Repository: cloud-custodian/cloud-custodian

Issue:
aws - cloudhsm-cluster policies failing in event mode 
### Describe the bug

When running a cloudhsm cluster policy in event mode, there's a traceback that pops up. I suspect it's happening due to an api change on the AWS side. 

### What did you expect to happen?

I expected 2 + 2 to equal 4, but instead 2 + 2 equaled 6!

### Cloud Provider

Amazon Web Services (AWS)

### Cloud Custodian version and dependency information

_No response_

### Policy

```shell
policies:
- name: cldhsmclstr-subnet-test-event
  resource: aws.cloudhsm-cluster
  mode:
    type: cloudtrail
    events:
    - event: CreateCluster
      ids: responseElements.cluster.clusterId
      source: cloudhsm.amazonaws.com
  filters:
  - type: subnet
    key: tag:abc
    op: ne
    value: 'xyz'
```


### Relevant log/traceback output

```shell
[ERROR] ParamValidationError: Parameter validation failed:
Invalid type for parameter Filters, value: cluster-qsxzbw5t4aw, type: <class 'str'>, valid types: <class 'dict'>
Traceback (most recent call last):
  File "/var/task/custodian_policy.py", line 4, in run
    return handler.dispatch_event(event, context)
  File "/var/task/c7n/handler.py", line 165, in dispatch_event
    p.push(event, context)
  File "/var/task/c7n/policy.py", line 1288, in push
    return mode.run(event, lambda_ctx)
  File "/var/task/c7n/policy.py", line 487, in run
    resources = self.resolve_resources(event)
  File "/var/task/c7n/policy.py", line 691, in resolve_resources
    return super().resolve_resources(event)
  File "/var/task/c7n/policy.py", line 469, in resolve_resources
    resources = self.policy.resource_manager.get_resources(resource_ids)
  File "/var/task/c7n/query.py", line 576, in get_resources
    resources = self.source.get_resources(ids)
  File "/var/task/c7n/query.py", line 227, in get_resources
    return self.query.get(self.manager, ids)
  File "/var/task/c7n/query.py", line 100, in get
    resources = self.filter(resource_manager, **params)
  File "/var/task/c7n/query.py", line 79, in filter
    return self._invoke_client_enum(
  File "/var/task/c7n/query.py", line 57, in _invoke_client_enum
    data = results.build_full_result()
  File "/var/runtime/botocore/paginate.py", line 451, in build_full_result
    for response in self:
  File "/var/runtime/botocore/paginate.py", line 255, in __iter__
    response = self._make_request(current_kwargs)
  File "/var/task/c7n/query.py", line 761, in _make_request
    return self.retry(self._method, **current_kwargs)
  File "/var/task/c7n/utils.py", line 448, in _retry
    return func(*args, **kw)
  File "/var/runtime/botocore/client.py", line 391, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/var/runtime/botocore/client.py", line 691, in _make_api_call
    request_dict = self._convert_to_request_dict(
  File "/var/runtime/botocore/client.py", line 739, in _convert_to_request_dict
    request_dict = self._serializer.serialize_to_request(
  File "/var/runtime/botocore/validate.py", line 360, in serialize_to_request
    raise ParamValidationError(report=report.generate_report())
```


### Extra information or context

_No response_

Discussion:
PratMis: Thanks for taking a look @thisisshi 


Patch:
diff --git a/c7n/resources/hsm.py b/c7n/resources/hsm.py
index fa7dfbc77..55f3a6d2a 100644
--- a/c7n/resources/hsm.py
+++ b/c7n/resources/hsm.py
@@ -2,13 +2,27 @@
 # SPDX-License-Identifier: Apache-2.0
 from c7n.exceptions import ClientError
 from c7n.manager import resources
-from c7n.query import QueryResourceManager, TypeInfo
-from c7n.tags import universal_augment
+from c7n.query import QueryResourceManager, TypeInfo, DescribeSource
 import c7n.filters.vpc as net_filters
 from c7n.actions import BaseAction
 from c7n.utils import local_session, type_schema
 
 
+class DescribeCloudHSMCluster(DescribeSource):
+
+    def get_resources(self, resource_ids, cache=True):
+        client = local_session(self.manager.session_factory).client('cloudhsmv2')
+        return self.manager.retry(
+            client.describe_clusters,
+            Filters={
+                'clusterIds': resource_ids}).get('Clusters', ())
+
+    def augment(self, resources):
+        for r in resources:
+            r['Tags'] = r.pop('TagList', ())
+        return resources
+
+
 @resources.register('cloudhsm-cluster')
 class CloudHSMCluster(QueryResourceManager):
 
@@ -18,11 +32,11 @@ class CloudHSMCluster(QueryResourceManager):
         permission_prefix = arn_service = 'cloudhsm'
         enum_spec = ('describe_clusters', 'Clusters', None)
         id = name = 'ClusterId'
-        filter_name = 'Filters'
-        filter_type = 'scalar'
         universal_taggable = object()
 
-    augment = universal_augment
+    source_mapping = {
+        'describe': DescribeCloudHSMCluster
+    }
 
 
 @CloudHSMCluster.filter_registry.register('subnet')


Test patch:
diff --git a/tests/data/cwe/event-cloud-trail-hsm-create-cluster.json b/tests/data/cwe/event-cloud-trail-hsm-create-cluster.json
new file mode 100644
index 000000000..b8a6118eb
--- /dev/null
+++ b/tests/data/cwe/event-cloud-trail-hsm-create-cluster.json
@@ -0,0 +1,69 @@
+{
+    "eventVersion": "1.08",
+    "userIdentity": {
+        "type": "IAMUser",
+        "arn": "arn:aws:iam::644160558196:user/pratyush.mishra@capitalone.com",
+        "accountId": "644160558196",
+        "userName": "pratyush.mishra@capitalone.com",
+        "sessionContext": {
+            "sessionIssuer": {},
+            "webIdFederationData": {},
+            "attributes": {
+                "creationDate": "2022-11-15T18:17:16Z",
+                "mfaAuthenticated": "false"
+            }
+        }
+    },
+    "eventTime": "2022-11-15T18:49:20Z",
+    "eventSource": "cloudhsm.amazonaws.com",
+    "eventName": "CreateCluster",
+    "awsRegion": "us-east-1",
+    "sourceIPAddress": "204.63.43.37",
+    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36",
+    "requestParameters": {
+        "backupRetentionPolicy": {
+            "type": "DAYS",
+            "value": "90"
+        },
+        "hsmType": "hsm1.medium",
+        "subnetIds": [
+            "subnet-07c118e47bb84cee7"
+        ],
+        "tagList": [
+            {
+                "key": "Owner",
+                "value": "test"
+            }
+        ]
+    },
+    "responseElements": {
+        "cluster": {
+            "backupPolicy": "DEFAULT",
+            "backupRetentionPolicy": {
+                "type": "DAYS",
+                "value": "90"
+            },
+            "clusterId": "cluster-dqf7m6ithhc",
+            "createTimestamp": "Nov 15, 2022, 6:49:20 PM",
+            "hsms": [],
+            "hsmType": "hsm1.medium",
+            "state": "CREATE_IN_PROGRESS",
+            "subnetMapping": {
+                "us-east-1a": "subnet-07c118e47bb84cee7"
+            },
+            "vpcId": "vpc-03005fb9b8740263d",
+            "certificates": {}
+        }
+    },
+    "requestID": "ef53d5d7-d422-4692-8f18-d8a1a9644543",
+    "eventID": "afeaa423-04ce-4fc5-9d12-03fb508dff1d",
+    "readOnly": false,
+    "eventType": "AwsApiCall",
+    "managementEvent": true,
+    "recipientAccountId": "644160558196",
+    "eventCategory": "Management",
+    "tlsDetails": {
+        "clientProvidedHostHeader": "cloudhsmv2.us-east-1.amazonaws.com"
+    },
+    "sessionCredentialFromConsole": "true"
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_cloudhsm_cluster_tag_event/cloudhsmv2.DescribeClusters_1.json b/tests/data/placebo/test_cloudhsm_cluster_tag_event/cloudhsmv2.DescribeClusters_1.json
new file mode 100644
index 000000000..2349f5b90
--- /dev/null
+++ b/tests/data/placebo/test_cloudhsm_cluster_tag_event/cloudhsmv2.DescribeClusters_1.json
@@ -0,0 +1,41 @@
+{
+    "status_code": 200,
+    "data": {
+        "Clusters": [
+            {
+                "BackupPolicy": "DEFAULT",
+                "BackupRetentionPolicy": {
+                    "Type": "DAYS",
+                    "Value": "90"
+                },
+                "ClusterId": "cluster-dqf7m6ithhc",
+                "CreateTimestamp": {
+                    "__class__": "datetime",
+                    "year": 2022,
+                    "month": 11,
+                    "day": 15,
+                    "hour": 10,
+                    "minute": 49,
+                    "second": 20,
+                    "microsecond": 314000
+                },
+                "Hsms": [],
+                "HsmType": "hsm1.medium",
+                "SecurityGroup": "sg-0d402886a1b75282a",
+                "State": "UNINITIALIZED",
+                "SubnetMapping": {
+                    "us-east-1a": "subnet-07c118e47bb84cee7"
+                },
+                "VpcId": "vpc-03005fb9b8740263d",
+                "Certificates": {},
+                "TagList": [
+                    {
+                        "Key": "Owner",
+                        "Value": "test"
+                    }
+                ]
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_cloudhsm_subnet_delete/cloudhsmv2.DeleteCluster_1.json b/tests/data/placebo/test_cloudhsm_subnet_delete/cloudhsmv2.DeleteCluster_1.json
index b10069634..04cc5b7d3 100644
--- a/tests/data/placebo/test_cloudhsm_subnet_delete/cloudhsmv2.DeleteCluster_1.json
+++ b/tests/data/placebo/test_cloudhsm_subnet_delete/cloudhsmv2.DeleteCluster_1.json
@@ -3,20 +3,24 @@
     "data": {
         "Cluster": {
             "BackupPolicy": "DEFAULT",
-            "ClusterId": "cluster-pqczsunscng",
+            "BackupRetentionPolicy": {
+                "Type": "DAYS",
+                "Value": "90"
+            },
+            "ClusterId": "cluster-mrq6aozbe5s",
             "CreateTimestamp": {
                 "__class__": "datetime",
-                "year": 2020,
-                "month": 8,
-                "day": 25,
-                "hour": 15,
-                "minute": 42,
-                "second": 28,
-                "microsecond": 583000
+                "year": 2022,
+                "month": 11,
+                "day": 15,
+                "hour": 10,
+                "minute": 30,
+                "second": 15,
+                "microsecond": 468000
             },
             "Hsms": [],
             "HsmType": "hsm1.medium",
-            "SecurityGroup": "sg-0883c648cb9c52db2",
+            "SecurityGroup": "sg-0e3c27dfc7ba4648d",
             "State": "DELETE_IN_PROGRESS",
             "StateMessage": "The cluster is being deleted.",
             "SubnetMapping": {
diff --git a/tests/data/placebo/test_cloudhsm_subnet_delete/cloudhsmv2.DescribeClusters_1.json b/tests/data/placebo/test_cloudhsm_subnet_delete/cloudhsmv2.DescribeClusters_1.json
index c4b737b39..a56e13923 100644
--- a/tests/data/placebo/test_cloudhsm_subnet_delete/cloudhsmv2.DescribeClusters_1.json
+++ b/tests/data/placebo/test_cloudhsm_subnet_delete/cloudhsmv2.DescribeClusters_1.json
@@ -4,20 +4,58 @@
         "Clusters": [
             {
                 "BackupPolicy": "DEFAULT",
-                "ClusterId": "cluster-pqczsunscng",
+                "BackupRetentionPolicy": {
+                    "Type": "DAYS",
+                    "Value": "90"
+                },
+                "ClusterId": "cluster-jz56hthw75g",
+                "CreateTimestamp": {
+                    "__class__": "datetime",
+                    "year": 2022,
+                    "month": 11,
+                    "day": 15,
+                    "hour": 10,
+                    "minute": 20,
+                    "second": 17,
+                    "microsecond": 344000
+                },
+                "Hsms": [],
+                "HsmType": "hsm1.medium",
+                "SecurityGroup": "sg-0aa06bb977e3b2661",
+                "State": "UNINITIALIZED",
+                "SubnetMapping": {
+                    "us-east-1a": "subnet-083ab4dd1a8b6eaa6",
+                    "us-east-1b": "subnet-0544e30702e2e1ad4"
+                },
+                "VpcId": "vpc-0598080981e0332f9",
+                "Certificates": {},
+                "TagList": [
+                    {
+                        "Key": "c7n",
+                        "Value": "test"
+                    }
+                ]
+            },
+            {
+                "BackupPolicy": "DEFAULT",
+                "BackupRetentionPolicy": {
+                    "Type": "DAYS",
+                    "Value": "90"
+                },
+                "ClusterId": "cluster-mrq6aozbe5s",
                 "CreateTimestamp": {
                     "__class__": "datetime",
-                    "year": 2020,
-                    "month": 8,
-                    "day": 25,
-                    "hour": 15,
-                    "minute": 42,
-                    "second": 28,
-                    "microsecond": 583000
+                    "year": 2022,
+                    "month": 11,
+                    "day": 15,
+                    "hour": 10,
+                    "minute": 30,
+                    "second": 15,
+                    "microsecond": 468000
                 },
                 "Hsms": [],
                 "HsmType": "hsm1.medium",
-                "SecurityGroup": "sg-0883c648cb9c52db2",
+                "SecurityGroup": "sg-0e3c27dfc7ba4648d",
                 "State": "UNINITIALIZED",
                 "SubnetMapping": {
                     "us-east-1a": "subnet-914763e7"
diff --git a/tests/data/placebo/test_cloudhsm_subnet_delete/cloudhsmv2.DescribeClusters_2.json b/tests/data/placebo/test_cloudhsm_subnet_delete/cloudhsmv2.DescribeClusters_2.json
index 41233698c..4fffe164f 100644
--- a/tests/data/placebo/test_cloudhsm_subnet_delete/cloudhsmv2.DescribeClusters_2.json
+++ b/tests/data/placebo/test_cloudhsm_subnet_delete/cloudhsmv2.DescribeClusters_2.json
@@ -4,20 +4,24 @@
         "Clusters": [
             {
                 "BackupPolicy": "DEFAULT",
-                "ClusterId": "cluster-pqczsunscng",
+                "BackupRetentionPolicy": {
+                    "Type": "DAYS",
+                    "Value": "90"
+                },
+                "ClusterId": "cluster-mrq6aozbe5s",
                 "CreateTimestamp": {
                     "__class__": "datetime",
-                    "year": 2020,
-                    "month": 8,
-                    "day": 25,
-                    "hour": 15,
-                    "minute": 42,
-                    "second": 28,
-                    "microsecond": 583000
+                    "year": 2022,
+                    "month": 11,
+                    "day": 15,
+                    "hour": 10,
+                    "minute": 30,
+                    "second": 15,
+                    "microsecond": 468000
                 },
                 "Hsms": [],
                 "HsmType": "hsm1.medium",
-                "SecurityGroup": "sg-0883c648cb9c52db2",
+                "SecurityGroup": "sg-0e3c27dfc7ba4648d",
                 "State": "DELETED",
                 "SubnetMapping": {
                     "us-east-1a": "subnet-914763e7"
diff --git a/tests/data/placebo/test_cloudhsm_subnet_delete/ec2.DescribeSubnets_1.json b/tests/data/placebo/test_cloudhsm_subnet_delete/ec2.DescribeSubnets_1.json
index 66be37a80..5ad77fc89 100644
--- a/tests/data/placebo/test_cloudhsm_subnet_delete/ec2.DescribeSubnets_1.json
+++ b/tests/data/placebo/test_cloudhsm_subnet_delete/ec2.DescribeSubnets_1.json
@@ -5,10 +5,72 @@
             {
                 "AvailabilityZone": "us-east-1a",
                 "AvailabilityZoneId": "use1-az4",
-                "AvailableIpAddressCount": 4088,
+                "AvailableIpAddressCount": 250,
+                "CidrBlock": "172.16.1.0/24",
+                "DefaultForAz": false,
+                "MapPublicIpOnLaunch": false,
+                "MapCustomerOwnedIpOnLaunch": false,
+                "State": "available",
+                "SubnetId": "subnet-083ab4dd1a8b6eaa6",
+                "VpcId": "vpc-0598080981e0332f9",
+                "OwnerId": "644160558196",
+                "AssignIpv6AddressOnCreation": false,
+                "Ipv6CidrBlockAssociationSet": [],
+                "Tags": [
+                    {
+                        "Key": "AWSServiceAccount",
+                        "Value": "644160558196"
+                    }
+                ],
+                "SubnetArn": "arn:aws:ec2:us-east-1:644160558196:subnet/subnet-083ab4dd1a8b6eaa6",
+                "EnableDns64": false,
+                "Ipv6Native": false,
+                "PrivateDnsNameOptionsOnLaunch": {
+                    "HostnameType": "ip-name",
+                    "EnableResourceNameDnsARecord": false,
+                    "EnableResourceNameDnsAAAARecord": false
+                }
+            },
+            {
+                "AvailabilityZone": "us-east-1b",
+                "AvailabilityZoneId": "use1-az6",
+                "AvailableIpAddressCount": 250,
+                "CidrBlock": "172.16.0.0/24",
+                "DefaultForAz": false,
+                "MapPublicIpOnLaunch": false,
+                "MapCustomerOwnedIpOnLaunch": false,
+                "State": "available",
+                "SubnetId": "subnet-0544e30702e2e1ad4",
+                "VpcId": "vpc-0598080981e0332f9",
+                "OwnerId": "644160558196",
+                "AssignIpv6AddressOnCreation": false,
+                "Ipv6CidrBlockAssociationSet": [],
+                "Tags": [
+                    {
+                        "Key": "AWSServiceAccount",
+                        "Value": "644160558196"
+                    },
+                    {
+                        "Key": "c7n",
+                        "Value": "pratyush"
+                    }
+                ],
+                "SubnetArn": "arn:aws:ec2:us-east-1:644160558196:subnet/subnet-0544e30702e2e1ad4",
+                "EnableDns64": false,
+                "Ipv6Native": false,
+                "PrivateDnsNameOptionsOnLaunch": {
+                    "HostnameType": "ip-name",
+                    "EnableResourceNameDnsARecord": false,
+                    "EnableResourceNameDnsAAAARecord": false
+                }
+            },
+            {
+                "AvailabilityZone": "us-east-1a",
+                "AvailabilityZoneId": "use1-az4",
+                "AvailableIpAddressCount": 4089,
                 "CidrBlock": "172.31.0.0/20",
                 "DefaultForAz": true,
-                "MapPublicIpOnLaunch": true,
+                "MapPublicIpOnLaunch": false,
                 "MapCustomerOwnedIpOnLaunch": false,
                 "State": "available",
                 "SubnetId": "subnet-914763e7",
@@ -20,9 +82,20 @@
                     {
                         "Key": "NetworkLocation",
                         "Value": "Public"
+                    },
+                    {
+                        "Key": "TestTag",
+                        "Value": "TestValue"
                     }
                 ],
-                "SubnetArn": "arn:aws:ec2:us-east-1:644160558196:subnet/subnet-914763e7"
+                "SubnetArn": "arn:aws:ec2:us-east-1:644160558196:subnet/subnet-914763e7",
+                "EnableDns64": false,
+                "Ipv6Native": false,
+                "PrivateDnsNameOptionsOnLaunch": {
+                    "HostnameType": "ip-name",
+                    "EnableResourceNameDnsARecord": false,
+                    "EnableResourceNameDnsAAAARecord": false
+                }
             }
         ],
         "ResponseMetadata": {}
diff --git a/tests/data/placebo/test_cloudhsm_subnet_delete/tagging.GetResources_1.json b/tests/data/placebo/test_cloudhsm_subnet_delete/tagging.GetResources_1.json
deleted file mode 100644
index 8b704d185..000000000
--- a/tests/data/placebo/test_cloudhsm_subnet_delete/tagging.GetResources_1.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-    "status_code": 200,
-    "data": {
-        "PaginationToken": "",
-        "ResourceTagMappingList": [],
-        "ResponseMetadata": {}
-    }
-}
\ No newline at end of file
diff --git a/tests/data/placebo/test_cloudhsm_tag/cloudhsmv2.DescribeClusters_1.json b/tests/data/placebo/test_cloudhsm_tag/cloudhsmv2.DescribeClusters_1.json
index 8979d976b..9cb974b2b 100644
--- a/tests/data/placebo/test_cloudhsm_tag/cloudhsmv2.DescribeClusters_1.json
+++ b/tests/data/placebo/test_cloudhsm_tag/cloudhsmv2.DescribeClusters_1.json
@@ -4,27 +4,66 @@
         "Clusters": [
             {
                 "BackupPolicy": "DEFAULT",
-                "ClusterId": "cluster-remd5qbjj6l",
+                "BackupRetentionPolicy": {
+                    "Type": "DAYS",
+                    "Value": "90"
+                },
+                "ClusterId": "cluster-jz56hthw75g",
                 "CreateTimestamp": {
                     "__class__": "datetime",
-                    "year": 2020,
-                    "month": 9,
-                    "day": 7,
-                    "hour": 16,
-                    "minute": 36,
-                    "second": 28,
-                    "microsecond": 179000
+                    "year": 2022,
+                    "month": 11,
+                    "day": 15,
+                    "hour": 10,
+                    "minute": 20,
+                    "second": 17,
+                    "microsecond": 344000
                 },
                 "Hsms": [],
                 "HsmType": "hsm1.medium",
-                "SecurityGroup": "sg-08e64d28891c7b9c9",
+                "SecurityGroup": "sg-0aa06bb977e3b2661",
                 "State": "UNINITIALIZED",
                 "SubnetMapping": {
-                    "us-east-1a": "subnet-914763e7"
+                    "us-east-1a": "subnet-083ab4dd1a8b6eaa6",
+                    "us-east-1b": "subnet-0544e30702e2e1ad4"
                 },
-                "VpcId": "vpc-d2d616b5",
+                "VpcId": "vpc-0598080981e0332f9",
                 "Certificates": {},
                 "TagList": []
+            },
+            {
+                "BackupPolicy": "DEFAULT",
+                "BackupRetentionPolicy": {
+                    "Type": "DAYS",
+                    "Value": "90"
+                },
+                "ClusterId": "cluster-psujwvuqolq",
+                "CreateTimestamp": {
+                    "__class__": "datetime",
+                    "year": 2022,
+                    "month": 11,
+                    "day": 15,
+                    "hour": 10,
+                    "minute": 19,
+                    "second": 59,
+                    "microsecond": 437000
+                },
+                "Hsms": [],
+                "HsmType": "hsm1.medium",
+                "SecurityGroup": "sg-0e644358d811186c4",
+                "State": "UNINITIALIZED",
+                "SubnetMapping": {
+                    "us-east-1a": "subnet-914763e7",
+                    "us-east-1b": "subnet-efbcccb7"
+                },
+                "VpcId": "vpc-d2d616b5",
+                "Certificates": {},
+                "TagList": [
+                    {
+                        "Key": "c7n",
+                        "Value": "tag"
+                    }
+                ]
             }
         ],
         "ResponseMetadata": {}
diff --git a/tests/data/placebo/test_cloudhsm_tag/tagging.GetResources_1.json b/tests/data/placebo/test_cloudhsm_tag/tagging.GetResources_1.json
deleted file mode 100644
index d5ade3b88..000000000
--- a/tests/data/placebo/test_cloudhsm_tag/tagging.GetResources_1.json
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-    "status_code": 200,
-    "data": {
-        "PaginationToken": "",
-        "ResourceTagMappingList": [
-            {
-                "ResourceARN": "arn:aws:cloudhsm:us-east-1:644160558196:cluster/cluster-remd5qbjj6l",
-                "Tags": []
-            }
-        ],
-        "ResponseMetadata": {}
-    }
-}
\ No newline at end of file
diff --git a/tests/test_hsm.py b/tests/test_hsm.py
index cfb0031b3..a967c744e 100644
--- a/tests/test_hsm.py
+++ b/tests/test_hsm.py
@@ -1,6 +1,6 @@
 # Copyright The Cloud Custodian Authors.
 # SPDX-License-Identifier: Apache-2.0
-from .common import BaseTest
+from .common import BaseTest, event_data
 import time
 
 
@@ -51,12 +51,12 @@ class CloudHSMClusterTest(BaseTest):
         )
         resources = p.run()
         self.assertEqual(len(resources), 1)
-        self.assertEqual(resources[0].get('ClusterId'), 'cluster-pqczsunscng')
+        self.assertEqual(resources[0].get('ClusterId'), 'cluster-mrq6aozbe5s')
         self.assertEqual(resources[0].get('SubnetMapping'), {"us-east-1a": "subnet-914763e7"})
         if self.recording:
             time.sleep(25)
         self.assertEqual(
-            client.describe_clusters(Filters={'clusterIds': ['cluster-pqczsunscng']}).get(
+            client.describe_clusters(Filters={'clusterIds': ['cluster-mrq6aozbe5s']}).get(
                 'Clusters')[0].get('State'), 'DELETED')
 
     def test_cloudhsm_tag(self):
@@ -77,3 +77,26 @@ class CloudHSMClusterTest(BaseTest):
         tags = client.list_tags(ResourceId=id)
         tag_map = {t["Key"]: t["Value"] for t in tags["TagList"]}
         self.assertTrue("c7n" in tag_map)
+
+    def test_cloudhsm_cluster_tag_event(self):
+        factory = self.replay_flight_data("test_cloudhsm_cluster_tag_event")
+        policy = self.load_policy(
+            {
+                "name": "cloudhsm-cluster-tag-event",
+                "resource": "aws.cloudhsm-cluster",
+                "mode": {"type": "cloudtrail", "events": [{
+                    "source": "cloudhsm.amazonaws.com",
+                    "ids": "responseElements.cluster.clusterId",
+                    "event": "CreateCluster"
+                }]},
+                "filters": [{"type": "value", "key": "tag:Owner", "value": "test"}]
+            },
+            session_factory=factory,
+        )
+        event = {
+            "detail": event_data("event-cloud-trail-hsm-create-cluster.json"),
+            "debug": True,
+        }
+        resources = policy.push(event)
+        self.assertEqual(len(resources), 1)
+        self.assertEqual(resources[0].get('Tags'), [{"Key": "Owner", "Value": "test"}])