Repository: cloud-custodian/cloud-custodian

Issue:
aws - set-vpc-flow log support create log group if not exists
For enabling VPC flow-logs through Custodian, If the LogGroup doesn't exist Custodian should create a LogGroup before enabling VPC flow-logs.

Discussion:
PratMis: Thanks for the feedback @kapilt , I'll address all your comments today
PratMis: Codecov/patch was failing, hence I added a new policy to the existing test which records `ResourceAlreadyExistsException` 

Patch:
diff --git a/c7n/resources/emr.py b/c7n/resources/emr.py
index dafd6ef5f..ab2f9ce2d 100644
--- a/c7n/resources/emr.py
+++ b/c7n/resources/emr.py
@@ -13,6 +13,7 @@
 # limitations under the License.
 import logging
 import time
+import json
 
 import six
 
@@ -284,3 +285,41 @@ class QueryFilter:
             value = [self.value]
 
         return {'Name': self.key, 'Values': value}
+
+
+@resources.register('emr-security-configuration')
+class EMRSecurityConfiguration(QueryResourceManager):
+    """Resource manager for EMR Security Configuration
+    """
+
+    class resource_type(TypeInfo):
+        service = 'emr'
+        arn_type = 'emr'
+        permission_prefix = 'elasticmapreduce'
+        enum_spec = ('list_security_configurations', 'SecurityConfigurations', None)
+        detail_spec = ('describe_security_configuration', 'Name', 'Name', None)
+        id = name = 'Name'
+
+    permissions = ('elasticmapreduce:ListSecurityConfigurations',
+                  'elasticmapreduce:DescribeSecurityConfiguration',)
+
+    def augment(self, resources):
+        resources = super().augment(resources)
+        for r in resources:
+            r['SecurityConfiguration'] = json.loads(r['SecurityConfiguration'])
+        return resources
+
+
+@EMRSecurityConfiguration.action_registry.register('delete')
+class DeleteEMRSecurityConfiguration(BaseAction):
+
+    schema = type_schema('delete')
+    permissions = ('elasticmapreduce:DeleteSecurityConfiguration',)
+
+    def process(self, resources):
+        client = local_session(self.manager.session_factory).client('emr')
+        for r in resources:
+            try:
+                client.delete_security_configuration(Name=r['Name'])
+            except client.exceptions.EntityNotFoundException:
+                continue
diff --git a/c7n/resources/resource_map.py b/c7n/resources/resource_map.py
index a1e508407..2a56519dd 100644
--- a/c7n/resources/resource_map.py
+++ b/c7n/resources/resource_map.py
@@ -55,6 +55,7 @@ ResourceMap = {
     "aws.elasticsearch": "c7n.resources.elasticsearch.ElasticSearchDomain",
     "aws.elb": "c7n.resources.elb.ELB",
     "aws.emr": "c7n.resources.emr.EMRCluster",
+    "aws.emr-security-configuration": "c7n.resources.emr.EMRSecurityConfiguration",
     "aws.eni": "c7n.resources.vpc.NetworkInterface",
     "aws.event-rule": "c7n.resources.cw.EventRule",
     "aws.event-rule-target": "c7n.resources.cw.EventRuleTarget",
diff --git a/c7n/resources/vpc.py b/c7n/resources/vpc.py
index e2a9cc27c..71dcc564e 100644
--- a/c7n/resources/vpc.py
+++ b/c7n/resources/vpc.py
@@ -2200,7 +2200,7 @@ class CreateFlowLogs(BaseAction):
                 DeliverLogsPermissionArn: arn:iam:role
                 LogGroupName: /custodian/vpc/flowlogs/
     """
-    permissions = ('ec2:CreateFlowLogs',)
+    permissions = ('ec2:CreateFlowLogs', 'logs:CreateLogGroup',)
     schema = {
         'type': 'object',
         'additionalProperties': False,
@@ -2297,7 +2297,8 @@ class CreateFlowLogs(BaseAction):
         params['ResourceType'] = self.RESOURCE_ALIAS[model.arn_type]
         params['TrafficType'] = self.data.get('TrafficType', 'ALL').upper()
         params['MaxAggregationInterval'] = self.data.get('MaxAggregationInterval', 600)
-
+        if self.data.get('LogDestinationType', 'cloud-watch-logs') == 'cloud-watch-logs':
+            self.process_log_group(self.data.get('LogGroupName'))
         try:
             results = client.create_flow_logs(**params)
 
@@ -2312,3 +2313,10 @@ class CreateFlowLogs(BaseAction):
                     e.response['Error']['Message'])
             else:
                 raise
+
+    def process_log_group(self, logroup):
+        client = local_session(self.manager.session_factory).client('logs')
+        try:
+            client.create_log_group(logGroupName=logroup)
+        except client.exceptions.ResourceAlreadyExistsException:
+            pass


Test patch:
diff --git a/tests/data/placebo/test_emr_security_configuration/elasticmapreduce.DescribeSecurityConfiguration_1.json b/tests/data/placebo/test_emr_security_configuration/elasticmapreduce.DescribeSecurityConfiguration_1.json
new file mode 100644
index 000000000..312fa3416
--- /dev/null
+++ b/tests/data/placebo/test_emr_security_configuration/elasticmapreduce.DescribeSecurityConfiguration_1.json
@@ -0,0 +1,9 @@
+{
+    "status_code": 200,
+    "data": {
+        "Name": "test",
+        "SecurityConfiguration": "{\"EncryptionConfiguration\":{\"EnableInTransitEncryption\":false,\"EnableAtRestEncryption\":false}}",
+        "CreationDateTime": "2020-04-21T00:26:08.759000-04:00",
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_emr_security_configuration/elasticmapreduce.ListSecurityConfigurations_1.json b/tests/data/placebo/test_emr_security_configuration/elasticmapreduce.ListSecurityConfigurations_1.json
new file mode 100644
index 000000000..d50703038
--- /dev/null
+++ b/tests/data/placebo/test_emr_security_configuration/elasticmapreduce.ListSecurityConfigurations_1.json
@@ -0,0 +1,12 @@
+{
+    "status_code": 200,
+    "data": {
+        "SecurityConfigurations": [
+            {
+                "Name": "test",
+                "CreationDateTime": "2020-04-21T00:26:08.759000-04:00"
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_emr_security_configuration_delete/elasticmapreduce.DeleteSecurityConfiguration_1.json b/tests/data/placebo/test_emr_security_configuration_delete/elasticmapreduce.DeleteSecurityConfiguration_1.json
new file mode 100644
index 000000000..5b2170a07
--- /dev/null
+++ b/tests/data/placebo/test_emr_security_configuration_delete/elasticmapreduce.DeleteSecurityConfiguration_1.json
@@ -0,0 +1,6 @@
+{
+    "status_code": 200,
+    "data": {
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_emr_security_configuration_delete/elasticmapreduce.DescribeSecurityConfiguration_1.json b/tests/data/placebo/test_emr_security_configuration_delete/elasticmapreduce.DescribeSecurityConfiguration_1.json
new file mode 100644
index 000000000..312fa3416
--- /dev/null
+++ b/tests/data/placebo/test_emr_security_configuration_delete/elasticmapreduce.DescribeSecurityConfiguration_1.json
@@ -0,0 +1,9 @@
+{
+    "status_code": 200,
+    "data": {
+        "Name": "test",
+        "SecurityConfiguration": "{\"EncryptionConfiguration\":{\"EnableInTransitEncryption\":false,\"EnableAtRestEncryption\":false}}",
+        "CreationDateTime": "2020-04-21T00:26:08.759000-04:00",
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_emr_security_configuration_delete/elasticmapreduce.ListSecurityConfigurations_1.json b/tests/data/placebo/test_emr_security_configuration_delete/elasticmapreduce.ListSecurityConfigurations_1.json
new file mode 100644
index 000000000..d50703038
--- /dev/null
+++ b/tests/data/placebo/test_emr_security_configuration_delete/elasticmapreduce.ListSecurityConfigurations_1.json
@@ -0,0 +1,12 @@
+{
+    "status_code": 200,
+    "data": {
+        "SecurityConfigurations": [
+            {
+                "Name": "test",
+                "CreationDateTime": "2020-04-21T00:26:08.759000-04:00"
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_emr_security_configuration_delete/elasticmapreduce.ListSecurityConfigurations_2.json b/tests/data/placebo/test_emr_security_configuration_delete/elasticmapreduce.ListSecurityConfigurations_2.json
new file mode 100644
index 000000000..30814c7b1
--- /dev/null
+++ b/tests/data/placebo/test_emr_security_configuration_delete/elasticmapreduce.ListSecurityConfigurations_2.json
@@ -0,0 +1,7 @@
+{
+    "status_code": 200,
+    "data": {
+        "SecurityConfigurations": [],
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_vpc_create_flow_logs/ec2.CreateFlowLogs_1.json b/tests/data/placebo/test_vpc_create_flow_logs/ec2.CreateFlowLogs_1.json
index 36eebc958..df7ff1126 100644
--- a/tests/data/placebo/test_vpc_create_flow_logs/ec2.CreateFlowLogs_1.json
+++ b/tests/data/placebo/test_vpc_create_flow_logs/ec2.CreateFlowLogs_1.json
@@ -1,22 +1,11 @@
 {
-    "status_code": 200, 
+    "status_code": 200,
     "data": {
-        "Unsuccessful": [], 
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "f1bbb838-5fed-41bc-832f-9ec5b65cc34f", 
-            "HTTPHeaders": {
-                "transfer-encoding": "chunked", 
-                "vary": "Accept-Encoding", 
-                "server": "AmazonEC2", 
-                "content-type": "text/xml;charset=UTF-8", 
-                "date": "Fri, 06 Apr 2018 16:51:45 GMT"
-            }
-        }, 
+        "ClientToken": "6zPNON5jQ9rEuL4pDVwzJlm70HqAQcYDkaOEHQr9gos=",
         "FlowLogIds": [
-            "fl-f076b299"
-        ], 
-        "ClientToken": "zc3APQuNTpR/2VUebosuWy3DOrWJhkyq7pcWIVGeKkc="
+            "fl-041cdc74dc6435446"
+        ],
+        "Unsuccessful": [],
+        "ResponseMetadata": {}
     }
 }
\ No newline at end of file
diff --git a/tests/data/placebo/test_vpc_create_flow_logs/ec2.CreateFlowLogs_2.json b/tests/data/placebo/test_vpc_create_flow_logs/ec2.CreateFlowLogs_2.json
new file mode 100644
index 000000000..9165c511d
--- /dev/null
+++ b/tests/data/placebo/test_vpc_create_flow_logs/ec2.CreateFlowLogs_2.json
@@ -0,0 +1,11 @@
+{
+    "status_code": 200,
+    "data": {
+        "ClientToken": "JuutuXS0nHXAfsQ1lOWaMAL6+tpqT5mqHMnEGPdD90I=",
+        "FlowLogIds": [
+            "fl-0c28f7d7b5cd29477"
+        ],
+        "Unsuccessful": [],
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_vpc_create_flow_logs/ec2.DescribeFlowLogs_1.json b/tests/data/placebo/test_vpc_create_flow_logs/ec2.DescribeFlowLogs_1.json
index be05be388..eeb65125b 100644
--- a/tests/data/placebo/test_vpc_create_flow_logs/ec2.DescribeFlowLogs_1.json
+++ b/tests/data/placebo/test_vpc_create_flow_logs/ec2.DescribeFlowLogs_1.json
@@ -1,18 +1,7 @@
 {
-    "status_code": 200, 
+    "status_code": 200,
     "data": {
-        "FlowLogs": [], 
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "a0cd7ea9-229e-4d62-9ab9-fbb6793c95e6", 
-            "HTTPHeaders": {
-                "transfer-encoding": "chunked", 
-                "vary": "Accept-Encoding", 
-                "server": "AmazonEC2", 
-                "content-type": "text/xml;charset=UTF-8", 
-                "date": "Fri, 06 Apr 2018 16:51:44 GMT"
-            }
-        }
+        "FlowLogs": [],
+        "ResponseMetadata": {}
     }
 }
\ No newline at end of file
diff --git a/tests/data/placebo/test_vpc_create_flow_logs/ec2.DescribeFlowLogs_2.json b/tests/data/placebo/test_vpc_create_flow_logs/ec2.DescribeFlowLogs_2.json
index cc37c1a43..3eea8c26a 100644
--- a/tests/data/placebo/test_vpc_create_flow_logs/ec2.DescribeFlowLogs_2.json
+++ b/tests/data/placebo/test_vpc_create_flow_logs/ec2.DescribeFlowLogs_2.json
@@ -1,37 +1,31 @@
 {
-    "status_code": 200, 
+    "status_code": 200,
     "data": {
         "FlowLogs": [
             {
-                "ResourceId": "vpc-7af45101", 
                 "CreationTime": {
-                    "hour": 16, 
-                    "__class__": "datetime", 
-                    "month": 4, 
-                    "second": 46, 
-                    "microsecond": 20000, 
-                    "year": 2018, 
-                    "day": 6, 
-                    "minute": 51
-                }, 
-                "LogGroupName": "/custodian/vpc_logs/", 
-                "TrafficType": "ALL", 
-                "FlowLogStatus": "ACTIVE", 
-                "FlowLogId": "fl-f076b299", 
-                "DeliverLogsPermissionArn": "arn:aws:iam::644160558196:role/flowlogsRole"
+                    "__class__": "datetime",
+                    "year": 2020,
+                    "month": 4,
+                    "day": 27,
+                    "hour": 4,
+                    "minute": 33,
+                    "second": 16,
+                    "microsecond": 30000
+                },
+                "DeliverLogsPermissionArn": "arn:aws:iam::644160558196:role/flowlogsRole",
+                "DeliverLogsStatus": "SUCCESS",
+                "FlowLogId": "fl-041cdc74dc6435446",
+                "FlowLogStatus": "ACTIVE",
+                "LogGroupName": "/custodian/vpc_log/",
+                "ResourceId": "vpc-d2d616b5",
+                "TrafficType": "ALL",
+                "LogDestinationType": "cloud-watch-logs",
+                "LogFormat": "${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status}",
+                "Tags": [],
+                "MaxAggregationInterval": 600
             }
-        ], 
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "844aacb9-04d2-42de-b5db-9cb92b5f2793", 
-            "HTTPHeaders": {
-                "transfer-encoding": "chunked", 
-                "vary": "Accept-Encoding", 
-                "server": "AmazonEC2", 
-                "content-type": "text/xml;charset=UTF-8", 
-                "date": "Fri, 06 Apr 2018 16:51:46 GMT"
-            }
-        }
+        ],
+        "ResponseMetadata": {}
     }
 }
\ No newline at end of file
diff --git a/tests/data/placebo/test_vpc_create_flow_logs/ec2.DescribeFlowLogs_3.json b/tests/data/placebo/test_vpc_create_flow_logs/ec2.DescribeFlowLogs_3.json
new file mode 100644
index 000000000..3eea8c26a
--- /dev/null
+++ b/tests/data/placebo/test_vpc_create_flow_logs/ec2.DescribeFlowLogs_3.json
@@ -0,0 +1,31 @@
+{
+    "status_code": 200,
+    "data": {
+        "FlowLogs": [
+            {
+                "CreationTime": {
+                    "__class__": "datetime",
+                    "year": 2020,
+                    "month": 4,
+                    "day": 27,
+                    "hour": 4,
+                    "minute": 33,
+                    "second": 16,
+                    "microsecond": 30000
+                },
+                "DeliverLogsPermissionArn": "arn:aws:iam::644160558196:role/flowlogsRole",
+                "DeliverLogsStatus": "SUCCESS",
+                "FlowLogId": "fl-041cdc74dc6435446",
+                "FlowLogStatus": "ACTIVE",
+                "LogGroupName": "/custodian/vpc_log/",
+                "ResourceId": "vpc-d2d616b5",
+                "TrafficType": "ALL",
+                "LogDestinationType": "cloud-watch-logs",
+                "LogFormat": "${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status}",
+                "Tags": [],
+                "MaxAggregationInterval": 600
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_vpc_create_flow_logs/ec2.DescribeFlowLogs_4.json b/tests/data/placebo/test_vpc_create_flow_logs/ec2.DescribeFlowLogs_4.json
new file mode 100644
index 000000000..f30a03afc
--- /dev/null
+++ b/tests/data/placebo/test_vpc_create_flow_logs/ec2.DescribeFlowLogs_4.json
@@ -0,0 +1,31 @@
+{
+    "status_code": 200,
+    "data": {
+        "FlowLogs": [
+            {
+                "CreationTime": {
+                    "__class__": "datetime",
+                    "year": 2020,
+                    "month": 4,
+                    "day": 27,
+                    "hour": 4,
+                    "minute": 33,
+                    "second": 17,
+                    "microsecond": 121000
+                },
+                "DeliverLogsPermissionArn": "arn:aws:iam::644160558196:role/flowlogsRole",
+                "DeliverLogsStatus": "SUCCESS",
+                "FlowLogId": "fl-0c28f7d7b5cd29477",
+                "FlowLogStatus": "ACTIVE",
+                "LogGroupName": "/custodian/vpc_log/",
+                "ResourceId": "vpc-03005fb9b8740263d",
+                "TrafficType": "ALL",
+                "LogDestinationType": "cloud-watch-logs",
+                "LogFormat": "${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status}",
+                "Tags": [],
+                "MaxAggregationInterval": 600
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_vpc_create_flow_logs/ec2.DescribeVpcs_1.json b/tests/data/placebo/test_vpc_create_flow_logs/ec2.DescribeVpcs_1.json
index 68d186edb..ea32baa71 100644
--- a/tests/data/placebo/test_vpc_create_flow_logs/ec2.DescribeVpcs_1.json
+++ b/tests/data/placebo/test_vpc_create_flow_logs/ec2.DescribeVpcs_1.json
@@ -1,42 +1,60 @@
 {
-    "status_code": 200, 
+    "status_code": 200,
     "data": {
         "Vpcs": [
             {
-                "VpcId": "vpc-7af45101", 
-                "InstanceTenancy": "default", 
+                "CidrBlock": "10.205.0.0/18",
+                "DhcpOptionsId": "dopt-24ff1940",
+                "State": "available",
+                "VpcId": "vpc-03005fb9b8740263d",
+                "OwnerId": "644160558196",
+                "InstanceTenancy": "default",
+                "CidrBlockAssociationSet": [
+                    {
+                        "AssociationId": "vpc-cidr-assoc-0f6765530d80dc044",
+                        "CidrBlock": "10.205.0.0/18",
+                        "CidrBlockState": {
+                            "State": "associated"
+                        }
+                    }
+                ],
+                "IsDefault": false,
                 "Tags": [
                     {
-                        "Value": "FlowLogTest", 
-                        "Key": "Name"
+                        "Key": "Owner",
+                        "Value": "c7n"
+                    },
+                    {
+                        "Key": "Name",
+                        "Value": "testing-vpc"
                     }
-                ], 
+                ]
+            },
+            {
+                "CidrBlock": "172.31.0.0/16",
+                "DhcpOptionsId": "dopt-24ff1940",
+                "State": "available",
+                "VpcId": "vpc-d2d616b5",
+                "OwnerId": "644160558196",
+                "InstanceTenancy": "default",
                 "CidrBlockAssociationSet": [
                     {
-                        "AssociationId": "vpc-cidr-assoc-7c1eb811", 
-                        "CidrBlock": "10.0.16.0/24", 
+                        "AssociationId": "vpc-cidr-assoc-33669f5a",
+                        "CidrBlock": "172.31.0.0/16",
                         "CidrBlockState": {
                             "State": "associated"
                         }
                     }
-                ], 
-                "State": "available", 
-                "DhcpOptionsId": "dopt-4d4c3035", 
-                "CidrBlock": "10.0.16.0/24", 
-                "IsDefault": false
-            }
-        ], 
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "e667839a-e438-453c-877a-4c75c0c26add", 
-            "HTTPHeaders": {
-                "transfer-encoding": "chunked", 
-                "vary": "Accept-Encoding", 
-                "server": "AmazonEC2", 
-                "content-type": "text/xml;charset=UTF-8", 
-                "date": "Fri, 06 Apr 2018 16:51:44 GMT"
+                ],
+                "IsDefault": true,
+                "Tags": [
+                    {
+                        "Key": "Name",
+                        "Value": "FlowLogTest"
+                    }
+                ]
             }
-        }
+        ],
+        "ResponseMetadata": {}
     }
 }
\ No newline at end of file
diff --git a/tests/data/placebo/test_vpc_create_flow_logs/ec2.DescribeVpcs_2.json b/tests/data/placebo/test_vpc_create_flow_logs/ec2.DescribeVpcs_2.json
new file mode 100644
index 000000000..ea32baa71
--- /dev/null
+++ b/tests/data/placebo/test_vpc_create_flow_logs/ec2.DescribeVpcs_2.json
@@ -0,0 +1,60 @@
+{
+    "status_code": 200,
+    "data": {
+        "Vpcs": [
+            {
+                "CidrBlock": "10.205.0.0/18",
+                "DhcpOptionsId": "dopt-24ff1940",
+                "State": "available",
+                "VpcId": "vpc-03005fb9b8740263d",
+                "OwnerId": "644160558196",
+                "InstanceTenancy": "default",
+                "CidrBlockAssociationSet": [
+                    {
+                        "AssociationId": "vpc-cidr-assoc-0f6765530d80dc044",
+                        "CidrBlock": "10.205.0.0/18",
+                        "CidrBlockState": {
+                            "State": "associated"
+                        }
+                    }
+                ],
+                "IsDefault": false,
+                "Tags": [
+                    {
+                        "Key": "Owner",
+                        "Value": "c7n"
+                    },
+                    {
+                        "Key": "Name",
+                        "Value": "testing-vpc"
+                    }
+                ]
+            },
+            {
+                "CidrBlock": "172.31.0.0/16",
+                "DhcpOptionsId": "dopt-24ff1940",
+                "State": "available",
+                "VpcId": "vpc-d2d616b5",
+                "OwnerId": "644160558196",
+                "InstanceTenancy": "default",
+                "CidrBlockAssociationSet": [
+                    {
+                        "AssociationId": "vpc-cidr-assoc-33669f5a",
+                        "CidrBlock": "172.31.0.0/16",
+                        "CidrBlockState": {
+                            "State": "associated"
+                        }
+                    }
+                ],
+                "IsDefault": true,
+                "Tags": [
+                    {
+                        "Key": "Name",
+                        "Value": "FlowLogTest"
+                    }
+                ]
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_vpc_create_flow_logs/logs.CreateLogGroup_1.json b/tests/data/placebo/test_vpc_create_flow_logs/logs.CreateLogGroup_1.json
new file mode 100644
index 000000000..5b2170a07
--- /dev/null
+++ b/tests/data/placebo/test_vpc_create_flow_logs/logs.CreateLogGroup_1.json
@@ -0,0 +1,6 @@
+{
+    "status_code": 200,
+    "data": {
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_vpc_create_flow_logs/logs.CreateLogGroup_2.json b/tests/data/placebo/test_vpc_create_flow_logs/logs.CreateLogGroup_2.json
new file mode 100644
index 000000000..a3f39d880
--- /dev/null
+++ b/tests/data/placebo/test_vpc_create_flow_logs/logs.CreateLogGroup_2.json
@@ -0,0 +1,10 @@
+{
+    "status_code": 400,
+    "data": {
+        "Error": {
+            "Message": "The specified log group already exists",
+            "Code": "ResourceAlreadyExistsException"
+        },
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/test_emr.py b/tests/test_emr.py
index 1328fba03..fe19dccb8 100644
--- a/tests/test_emr.py
+++ b/tests/test_emr.py
@@ -230,3 +230,38 @@ class TestActions(unittest.TestCase):
     def test_action_construction(self):
 
         self.assertIsInstance(actions.factory("terminate", None), emr.Terminate)
+
+
+class TestEMRSecurityConfiguration(BaseTest):
+    def test_emr_security_configuration(self):
+        session_factory = self.replay_flight_data("test_emr_security_configuration")
+        p = self.load_policy(
+            {
+                'name': 'emr',
+                'resource': 'emr-security-configuration',
+            },
+            session_factory=session_factory)
+        resources = p.run()
+        print(resources)
+        self.assertEqual(resources[0]["SecurityConfiguration"]['EncryptionConfiguration']
+             ['EnableInTransitEncryption'], False)
+
+    def test_emr_security_configuration_delete(self):
+        session_factory = self.replay_flight_data("test_emr_security_configuration_delete")
+        p = self.load_policy(
+            {
+                'name': 'emr',
+                'resource': 'emr-security-configuration',
+                "filters": [{"Name": "test"}],
+                "actions": [{"type": "delete"}],
+            },
+            session_factory=session_factory
+        )
+        resources = p.run()
+        self.assertEqual(len(resources), 1)
+
+        client = session_factory(region="us-east-1").client("emr")
+        resp = client.list_security_configurations()
+        self.assertFalse(
+            resp['SecurityConfigurations']
+        )
diff --git a/tests/test_vpc.py b/tests/test_vpc.py
index e6646f0de..c7936f7ef 100644
--- a/tests/test_vpc.py
+++ b/tests/test_vpc.py
@@ -2725,6 +2725,7 @@ class FlowLogsTest(BaseTest):
 
     def test_vpc_create_flow_logs(self):
         session_factory = self.replay_flight_data("test_vpc_create_flow_logs")
+        # creates log group
         p = self.load_policy(
             {
                 "name": "c7n-create-vpc-flow-logs",
@@ -2737,7 +2738,7 @@ class FlowLogsTest(BaseTest):
                     {
                         "type": "set-flow-log",
                         "DeliverLogsPermissionArn": "arn:aws:iam::644160558196:role/flowlogsRole",
-                        "LogGroupName": "/custodian/vpc_logs/",
+                        "LogGroupName": "/custodian/vpc_log/",
                         "TrafficType": "ALL",
                     }
                 ],
@@ -2746,14 +2747,40 @@ class FlowLogsTest(BaseTest):
         )
         resources = p.run()
         self.assertEqual(len(resources), 1)
-        self.assertEqual(resources[0]["VpcId"], "vpc-7af45101")
+        self.assertEqual(resources[0]["VpcId"], "vpc-d2d616b5")
         client = session_factory(region="us-east-1").client("ec2")
         logs = client.describe_flow_logs(
             Filters=[{"Name": "resource-id", "Values": [resources[0]["VpcId"]]}]
-        )[
-            "FlowLogs"
-        ]
+        )["FlowLogs"]
         self.assertEqual(logs[0]["ResourceId"], resources[0]["VpcId"])
+        # p1 has same log group name
+        p1 = self.load_policy(
+            {
+                "name": "c7n-create-vpc-flow-logs",
+                "resource": "vpc",
+                "filters": [
+                    {"tag:Name": "testing-vpc"},
+                    {"type": "flow-logs", "enabled": False}
+                ],
+                "actions": [
+                    {
+                        "type": "set-flow-log",
+                        "DeliverLogsPermissionArn": "arn:aws:iam::644160558196:role/flowlogsRole",
+                        "LogGroupName": "/custodian/vpc_log/",
+                        "TrafficType": "ALL",
+                    }
+                ],
+            },
+            session_factory=session_factory,
+        )
+        res = p1.run()
+        self.assertEqual(len(res), 1)
+        self.assertEqual(res[0]["VpcId"], "vpc-03005fb9b8740263d")
+        client = session_factory(region="us-east-1").client("ec2")
+        lgs = client.describe_flow_logs(
+            Filters=[{"Name": "resource-id", "Values": [res[0]["VpcId"]]}]
+        )["FlowLogs"]
+        self.assertEqual(lgs[0]["ResourceId"], res[0]["VpcId"])
 
     def test_vpc_flow_log_destination(self):
         session_factory = self.replay_flight_data('test_vpc_flow_filter_destination')