Repository: cloud-custodian/cloud-custodian

Issue:
AWS - Lambda Edge Filter
Creating this issue for more visibility/discussion on this PR as suggested: https://github.com/cloud-custodian/cloud-custodian/pull/5999. I'm not sure which approach is the better one.

**Is your feature request related to a problem? Please describe.**
The use case is to enforce specific rules on lambda@edge functions, such as limiting their access to other AWS resources.

**Describe the solution you'd like**
Create a lambda@edge filter, perhaps also creating a new resource type for lambda versions. This is because lambda triggers are unique for each published function version (https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-edge-edit-function.html), and so we would like to be able to filter for the lambda function versions that have cloudfront event triggers.

**Describe alternatives you've considered**
The main alternative would be to consider a lambda function a lambda@edge function if it has at least one version that is lambda@edge. This sacrifices some precision of controls in return for not having to make a new lambda version resource. 




Discussion:
what do you mean by limiting access to other resources? do you have an example policy (filters, actions)? do you mean the iam role in use for the function? the iam access policy for the function spans versions. 
Ah, ok I hadn't realized that. Yes, one use case would be enforcing rules on the iam access policy. The other main use case is we would like to make sure that all lambda functions are run within a VPC (ie their Configuration.VpcConifg is not null). However, lambda@edge functions cannot be placed within a VPC, so they would be exempt from this requirement. 
but thats re use of lambda edge not an argument for versions, thats an argument for a source filter on lambda. exposing versions multiplies needlessly a lot under management. even in the gc versions work which does need to process versions, the goal is to simplify management and expression of that by exposing it on a function.
ok sounds good I'll implement it without exposing version then
I support the enhancement for adding recognition of lambda versions/aliases to ```resource: lambda```. Looking through @Lucas-Irvine 's commits, he had this written but then backed out. 

The use case I encounter can be read in more detail in this issue: https://github.com/cloud-custodian/cloud-custodian/issues/6058

Thanks!

Resolving patch:
diff --git a/c7n/resources/awslambda.py b/c7n/resources/awslambda.py
--- a/c7n/resources/awslambda.py
+++ b/c7n/resources/awslambda.py
@@ -10,7 +10,7 @@
 from datetime import timedelta, datetime
 
 from c7n.actions import Action, RemovePolicyBase, ModifyVpcSecurityGroupsAction
-from c7n.filters import CrossAccountAccessFilter, ValueFilter
+from c7n.filters import CrossAccountAccessFilter, ValueFilter, Filter
 from c7n.filters.kms import KmsRelatedFilter
 import c7n.filters.vpc as net_filters
 from c7n.manager import resources
@@ -799,3 +799,55 @@ def format_resource(self, r):
         payload.update(self.filter_empty(
             select_keys(r, ['Version', 'CreatedDate', 'CompatibleRuntimes'])))
         return envelope
+
+
+@AWSLambda.filter_registry.register('lambda-edge')
+
+class LambdaEdgeFilter(Filter):
+    """
+    Filter for lambda@edge functions. Lambda@edge only exists in us-east-1
+
+    :example:
+
+        .. code-block:: yaml
+
+            policies:
+                - name: lambda-edge-filter
+                  resource: lambda
+                  region: us-east-1
+                  filters:
+                    - type: lambda-edge
+                      state: True
+    """
+    permissions = ('cloudfront:ListDistributions',)
+
+    schema = type_schema('lambda-edge',
+        **{'state': {'type': 'boolean'}})
+
+    def get_lambda_cf_map(self):
+        cfs = self.manager.get_resource_manager('distribution').resources()
+        func_expressions = ('DefaultCacheBehavior.LambdaFunctionAssociations.Items',
+          'CacheBehaviors.LambdaFunctionAssociations.Items')
+        lambda_dist_map = {}
+        for d in cfs:
+            for exp in func_expressions:
+                if jmespath.search(exp, d):
+                    for function in jmespath.search(exp, d):
+                        # Geting rid of the version number in the arn
+                        lambda_edge_arn = ':'.join(function['LambdaFunctionARN'].split(':')[:-1])
+                        lambda_dist_map.setdefault(lambda_edge_arn, []).append(d['Id'])
+        return lambda_dist_map
+
+    def process(self, resources, event=None):
+        results = []
+        if self.manager.config.region != 'us-east-1' and self.data.get('state'):
+            return []
+        annotation_key = 'c7n:DistributionIds'
+        lambda_edge_cf_map = self.get_lambda_cf_map()
+        for r in resources:
+            if (r['FunctionArn'] in lambda_edge_cf_map and self.data.get('state')):
+                r[annotation_key] = lambda_edge_cf_map.get(r['FunctionArn'])
+                results.append(r)
+            elif (r['FunctionArn'] not in lambda_edge_cf_map and not self.data.get('state')):
+                results.append(r)
+        return results


Test patch:
diff --git a/tests/data/placebo/test_aws_lambda_edge_filter/cloudfront.ListDistributions_1.json b/tests/data/placebo/test_aws_lambda_edge_filter/cloudfront.ListDistributions_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_aws_lambda_edge_filter/cloudfront.ListDistributions_1.json
@@ -0,0 +1,348 @@
+{
+    "status_code": 200,
+    "data": {
+        "ResponseMetadata": {},
+        "DistributionList": {
+            "Marker": "",
+            "MaxItems": 100,
+            "IsTruncated": false,
+            "Quantity": 3,
+            "Items": [
+                {
+                    "Id": "E3Q5UC7SQLL7MN",
+                    "ARN": "arn:aws:cloudfront::644160558196:distribution/E3Q5UC7SQLL7MN",
+                    "Status": "Deployed",
+                    "LastModifiedTime": {
+                        "__class__": "datetime",
+                        "year": 2023,
+                        "month": 3,
+                        "day": 15,
+                        "hour": 2,
+                        "minute": 54,
+                        "second": 29,
+                        "microsecond": 196000
+                    },
+                    "DomainName": "d1j7wua3tltg12.cloudfront.net",
+                    "Aliases": {
+                        "Quantity": 0
+                    },
+                    "Origins": {
+                        "Quantity": 1,
+                        "Items": [
+                            {
+                                "Id": "c7n-test-bucket.s3.us-east-1",
+                                "DomainName": "c7n-test-bucket.s3.us-east-1.amazonaws.com",
+                                "OriginPath": "",
+                                "CustomHeaders": {
+                                    "Quantity": 0
+                                },
+                                "S3OriginConfig": {
+                                    "OriginAccessIdentity": ""
+                                },
+                                "ConnectionAttempts": 3,
+                                "ConnectionTimeout": 10,
+                                "OriginShield": {
+                                    "Enabled": false
+                                },
+                                "OriginAccessControlId": ""
+                            }
+                        ]
+                    },
+                    "OriginGroups": {
+                        "Quantity": 0
+                    },
+                    "DefaultCacheBehavior": {
+                        "TargetOriginId": "c7n-test-bucket.s3.us-east-1",
+                        "TrustedSigners": {
+                            "Enabled": false,
+                            "Quantity": 0
+                        },
+                        "TrustedKeyGroups": {
+                            "Enabled": false,
+                            "Quantity": 0
+                        },
+                        "ViewerProtocolPolicy": "allow-all",
+                        "AllowedMethods": {
+                            "Quantity": 2,
+                            "Items": [
+                                "HEAD",
+                                "GET"
+                            ],
+                            "CachedMethods": {
+                                "Quantity": 2,
+                                "Items": [
+                                    "HEAD",
+                                    "GET"
+                                ]
+                            }
+                        },
+                        "SmoothStreaming": false,
+                        "Compress": true,
+                        "LambdaFunctionAssociations": {
+                            "Quantity": 2,
+                            "Items": [
+                                {
+                                    "LambdaFunctionARN": "arn:aws:lambda:us-east-1:644160558196:function:c7n-lambda-edge-new:1",
+                                    "EventType": "origin-response",
+                                    "IncludeBody": false
+                                },
+                                {
+                                    "LambdaFunctionARN": "arn:aws:lambda:us-east-1:644160558196:function:test-lambda-edge:4",
+                                    "EventType": "origin-request",
+                                    "IncludeBody": false
+                                }
+                            ]
+                        },
+                        "FunctionAssociations": {
+                            "Quantity": 0
+                        },
+                        "FieldLevelEncryptionId": "",
+                        "CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6"
+                    },
+                    "CacheBehaviors": {
+                        "Quantity": 0
+                    },
+                    "CustomErrorResponses": {
+                        "Quantity": 0
+                    },
+                    "Comment": "",
+                    "PriceClass": "PriceClass_All",
+                    "Enabled": true,
+                    "ViewerCertificate": {
+                        "CloudFrontDefaultCertificate": true,
+                        "SSLSupportMethod": "vip",
+                        "MinimumProtocolVersion": "TLSv1",
+                        "CertificateSource": "cloudfront"
+                    },
+                    "Restrictions": {
+                        "GeoRestriction": {
+                            "RestrictionType": "none",
+                            "Quantity": 0
+                        }
+                    },
+                    "WebACLId": "",
+                    "HttpVersion": "HTTP2",
+                    "IsIPV6Enabled": true,
+                    "Staging": false
+                },
+                {
+                    "Id": "E2QP4HHF7YEXWR",
+                    "ARN": "arn:aws:cloudfront::644160558196:distribution/E2QP4HHF7YEXWR",
+                    "Status": "Deployed",
+                    "LastModifiedTime": {
+                        "__class__": "datetime",
+                        "year": 2023,
+                        "month": 3,
+                        "day": 15,
+                        "hour": 1,
+                        "minute": 43,
+                        "second": 25,
+                        "microsecond": 541000
+                    },
+                    "DomainName": "d2x3t6o9kdadhj.cloudfront.net",
+                    "Aliases": {
+                        "Quantity": 0
+                    },
+                    "Origins": {
+                        "Quantity": 1,
+                        "Items": [
+                            {
+                                "Id": "c7n-test-1",
+                                "DomainName": "c7n-test-1.s3.amazonaws.com",
+                                "OriginPath": "",
+                                "CustomHeaders": {
+                                    "Quantity": 0
+                                },
+                                "S3OriginConfig": {
+                                    "OriginAccessIdentity": "origin-access-identity/cloudfront/E1HDZBBD47I5Y5"
+                                },
+                                "ConnectionAttempts": 3,
+                                "ConnectionTimeout": 10,
+                                "OriginShield": {
+                                    "Enabled": false
+                                },
+                                "OriginAccessControlId": ""
+                            }
+                        ]
+                    },
+                    "OriginGroups": {
+                        "Quantity": 0
+                    },
+                    "DefaultCacheBehavior": {
+                        "TargetOriginId": "c7n-test-1",
+                        "TrustedSigners": {
+                            "Enabled": false,
+                            "Quantity": 0
+                        },
+                        "TrustedKeyGroups": {
+                            "Enabled": false,
+                            "Quantity": 0
+                        },
+                        "ViewerProtocolPolicy": "allow-all",
+                        "AllowedMethods": {
+                            "Quantity": 2,
+                            "Items": [
+                                "HEAD",
+                                "GET"
+                            ],
+                            "CachedMethods": {
+                                "Quantity": 2,
+                                "Items": [
+                                    "HEAD",
+                                    "GET"
+                                ]
+                            }
+                        },
+                        "SmoothStreaming": false,
+                        "Compress": false,
+                        "LambdaFunctionAssociations": {
+                            "Quantity": 1,
+                            "Items": [
+                                {
+                                    "LambdaFunctionARN": "arn:aws:lambda:us-east-1:644160558196:function:test-lambda-edge:4",
+                                    "EventType": "origin-request",
+                                    "IncludeBody": false
+                                }
+                            ]
+                        },
+                        "FunctionAssociations": {
+                            "Quantity": 0
+                        },
+                        "FieldLevelEncryptionId": "",
+                        "CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6"
+                    },
+                    "CacheBehaviors": {
+                        "Quantity": 0
+                    },
+                    "CustomErrorResponses": {
+                        "Quantity": 0
+                    },
+                    "Comment": "",
+                    "PriceClass": "PriceClass_All",
+                    "Enabled": true,
+                    "ViewerCertificate": {
+                        "CloudFrontDefaultCertificate": true,
+                        "SSLSupportMethod": "vip",
+                        "MinimumProtocolVersion": "TLSv1",
+                        "CertificateSource": "cloudfront"
+                    },
+                    "Restrictions": {
+                        "GeoRestriction": {
+                            "RestrictionType": "none",
+                            "Quantity": 0
+                        }
+                    },
+                    "WebACLId": "",
+                    "HttpVersion": "HTTP2",
+                    "IsIPV6Enabled": false,
+                    "Staging": false
+                },
+                {
+                    "Id": "E2NVTXSLAPXV0T",
+                    "ARN": "arn:aws:cloudfront::644160558196:distribution/E2NVTXSLAPXV0T",
+                    "Status": "Deployed",
+                    "LastModifiedTime": {
+                        "__class__": "datetime",
+                        "year": 2023,
+                        "month": 3,
+                        "day": 15,
+                        "hour": 3,
+                        "minute": 55,
+                        "second": 50,
+                        "microsecond": 247000
+                    },
+                    "DomainName": "d2cg08xod0stfk.cloudfront.net",
+                    "Aliases": {
+                        "Quantity": 0
+                    },
+                    "Origins": {
+                        "Quantity": 1,
+                        "Items": [
+                            {
+                                "Id": "c7n-test-1",
+                                "DomainName": "c7n-test-1.s3.amazonaws.com",
+                                "OriginPath": "",
+                                "CustomHeaders": {
+                                    "Quantity": 0
+                                },
+                                "S3OriginConfig": {
+                                    "OriginAccessIdentity": "origin-access-identity/cloudfront/E2ANG29K5NUNI4"
+                                },
+                                "ConnectionAttempts": 3,
+                                "ConnectionTimeout": 10,
+                                "OriginShield": {
+                                    "Enabled": false
+                                },
+                                "OriginAccessControlId": ""
+                            }
+                        ]
+                    },
+                    "OriginGroups": {
+                        "Quantity": 0
+                    },
+                    "DefaultCacheBehavior": {
+                        "TargetOriginId": "c7n-test-1",
+                        "TrustedSigners": {
+                            "Enabled": false,
+                            "Quantity": 0
+                        },
+                        "TrustedKeyGroups": {
+                            "Enabled": false,
+                            "Quantity": 0
+                        },
+                        "ViewerProtocolPolicy": "allow-all",
+                        "AllowedMethods": {
+                            "Quantity": 2,
+                            "Items": [
+                                "HEAD",
+                                "GET"
+                            ],
+                            "CachedMethods": {
+                                "Quantity": 2,
+                                "Items": [
+                                    "HEAD",
+                                    "GET"
+                                ]
+                            }
+                        },
+                        "SmoothStreaming": false,
+                        "Compress": true,
+                        "LambdaFunctionAssociations": {
+                            "Quantity": 0
+                        },
+                        "FunctionAssociations": {
+                            "Quantity": 0
+                        },
+                        "FieldLevelEncryptionId": "",
+                        "CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6"
+                    },
+                    "CacheBehaviors": {
+                        "Quantity": 0
+                    },
+                    "CustomErrorResponses": {
+                        "Quantity": 0
+                    },
+                    "Comment": "",
+                    "PriceClass": "PriceClass_All",
+                    "Enabled": true,
+                    "ViewerCertificate": {
+                        "CloudFrontDefaultCertificate": true,
+                        "SSLSupportMethod": "vip",
+                        "MinimumProtocolVersion": "TLSv1",
+                        "CertificateSource": "cloudfront"
+                    },
+                    "Restrictions": {
+                        "GeoRestriction": {
+                            "RestrictionType": "none",
+                            "Quantity": 0
+                        }
+                    },
+                    "WebACLId": "",
+                    "HttpVersion": "HTTP2",
+                    "IsIPV6Enabled": true,
+                    "Staging": false
+                }
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_aws_lambda_edge_filter/lambda.ListFunctions_1.json b/tests/data/placebo/test_aws_lambda_edge_filter/lambda.ListFunctions_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_aws_lambda_edge_filter/lambda.ListFunctions_1.json
@@ -0,0 +1,129 @@
+{
+    "status_code": 200,
+    "data": {
+        "ResponseMetadata": {},
+        "Functions": [
+            {
+                "FunctionName": "test-pratyush",
+                "FunctionArn": "arn:aws:lambda:us-east-1:644160558196:function:test-pratyush",
+                "Runtime": "python3.9",
+                "Role": "arn:aws:iam::644160558196:role/service-role/test-pratyush-role-z8t69erp",
+                "Handler": "lambda_function.lambda_handler",
+                "CodeSize": 230,
+                "Description": "",
+                "Timeout": 3,
+                "MemorySize": 128,
+                "LastModified": "2023-02-10T16:16:05.606+0000",
+                "CodeSha256": "qyaQA4CyfLv6R5+dxMlaZ1qpDSOWxK9C5H/O3OKt+vA=",
+                "Version": "$LATEST",
+                "TracingConfig": {
+                    "Mode": "PassThrough"
+                },
+                "RevisionId": "b3cdc8b9-425c-4999-bba7-ac4ae4725150",
+                "PackageType": "Zip",
+                "Architectures": [
+                    "x86_64"
+                ],
+                "EphemeralStorage": {
+                    "Size": 512
+                },
+                "SnapStart": {
+                    "ApplyOn": "None",
+                    "OptimizationStatus": "Off"
+                }
+            },
+            {
+                "FunctionName": "c7n-lambda-edge-new",
+                "FunctionArn": "arn:aws:lambda:us-east-1:644160558196:function:c7n-lambda-edge-new",
+                "Runtime": "nodejs14.x",
+                "Role": "arn:aws:iam::644160558196:role/CloudCustodianRole",
+                "Handler": "index.handler",
+                "CodeSize": 363,
+                "Description": "Blueprint for returning HTTP redirect implemented in NodeJS.",
+                "Timeout": 1,
+                "MemorySize": 128,
+                "LastModified": "2023-03-15T02:54:09.007+0000",
+                "CodeSha256": "fCqpzRP6ghfnxzr+XQlJxD3DOQPFM6mG/oMVGus7KF8=",
+                "Version": "$LATEST",
+                "TracingConfig": {
+                    "Mode": "PassThrough"
+                },
+                "RevisionId": "601d1e93-bd8e-49a2-9e29-2dbc0f21dae7",
+                "PackageType": "Zip",
+                "Architectures": [
+                    "x86_64"
+                ],
+                "EphemeralStorage": {
+                    "Size": 512
+                },
+                "SnapStart": {
+                    "ApplyOn": "None",
+                    "OptimizationStatus": "Off"
+                }
+            },
+            {
+                "FunctionName": "test-python",
+                "FunctionArn": "arn:aws:lambda:us-east-1:644160558196:function:test-python",
+                "Runtime": "python3.8",
+                "Role": "arn:aws:iam::644160558196:role/BrentTestCustodianRole",
+                "Handler": "lambda_function.lambda_handler",
+                "CodeSize": 300,
+                "Description": "",
+                "Timeout": 3,
+                "MemorySize": 128,
+                "LastModified": "2022-11-22T19:10:35.342+0000",
+                "CodeSha256": "YILsaYMROYwZjWFweT4yJ6tPf40OwvI9jKdrfshdVuA=",
+                "Version": "$LATEST",
+                "VpcConfig": {
+                    "SubnetIds": [],
+                    "SecurityGroupIds": [],
+                    "VpcId": ""
+                },
+                "TracingConfig": {
+                    "Mode": "PassThrough"
+                },
+                "RevisionId": "f19c21cc-46ad-46d0-b5d9-38b25ade22d5",
+                "PackageType": "Zip",
+                "Architectures": [
+                    "x86_64"
+                ],
+                "EphemeralStorage": {
+                    "Size": 512
+                },
+                "SnapStart": {
+                    "ApplyOn": "None",
+                    "OptimizationStatus": "Off"
+                }
+            },
+            {
+                "FunctionName": "test-lambda-edge",
+                "FunctionArn": "arn:aws:lambda:us-east-1:644160558196:function:test-lambda-edge",
+                "Runtime": "nodejs14.x",
+                "Role": "arn:aws:iam::644160558196:role/CloudCustodianRole",
+                "Handler": "index.handler",
+                "CodeSize": 389,
+                "Description": "Blueprint for modifying CloudFront response header implemented in NodeJS.",
+                "Timeout": 1,
+                "MemorySize": 128,
+                "LastModified": "2023-03-15T01:20:54.053+0000",
+                "CodeSha256": "PRrkU1iZ2meuOdge3XCeQPebrEknjcZlEEMBbMAT70g=",
+                "Version": "$LATEST",
+                "TracingConfig": {
+                    "Mode": "PassThrough"
+                },
+                "RevisionId": "7e0c0cd4-45ec-4b9a-a33f-bf2e18d22cbc",
+                "PackageType": "Zip",
+                "Architectures": [
+                    "x86_64"
+                ],
+                "EphemeralStorage": {
+                    "Size": 512
+                },
+                "SnapStart": {
+                    "ApplyOn": "None",
+                    "OptimizationStatus": "Off"
+                }
+            }
+        ]
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_aws_lambda_edge_filter/tagging.GetResources_1.json b/tests/data/placebo/test_aws_lambda_edge_filter/tagging.GetResources_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_aws_lambda_edge_filter/tagging.GetResources_1.json
@@ -0,0 +1,57 @@
+{
+    "status_code": 200,
+    "data": {
+        "PaginationToken": "",
+        "ResourceTagMappingList": [
+            {
+                "ResourceARN": "arn:aws:lambda:us-east-1:644160558196:function:test-pratyush",
+                "Tags": [
+                    {
+                        "Key": "7ps:signature",
+                        "Value": "xyz"
+                    },
+                    {
+                        "Key": "bogie:gears:signature",
+                        "Value": "abc"
+                    },
+                    {
+                        "Key": "c7n-timestamp",
+                        "Value": "2022-11-22 19:10:34.442479"
+                    }
+                ]
+            },
+            {
+                "ResourceARN": "arn:aws:lambda:us-east-1:644160558196:function:c7n-lambda-edge-new",
+                "Tags": [
+                    {
+                        "Key": "lambda-console:blueprint",
+                        "Value": "cloudfront-http-redirect"
+                    }
+                ]
+            },
+            {
+                "ResourceARN": "arn:aws:lambda:us-east-1:644160558196:function:test-python",
+                "Tags": [
+                    {
+                        "Key": "c7n:FindingId:lambda-force-vulnerabilities",
+                        "Value": "us-east-1/644160558196/a045b52dbdf3f1601befc59dd0c8526f/a317aa172505e9805fb207a8b22c1e72:2022-04-12T14:37:06.132664+00:00"
+                    },
+                    {
+                        "Key": "c7n-timestamp",
+                        "Value": "2022-11-22 19:10:34.442479"
+                    }
+                ]
+            },
+            {
+                "ResourceARN": "arn:aws:lambda:us-east-1:644160558196:function:test-lambda-edge",
+                "Tags": [
+                    {
+                        "Key": "lambda-console:blueprint",
+                        "Value": "cloudfront-modify-response-header"
+                    }
+                ]
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_aws_lambda_edge_filter/tagging.GetResources_2.json b/tests/data/placebo/test_aws_lambda_edge_filter/tagging.GetResources_2.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_aws_lambda_edge_filter/tagging.GetResources_2.json
@@ -0,0 +1,8 @@
+{
+    "status_code": 200,
+    "data": {
+        "PaginationToken": "",
+        "ResourceTagMappingList": [],
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/test_lambda.py b/tests/test_lambda.py
--- a/tests/test_lambda.py
+++ b/tests/test_lambda.py
@@ -451,6 +451,23 @@ def test_set_xray_tracing_false(self):
             FunctionName=resources[0]['FunctionName'])
         self.assertEqual(response['Configuration']['TracingConfig']['Mode'], 'PassThrough')
 
+    def test_lambda_edge(self):
+        factory = self.replay_flight_data("test_aws_lambda_edge_filter")
+        p = self.load_policy(
+            {
+                "name": "lambda-edge-filter",
+                "resource": "lambda",
+                "filters": [{"type": "lambda-edge",
+                            "state": True}],
+            },
+            session_factory=factory,
+        )
+        resources = p.run()
+        self.assertEqual(len(resources), 2)
+        self.assertEqual(
+            [r["FunctionName"] for r in resources],
+            ["c7n-lambda-edge-new", "test-lambda-edge"])
+
 
 class LambdaTagTest(BaseTest):