Repository: cloud-custodian/cloud-custodian

Issue:
Assumed role not being passed into lambda config
Getting this error on trunk:

```
2018-10-19 01:10:12,112: custodian.output:ERROR Error while executing policy
Traceback (most recent call last):
File "/src/c7n/policy.py", line 494, in provision
role=self.policy.options.assume_role)
File "/src/c7n/mu.py", line 283, in publish
func, role, s3_uri, qualifier=alias)
File "/src/c7n/mu.py", line 427, in _create_or_update
result = self.client.update_function_configuration(**new_config)
File "/usr/local/lib/python2.7/site-packages/botocore/client.py", line 320, in _api_call
return self._make_api_call(operation_name, kwargs)
File "/usr/local/lib/python2.7/site-packages/botocore/client.py", line 623, in _make_api_call
raise error_class(parsed_response, operation_name)
ClientError: An error occurred (ValidationException) when calling the UpdateFunctionConfiguration operation: 1 validation error detected: Value '' at 'role' failed to satisfy constraint: Member must satisfy regular expression pattern: arn:(aws[a-zA-Z-]*)?:iam::\d{12}:role/?[a-zA-Z_0-9+=,.@\-_/]+
```

Related to this change: https://github.com/capitalone/cloud-custodian/commit/e012885d86cd5492a364bfa4b50750515e32a97e#diff-3b6d052df3306ec5a910d7c6055b0e57L417


Discussion:
specifically this is using custodian being run with lambda policy with role automatically provided per the assume role value i think?

Resolving patch:
diff --git a/c7n/mu.py b/c7n/mu.py
--- a/c7n/mu.py
+++ b/c7n/mu.py
@@ -418,6 +418,7 @@ def _create_or_update(self, func, role=None, s3_uri=None, qualifier=None):
             # after configuration change?
 
             new_config = func.get_config()
+            new_config['Role'] = role
             new_tags = new_config.pop('Tags', {})
 
             config_changed = self.delta_function(old_config, new_config)
@@ -436,11 +437,11 @@ def _create_or_update(self, func, role=None, s3_uri=None, qualifier=None):
             tags_to_add, tags_to_remove = self.diff_tags(old_tags, new_tags)
 
             if tags_to_add:
-                log.debug("Adding/updating tags: %s config" % func.name)
+                log.debug("Updating function tags: %s" % func.name)
                 self.client.tag_resource(
                     Resource=base_arn, Tags=tags_to_add)
             if tags_to_remove:
-                log.debug("Removing tags: %s config" % func.name)
+                log.debug("Removing function stale tags: %s" % func.name)
                 self.client.untag_resource(
                     Resource=base_arn, TagKeys=tags_to_remove)
 


Test patch:
diff --git a/tests/test_mu.py b/tests/test_mu.py
--- a/tests/test_mu.py
+++ b/tests/test_mu.py
@@ -312,7 +312,7 @@ def test_cwe_update_config_and_code(self):
         lines = output.getvalue().strip().split("\n")
         self.assertTrue("Updating function custodian-s3-bucket-policy code" in lines)
         self.assertTrue(
-            "Updating function: custodian-s3-bucket-policy config MemorySize, Role" in lines)
+            "Updating function: custodian-s3-bucket-policy config MemorySize" in lines)
         self.assertEqual(result["FunctionName"], result2["FunctionName"])
         # drive by coverage
         functions = [