aws/lambda/custodian-all-snaps,1542309776325
arn:aws:logs:us-east-1:1222111222:log-group:/aws/lambda/custodian-ddb:*,/aws/lambda/custodian-ddb,1548517514561

```
stepping through there's definitely something off on the start marker its got a double date in it.

Resolving patch:
diff --git a/c7n/reports/csvout.py b/c7n/reports/csvout.py
--- a/c7n/reports/csvout.py
+++ b/c7n/reports/csvout.py
@@ -82,8 +82,8 @@ def report(policies, start_date, options, output_fh, raw_output_fh=None):
         if policy.ctx.output.type == 's3':
             policy_records = record_set(
                 policy.session_factory,
-                policy.ctx.output.bucket,
-                policy.ctx.output.key_prefix,
+                policy.ctx.output.config['netloc'],
+                policy.ctx.output.config['path'].strip('/'),
                 start_date)
         else:
             policy_records = fs_record_set(policy.ctx.log_dir, policy.name)
diff --git a/c7n/resources/aws.py b/c7n/resources/aws.py
--- a/c7n/resources/aws.py
+++ b/c7n/resources/aws.py
@@ -397,7 +397,7 @@ def __repr__(self):
 
     def get_output_path(self, output_url):
         if '{' not in output_url:
-            date_path = datetime.datetime.now().strftime('%Y/%m/%d/%H')
+            date_path = datetime.datetime.utcnow().strftime('%Y/%m/%d/%H')
             return self.join(
                 output_url, self.ctx.policy.name, date_path)
         return output_url.format(**self.get_output_vars())


Test patch: