diff --git a/c7n/commands.py b/c7n/commands.py
index 2a29bf925..77c82b936 100644
--- a/c7n/commands.py
+++ b/c7n/commands.py
@@ -276,17 +276,21 @@ def run(options, policies):
             log.exception("Unable to assume role %s", options.assume_role)
             sys.exit(1)
 
+    errored_policies = []
     for policy in policies:
         try:
             policy()
         except Exception:
             exit_code = 2
+            errored_policies.append(policy.name)
             if options.debug:
                 raise
             log.exception(
                 "Error while executing policy %s, continuing" % (
                     policy.name))
     if exit_code != 0:
+        log.error("The following policies had errors while executing\n - %s" % (
+            "\n - ".join(errored_policies)))
         sys.exit(exit_code)
 
 
diff --git a/c7n/filters/iamaccess.py b/c7n/filters/iamaccess.py
index 8519fca7b..3c5f2b159 100644
--- a/c7n/filters/iamaccess.py
+++ b/c7n/filters/iamaccess.py
@@ -249,7 +249,7 @@ class PolicyChecker:
 
     def handle_aws_principalorgid(self, s, c):
         if not self.allowed_orgid:
-            return False
+            return True
         return bool(set(map(_account, c['values'])).difference(self.allowed_orgid))
 
 
diff --git a/c7n/loader.py b/c7n/loader.py
index 108b2516a..ed419ce99 100644
--- a/c7n/loader.py
+++ b/c7n/loader.py
@@ -130,9 +130,9 @@ class PolicyLoader:
         if missing:
             self._handle_missing_resources(policy_data, missing)
 
-        if validate is not False or (
+        if schema and (validate is not False or (
                 validate is None and
-                self.default_schema_validate):
+                self.default_schema_validate)):
             errors = self.validator.validate(policy_data, tuple(rtypes))
             if errors:
                 raise PolicyValidationError(
diff --git a/c7n/manager.py b/c7n/manager.py
index b0995227c..513eb9b29 100644
--- a/c7n/manager.py
+++ b/c7n/manager.py
@@ -111,8 +111,8 @@ class ResourceManager:
         original = len(resources)
         if event and event.get('debug', False):
             self.log.info(
-                "Filtering resources with %s", self.filters)
-        for f in self.filters:
+                "Filtering resources using %d filters", len(self.filters))
+        for idx, f in enumerate(self.filters, start=1):
             if not resources:
                 break
             rcount = len(resources)
@@ -122,7 +122,8 @@ class ResourceManager:
 
             if event and event.get('debug', False):
                 self.log.debug(
-                    "applied filter %s %d->%d", f, rcount, len(resources))
+                    "Filter #%d applied %d->%d filter: %s",
+                    idx, rcount, len(resources), dumps(f.data, indent=None))
         self.log.debug("Filtered from %d to %d %s" % (
             original, len(resources), self.__class__.__name__.lower()))
         return resources
diff --git a/c7n/resources/glue.py b/c7n/resources/glue.py
index 059c50440..e985ebc6d 100644
--- a/c7n/resources/glue.py
+++ b/c7n/resources/glue.py
@@ -11,12 +11,14 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+import json
 from botocore.exceptions import ClientError
 from concurrent.futures import as_completed
 from c7n.manager import resources, ResourceManager
 from c7n.query import QueryResourceManager, TypeInfo
 from c7n.utils import local_session, chunks, type_schema
-from c7n.actions import BaseAction, ActionRegistry
+from c7n.actions import BaseAction, ActionRegistry, RemovePolicyBase
+from c7n.exceptions import PolicyValidationError
 from c7n.filters.vpc import SubnetFilter, SecurityGroupFilter
 from c7n.filters.related import RelatedResourceFilter
 from c7n.tags import universal_augment
@@ -637,3 +639,46 @@ class GlueCatalogCrossAccount(CrossAccountAccessFilter):
             policy = {}
         r[self.policy_annotation] = policy
         return policy
+
+
+@GlueDataCatalog.action_registry.register('remove-statements')
+class RemovePolicyStatement(RemovePolicyBase):
+    """Action to remove policy statements from Glue Data Catalog
+
+    :example:
+
+    .. code-block:: yaml
+
+           policies:
+              - name: remove-glue-catalog-cross-account
+                resource: aws.glue-catalog
+                filters:
+                  - type: cross-account
+                actions:
+                  - type: remove-statements
+                    statement_ids: matched
+    """
+    permissions = ('glue:PutResourcePolicy',)
+    policy_annotation = "c7n:AccessPolicy"
+
+    def validate(self):
+        for f in self.manager.iter_filters():
+            if isinstance(f, GlueCatalogCrossAccount):
+                return self
+        raise PolicyValidationError(
+            '`remove-statements` may only be used in '
+            'conjunction with `cross-account` filter on %s' % (self.manager.data,))
+
+    def process(self, resources):
+        resource = resources[0]
+        client = local_session(self.manager.session_factory).client('glue')
+        if resource.get(self.policy_annotation):
+            p = json.loads(resource[self.policy_annotation])
+            statements, found = self.process_policy(
+                p, resource, CrossAccountAccessFilter.annotation_key)
+            if not found:
+                return
+            if statements:
+                client.put_resource_policy(PolicyInJson=json.dumps(p))
+            else:
+                client.delete_resource_policy()
diff --git a/c7n/resources/resource_map.py b/c7n/resources/resource_map.py
index 2a56519dd..04b466b87 100644
--- a/c7n/resources/resource_map.py
+++ b/c7n/resources/resource_map.py
@@ -146,6 +146,7 @@ ResourceMap = {
     "aws.sagemaker-transform-job": "c7n.resources.sagemaker.SagemakerTransformJob",
     "aws.secrets-manager": "c7n.resources.secretsmanager.SecretsManager",
     "aws.security-group": "c7n.resources.vpc.SecurityGroup",
+    "aws.serverless-app": "c7n.resources.sar.ServerlessApp",
     "aws.shield-attack": "c7n.resources.shield.ShieldAttack",
     "aws.shield-protection": "c7n.resources.shield.ShieldProtection",
     "aws.simpledb": "c7n.resources.simpledb.SimpleDB",
diff --git a/c7n/resources/sar.py b/c7n/resources/sar.py
new file mode 100644
index 000000000..98c91d77d
--- /dev/null
+++ b/c7n/resources/sar.py
@@ -0,0 +1,87 @@
+# Copyright 2020 Kapil Thangavelu
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+from c7n.actions import Action
+from c7n.filters import CrossAccountAccessFilter
+from c7n.query import QueryResourceManager, TypeInfo
+from c7n.manager import resources
+from c7n.utils import type_schema, local_session
+
+
+@resources.register('serverless-app')
+class ServerlessApp(QueryResourceManager):
+
+    class resource_type(TypeInfo):
+        service = 'serverlessrepo'
+        arn = id = 'ApplicationId'
+        name = 'Name'
+        enum_spec = ('list_applications', 'Applications', None)
+        cfn_type = 'AWS::Serverless::Application'
+        default_report_fields = [
+            'ApplicationId', 'Name', 'CreationTime', 'SpdxLicenseId', 'Author']
+
+
+@ServerlessApp.action_registry.register('delete')
+class Delete(Action):
+
+    permissions = ('serverlessrepo:DeleteApplication',)
+    schema = type_schema('delete')
+
+    def process(self, resources):
+        client = local_session(
+            self.manager.session_factory).client('serverlessrepo')
+        for r in resources:
+            self.manager.retry(
+                client.delete_application,
+                ApplicationId=r['ApplicationId'])
+
+
+@ServerlessApp.filter_registry.register('cross-account')
+class CrossAccount(CrossAccountAccessFilter):
+
+    permissions = ('serverlessrepo:GetApplicationPolicy',)
+    policy_attribute = 'c7n:Policy'
+
+    def process(self, resources, event=None):
+        client = local_session(
+            self.manager.session_factory).client('serverlessrepo')
+        for r in resources:
+            if self.policy_attribute not in r:
+                r[self.policy_attribute] = p = client.get_application_policy(
+                    ApplicationId=r['ApplicationId'])
+                p.pop('ResponseMetadata', None)
+                self.transform_policy(p)
+        return super().process(resources)
+
+    def transform_policy(self, policy):
+        """Serverless Application repositories policies aren't valid iam policies.
+
+        Its a service specific spelling that violates basic constraints of the iam
+        schema. We attempt to normalize it to normal IAM spelling.
+        """
+        policy['Statement'] = policy.pop('Statements')
+        for s in policy['Statement']:
+            actions = ['serverlessrepo:%s' % a for a in s['Actions']]
+            s['Actions'] = actions
+            if 'Effect' not in s:
+                s['Effect'] = 'Allow'
+            if 'Principals' in s:
+                s['Principal'] = {'AWS': s.pop('Principals')}
+            if 'PrincipalOrgIDs' in s:
+                org_ids = s.pop('PrincipalOrgIDs')
+                if org_ids:
+                    s['Condition'] = {
+                        'StringEquals': {'aws:PrincipalOrgID': org_ids}}
+        return policy
diff --git a/tools/dev/cfntypedb.py b/tools/dev/cfntypedb.py
new file mode 100644
index 000000000..6caf4ab39
--- /dev/null
+++ b/tools/dev/cfntypedb.py
@@ -0,0 +1,32 @@
+import boto3
+import json
+import jmespath
+
+from botocore.paginate import Paginator
+
+
+def main():
+
+    client = boto3.client('cloudformation')
+
+    paginator = Paginator(
+        client.list_types,
+        {'input_token': 'NextToken',
+         'output_token': 'NextToken',
+         'result_key': 'TypeSummaries'},
+        client.meta.service_model.operation_model('ListTypes'))
+
+    results = paginator.paginate(Visibility='PUBLIC').build_full_result()
+    type_names = jmespath.search('TypeSummaries[].TypeName', results)
+
+    # manually add the ones missing
+    missing = (
+        'AWS::Serverless::Application',)
+    for m in missing:
+        if m not in type_names:
+            type_names.append(m)
+    print(json.dumps(sorted(type_names), indent=2))
+
+
+if __name__ == '__main__':
+    main()

Add resource support for AWS Serverless Application Support
SAR allows customers to share/publish serverless functions as well as access public function code.  We would like to put some controls around this to detect if our customers are publishing things and maybe even limit the customers to consume the verified AWS customer functions.
diff --git a/tests/data/cfn-types.json b/tests/data/cfn-types.json
index 55aad97cc..32e60797c 100644
--- a/tests/data/cfn-types.json
+++ b/tests/data/cfn-types.json
@@ -4,7 +4,9 @@
   "AWS::ACMPCA::CertificateAuthorityActivation",
   "AWS::AccessAnalyzer::Analyzer",
   "AWS::AmazonMQ::Broker",
+  "AWS::AmazonMQ::Configuration",
   "AWS::AmazonMQ::ConfigurationAssociation",
+  "AWS::Amplify::App",
   "AWS::Amplify::Branch",
   "AWS::Amplify::Domain",
   "AWS::ApiGateway::Account",
@@ -37,6 +39,11 @@
   "AWS::ApiGatewayV2::Route",
   "AWS::ApiGatewayV2::RouteResponse",
   "AWS::ApiGatewayV2::Stage",
+  "AWS::AppConfig::Application",
+  "AWS::AppConfig::ConfigurationProfile",
+  "AWS::AppConfig::Deployment",
+  "AWS::AppConfig::DeploymentStrategy",
+  "AWS::AppConfig::Environment",
   "AWS::AppMesh::Mesh",
   "AWS::AppMesh::Route",
   "AWS::AppMesh::VirtualNode",
@@ -49,6 +56,7 @@
   "AWS::AppStream::StackFleetAssociation",
   "AWS::AppStream::StackUserAssociation",
   "AWS::AppStream::User",
+  "AWS::AppSync::ApiCache",
   "AWS::AppSync::ApiKey",
   "AWS::AppSync::DataSource",
   "AWS::AppSync::FunctionConfiguration",
@@ -91,7 +99,9 @@
   "AWS::CloudWatch::AnomalyDetector",
   "AWS::CloudWatch::CompositeAlarm",
   "AWS::CloudWatch::Dashboard",
+  "AWS::CloudWatch::InsightRule",
   "AWS::CodeBuild::Project",
+  "AWS::CodeBuild::ReportGroup",
   "AWS::CodeBuild::SourceCredential",
   "AWS::CodeCommit::Repository",
   "AWS::CodeDeploy::Application",
@@ -103,9 +113,10 @@
   "AWS::CodePipeline::Webhook",
   "AWS::CodeStar::GitHubRepository",
   "AWS::CodeStarConnections::Connection",
+  "AWS::CodeStarNotifications::NotificationRule",
   "AWS::Cognito::IdentityPool",
-    "AWS::Cognito::IdentityPoolRoleAttachment",
-    "AWS::Cognito::UserPool",    
+  "AWS::Cognito::IdentityPoolRoleAttachment",
+  "AWS::Cognito::UserPool",
   "AWS::Cognito::UserPoolClient",
   "AWS::Cognito::UserPoolDomain",
   "AWS::Cognito::UserPoolGroup",
@@ -134,6 +145,7 @@
   "AWS::DMS::ReplicationInstance",
   "AWS::DMS::ReplicationSubnetGroup",
   "AWS::DMS::ReplicationTask",
+  "AWS::DataPipeline::Pipeline",
   "AWS::Detective::Graph",
   "AWS::Detective::MemberInvitation",
   "AWS::DirectoryService::MicrosoftAD",
@@ -203,15 +215,18 @@
   "AWS::EC2::VPNGateway",
   "AWS::EC2::VPNGatewayRoutePropagation",
   "AWS::EC2::Volume",
+  "AWS::EC2::VolumeAttachment",
   "AWS::ECR::Repository",
   "AWS::ECS::Cluster",
   "AWS::ECS::PrimaryTaskSet",
   "AWS::ECS::Service",
   "AWS::ECS::TaskDefinition",
   "AWS::ECS::TaskSet",
+  "AWS::EFS::AccessPoint",
   "AWS::EFS::FileSystem",
   "AWS::EFS::MountTarget",
   "AWS::EKS::Cluster",
+  "AWS::EKS::Nodegroup",
   "AWS::EMR::Cluster",
   "AWS::EMR::InstanceFleetConfig",
   "AWS::EMR::InstanceGroupConfig",
@@ -234,6 +249,10 @@
   "AWS::ElasticLoadBalancingV2::LoadBalancer",
   "AWS::ElasticLoadBalancingV2::TargetGroup",
   "AWS::Elasticsearch::Domain",
+  "AWS::EventSchemas::Discoverer",
+  "AWS::EventSchemas::Registry",
+  "AWS::EventSchemas::RegistryPolicy",
+  "AWS::EventSchemas::Schema",
   "AWS::Events::EventBus",
   "AWS::Events::EventBusPolicy",
   "AWS::Events::Rule",
@@ -243,6 +262,13 @@
   "AWS::GameLift::Alias",
   "AWS::GameLift::Build",
   "AWS::GameLift::Fleet",
+  "AWS::GameLift::GameSessionQueue",
+  "AWS::GameLift::MatchmakingConfiguration",
+  "AWS::GameLift::MatchmakingRuleSet",
+  "AWS::GameLift::Script",
+  "AWS::GlobalAccelerator::Accelerator",
+  "AWS::GlobalAccelerator::EndpointGroup",
+  "AWS::GlobalAccelerator::Listener",
   "AWS::Glue::Classifier",
   "AWS::Glue::Connection",
   "AWS::Glue::Crawler",
@@ -289,6 +315,7 @@
   "AWS::IAM::UserToGroupAddition",
   "AWS::ImageBuilder::Component",
   "AWS::ImageBuilder::DistributionConfiguration",
+  "AWS::ImageBuilder::Image",
   "AWS::ImageBuilder::ImagePipeline",
   "AWS::ImageBuilder::ImageRecipe",
   "AWS::ImageBuilder::InfrastructureConfiguration",
@@ -327,20 +354,27 @@
   "AWS::LakeFormation::Permissions",
   "AWS::LakeFormation::Resource",
   "AWS::Lambda::Alias",
+  "AWS::Lambda::EventInvokeConfig",
   "AWS::Lambda::EventSourceMapping",
   "AWS::Lambda::Function",
   "AWS::Lambda::LayerVersion",
   "AWS::Lambda::LayerVersionPermission",
   "AWS::Lambda::Permission",
-    "AWS::Lambda::Version",
-    "AWS::Logs::LogGroup",
+  "AWS::Lambda::Version",
   "AWS::Logs::Destination",
+  "AWS::Logs::LogGroup",
   "AWS::Logs::LogStream",
   "AWS::Logs::MetricFilter",
   "AWS::Logs::SubscriptionFilter",
   "AWS::MSK::Cluster",
+  "AWS::Macie::CustomDataIdentifier",
+  "AWS::Macie::FindingsFilter",
+  "AWS::Macie::Session",
   "AWS::ManagedBlockchain::Member",
   "AWS::ManagedBlockchain::Node",
+  "AWS::MediaConvert::JobTemplate",
+  "AWS::MediaConvert::Preset",
+  "AWS::MediaConvert::Queue",
   "AWS::MediaLive::Channel",
   "AWS::MediaLive::Input",
   "AWS::MediaLive::InputSecurityGroup",
@@ -452,6 +486,7 @@
   "AWS::SecretsManager::Secret",
   "AWS::SecretsManager::SecretTargetAttachment",
   "AWS::SecurityHub::Hub",
+  "AWS::Serverless::Application",
   "AWS::ServiceCatalog::AcceptedPortfolioShare",
   "AWS::ServiceCatalog::CloudFormationProduct",
   "AWS::ServiceCatalog::CloudFormationProvisionedProduct",
diff --git a/tests/data/placebo/test_catalog_remove_matched/glue.GetDataCatalogEncryptionSettings_1.json b/tests/data/placebo/test_catalog_remove_matched/glue.GetDataCatalogEncryptionSettings_1.json
new file mode 100644
index 000000000..8a71abba2
--- /dev/null
+++ b/tests/data/placebo/test_catalog_remove_matched/glue.GetDataCatalogEncryptionSettings_1.json
@@ -0,0 +1,16 @@
+{
+    "status_code": 200,
+    "data": {
+        "DataCatalogEncryptionSettings": {
+            "EncryptionAtRest": {
+                "CatalogEncryptionMode": "SSE-KMS",
+                "SseAwsKmsKeyId": "arn:aws:kms:us-east-1:644160558196:key/ec3b9189-1247-4ecc-8bfd-c492f07621db"
+            },
+            "ConnectionPasswordEncryption": {
+                "ReturnConnectionPasswordEncrypted": true,
+                "AwsKmsKeyId": "arn:aws:kms:us-east-1:644160558196:key/358f7699-4ea5-455a-9c78-1c868301e5a8"
+            }
+        },
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_catalog_remove_matched/glue.GetResourcePolicy_1.json b/tests/data/placebo/test_catalog_remove_matched/glue.GetResourcePolicy_1.json
new file mode 100644
index 000000000..509e9b365
--- /dev/null
+++ b/tests/data/placebo/test_catalog_remove_matched/glue.GetResourcePolicy_1.json
@@ -0,0 +1,28 @@
+{
+    "status_code": 200,
+    "data": {
+        "PolicyInJson": "{\n  \"Version\" : \"2012-10-17\",\n  \"Statement\" : [ {\n    \"Sid\" : \"SpecificAllow\",\n    \"Effect\" : \"Allow\",\n    \"Principal\" : {\n      \"AWS\" : \"arn:aws:iam::644160558196:root\"\n    },\n    \"Action\" : \"glue:GetDatabase\",\n    \"Resource\" : \"arn:aws:glue:us-east-1:644160558196:catalog\"\n  }, {\n    \"Sid\" : \"CrossAccount\",\n    \"Effect\" : \"Allow\",\n    \"Principal\" : {\n      \"AWS\" : \"arn:aws:iam::123456789123:root\"\n    },\n    \"Action\" : \"glue:GetDatabase\",\n    \"Resource\" : \"arn:aws:glue:us-east-1:644160558196:catalog\"\n  } ]\n}",
+        "PolicyHash": "GA378QJBD16utk5xXRuSAw==",
+        "CreateTime": {
+            "__class__": "datetime",
+            "year": 2020,
+            "month": 5,
+            "day": 27,
+            "hour": 23,
+            "minute": 23,
+            "second": 42,
+            "microsecond": 470000
+        },
+        "UpdateTime": {
+            "__class__": "datetime",
+            "year": 2020,
+            "month": 5,
+            "day": 27,
+            "hour": 23,
+            "minute": 23,
+            "second": 42,
+            "microsecond": 470000
+        },
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_catalog_remove_matched/glue.GetResourcePolicy_2.json b/tests/data/placebo/test_catalog_remove_matched/glue.GetResourcePolicy_2.json
new file mode 100644
index 000000000..05a561141
--- /dev/null
+++ b/tests/data/placebo/test_catalog_remove_matched/glue.GetResourcePolicy_2.json
@@ -0,0 +1,28 @@
+{
+    "status_code": 200,
+    "data": {
+        "PolicyInJson": "{\n  \"Version\" : \"2012-10-17\",\n  \"Statement\" : [ {\n    \"Sid\" : \"SpecificAllow\",\n    \"Effect\" : \"Allow\",\n    \"Principal\" : {\n      \"AWS\" : \"arn:aws:iam::644160558196:root\"\n    },\n    \"Action\" : \"glue:GetDatabase\",\n    \"Resource\" : \"arn:aws:glue:us-east-1:644160558196:catalog\"\n  } ]\n}",
+        "PolicyHash": "5V9sCbFtrjJ6N1gmoX+K7Q==",
+        "CreateTime": {
+            "__class__": "datetime",
+            "year": 2020,
+            "month": 5,
+            "day": 27,
+            "hour": 23,
+            "minute": 23,
+            "second": 42,
+            "microsecond": 470000
+        },
+        "UpdateTime": {
+            "__class__": "datetime",
+            "year": 2020,
+            "month": 5,
+            "day": 27,
+            "hour": 23,
+            "minute": 23,
+            "second": 45,
+            "microsecond": 47000
+        },
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_catalog_remove_matched/glue.PutResourcePolicy_1.json b/tests/data/placebo/test_catalog_remove_matched/glue.PutResourcePolicy_1.json
new file mode 100644
index 000000000..b79241e8b
--- /dev/null
+++ b/tests/data/placebo/test_catalog_remove_matched/glue.PutResourcePolicy_1.json
@@ -0,0 +1,7 @@
+{
+    "status_code": 200,
+    "data": {
+        "PolicyHash": "GA378QJBD16utk5xXRuSAw==",
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_catalog_remove_matched/glue.PutResourcePolicy_2.json b/tests/data/placebo/test_catalog_remove_matched/glue.PutResourcePolicy_2.json
new file mode 100644
index 000000000..226db9174
--- /dev/null
+++ b/tests/data/placebo/test_catalog_remove_matched/glue.PutResourcePolicy_2.json
@@ -0,0 +1,7 @@
+{
+    "status_code": 200,
+    "data": {
+        "PolicyHash": "5V9sCbFtrjJ6N1gmoX+K7Q==",
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_sar_cross_account/serverlessrepo.GetApplicationPolicy_1.json b/tests/data/placebo/test_sar_cross_account/serverlessrepo.GetApplicationPolicy_1.json
new file mode 100644
index 000000000..bedd5a866
--- /dev/null
+++ b/tests/data/placebo/test_sar_cross_account/serverlessrepo.GetApplicationPolicy_1.json
@@ -0,0 +1,31 @@
+{
+    "status_code": 200,
+    "data": {
+        "ResponseMetadata": {},
+        "Statements": [
+            {
+                "Actions": [
+                    "Deploy",
+                    "UnshareApplication"
+                ],
+                "PrincipalOrgIDs": [
+                    "o-4adkskbcff"
+                ],
+                "Principals": [
+                    "*"
+                ],
+                "StatementId": "cab89702-05f0-4751-818e-ced6e98ef5f9"
+            },
+            {
+                "Actions": [
+                    "Deploy"
+                ],
+                "PrincipalOrgIDs": [],
+                "Principals": [
+                    "112233445566"
+                ],
+                "StatementId": "b364d84f-62d2-411c-9787-3636b2b1975c"
+            }
+        ]
+    }
+}
diff --git a/tests/data/placebo/test_sar_cross_account/serverlessrepo.ListApplications_1.json b/tests/data/placebo/test_sar_cross_account/serverlessrepo.ListApplications_1.json
new file mode 100644
index 000000000..60c699ae9
--- /dev/null
+++ b/tests/data/placebo/test_sar_cross_account/serverlessrepo.ListApplications_1.json
@@ -0,0 +1,18 @@
+{
+    "status_code": 200,
+    "data": {
+        "ResponseMetadata": {},
+        "Applications": [
+            {
+                "ApplicationId": "arn:aws:serverlessrepo:us-east-1:644160558196:applications/GitterArchive",
+                "Author": "Kapil Thangavelu",
+                "CreationTime": "2020-05-30T15:33:25.878Z",
+                "Description": "archive gitter stuff",
+                "HomePageUrl": "https://github.com/kapilt",
+                "Labels": [],
+                "Name": "GitterArchive",
+                "SpdxLicenseId": "Apache-2.0"
+            }
+        ]
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_sar_query_app/serverlessrepo.ListApplications_1.json b/tests/data/placebo/test_sar_query_app/serverlessrepo.ListApplications_1.json
new file mode 100644
index 000000000..60c699ae9
--- /dev/null
+++ b/tests/data/placebo/test_sar_query_app/serverlessrepo.ListApplications_1.json
@@ -0,0 +1,18 @@
+{
+    "status_code": 200,
+    "data": {
+        "ResponseMetadata": {},
+        "Applications": [
+            {
+                "ApplicationId": "arn:aws:serverlessrepo:us-east-1:644160558196:applications/GitterArchive",
+                "Author": "Kapil Thangavelu",
+                "CreationTime": "2020-05-30T15:33:25.878Z",
+                "Description": "archive gitter stuff",
+                "HomePageUrl": "https://github.com/kapilt",
+                "Labels": [],
+                "Name": "GitterArchive",
+                "SpdxLicenseId": "Apache-2.0"
+            }
+        ]
+    }
+}
\ No newline at end of file
diff --git a/tests/test_glue.py b/tests/test_glue.py
index 41896ff17..5057a3215 100644
--- a/tests/test_glue.py
+++ b/tests/test_glue.py
@@ -13,6 +13,8 @@
 # limitations under the License.
 from .common import BaseTest
 import time
+import json
+from c7n.exceptions import PolicyValidationError
 
 
 class TestGlueConnections(BaseTest):
@@ -536,3 +538,52 @@ class TestGlueDataCatalog(BaseTest):
         )
         resources = p.run()
         self.assertEqual(len(resources), 1)
+
+    def test_catalog_remove_matched(self):
+        session_factory = self.replay_flight_data("test_catalog_remove_matched")
+        client = session_factory().client("glue")
+        client.put_resource_policy(PolicyInJson=json.dumps(
+            {
+                "Version": "2012-10-17",
+                "Statement": [
+                    {
+                        "Sid": "SpecificAllow",
+                        "Effect": "Allow",
+                        "Principal": {"AWS": "arn:aws:iam::644160558196:root"},
+                        "Action": "glue:GetDatabase",
+                        "Resource": "arn:aws:glue:us-east-1:644160558196:catalog"
+                    },
+                    {
+                        "Sid": "CrossAccount",
+                        "Effect": "Allow",
+                        "Principal": {"AWS": "arn:aws:iam::123456789123:root"},
+                        "Action": "glue:GetDatabase",
+                        "Resource": "arn:aws:glue:us-east-1:644160558196:catalog"
+                    },
+                ]
+            }))
+        p = self.load_policy(
+            {
+                "name": "glue-catalog-rm-matched",
+                "resource": "glue-catalog",
+                "filters": [{"type": "cross-account"}],
+                "actions": [{"type": "remove-statements", "statement_ids": "matched"}],
+            },
+            session_factory=session_factory,
+        )
+        resources = p.run()
+        self.assertEqual(len(resources), 1)
+        data = json.loads(client.get_resource_policy().get("PolicyInJson"))
+        self.assertEqual(len(data.get('Statement')), 1)
+        self.assertEqual([s['Sid'] for s in data.get('Statement')], ["SpecificAllow"])
+
+    def test_remove_statements_validation_error(self):
+        self.assertRaises(
+            PolicyValidationError,
+            self.load_policy,
+            {
+                "name": "glue-catalog-remove-matched",
+                "resource": "glue-catalog",
+                "actions": [{"type": "remove-statements", "statement_ids": "matched"}],
+            }
+        )
diff --git a/tests/test_iam.py b/tests/test_iam.py
index 47b9ad821..fa06bb5e4 100644
--- a/tests/test_iam.py
+++ b/tests/test_iam.py
@@ -1582,6 +1582,33 @@ class CrossAccountChecker(TestCase):
             violations = checker.check(p)
             self.assertEqual(bool(violations), expected)
 
+    def test_principal_org_id(self):
+        statements = [
+            {'Actions': ['Deploy', 'UnshareApplication'],
+             'Principal': ['*'],
+             'StatementId': 'cab89702-05f0-4751-818e-ced6e98ef5f9',
+             'Effect': 'Allow',
+             'Condition': {
+                 'StringEquals': {
+                     'aws:PrincipalOrgID': ['o-4pmkskbcf9']}}},
+            {'Actions': ['Deploy'],
+             'Principal': ['619193117841'],
+             'StatementId': 'b364d84f-62d2-411c-9787-3636b2b1975c',
+             'Effect': 'Allow'}
+        ]
+
+        checker = PolicyChecker({
+            'allowed_orgid': ['o-4pmkskbcf9']})
+
+        for statement, expected in zip(statements, [False, True]):
+            self.assertEqual(
+                bool(checker.handle_statement(statement)), expected)
+
+        checker = PolicyChecker({})
+        for statement, expected in zip(statements, [True, True]):
+            self.assertEqual(
+                bool(checker.handle_statement(statement)), expected)
+
     def test_s3_policies(self):
         policies = load_data("iam/s3-policies.json")
         checker = PolicyChecker(
diff --git a/tests/test_policy.py b/tests/test_policy.py
index 7896183fb..823f55817 100644
--- a/tests/test_policy.py
+++ b/tests/test_policy.py
@@ -206,8 +206,13 @@ class PolicyMetaLint(BaseTest):
             if rtype is not None:
                 resource_cfn_types.add(rtype)
         cfn_types = set(load_data('cfn-types.json'))
+        missing = set()
         for rtype in resource_cfn_types:
-            assert rtype in cfn_types, "invalid cfn %s" % rtype
+            if rtype not in cfn_types:
+                missing.add(rtype)
+        if missing:
+            raise AssertionError("Bad cfn types:\n %s" % (
+                "\n".join(sorted(missing))))
 
     def test_securityhub_resource_support(self):
         session = fake_session()._session
diff --git a/tests/test_sar.py b/tests/test_sar.py
new file mode 100644
index 000000000..19e3c7e8c
--- /dev/null
+++ b/tests/test_sar.py
@@ -0,0 +1,50 @@
+# Copyright 2020 Kapil Thangavelu
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+from .common import BaseTest
+
+
+class SARTest(BaseTest):
+
+    def test_query(self):
+        factory = self.replay_flight_data('test_sar_query_app')
+        p = self.load_policy({
+            'name': 'test-sar',
+            'resource': 'aws.serverless-app'},
+            session_factory=factory)
+        resources = p.run()
+        self.assertEqual(len(resources), 1)
+        self.assertEqual(resources[0]['Name'], 'GitterArchive')
+
+    def test_cross_account(self):
+        factory = self.replay_flight_data('test_sar_cross_account')
+        p = self.load_policy({
+            'name': 'test-sar',
+            'resource': 'aws.serverless-app',
+            'filters': [{
+                'type': 'cross-account',
+                'whitelist_orgids': ['o-4adkskbcff']
+            }]},
+            session_factory=factory)
+        resources = p.run()
+        self.assertEqual(len(resources), 1)
+        self.maxDiff = None
+        self.assertEqual(
+            resources[0]['CrossAccountViolations'], [
+                {'Actions': ['serverlessrepo:Deploy'],
+                 'Effect': 'Allow',
+                 'Principal': {'AWS': ['112233445566']},
+                 'StatementId': 'b364d84f-62d2-411c-9787-3636b2b1975c'}
+            ])
diff --git a/tests/test_vpc.py b/tests/test_vpc.py
index a7c1e072f..7c6814c1a 100644
--- a/tests/test_vpc.py
+++ b/tests/test_vpc.py
@@ -2564,7 +2564,8 @@ class EndpointTest(BaseTest):
                 'name': 'vpc-endpoint-cross-account',
                 'resource': 'vpc-endpoint',
                 'filters': [
-                    {'type': 'cross-account'}
+                    {'type': 'cross-account',
+                     'whitelist_orgids': ['o-4amkskbcf1']}
                 ]
             },
             session_factory=session_factory

pip install -e .[dev]
parse_log_pytest
requirements.txt
pytest pytest-cov pytest-xdist pytest-mock pytest
apt-get update apt-get install -y gcc
3.8
requirements.txt
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
apipkg==1.5
appdirs==1.4.4
argcomplete==1.11.1
attrs==19.3.0
aws-xray-sdk==2.5.0
bleach==3.1.5
boto3==1.13.18
botocore==1.16.18
-e git+https://github.com/cloud-custodian/cloud-custodian.git@ace44924eb0c25b1a3961efbfa50a3da1d18310d#egg=c7n
certifi==2020.4.5.1
cffi==1.14.0
chardet==3.0.4
coverage==5.1
cryptography==2.9.2
distlib==0.3.0
docutils==0.15.2
exceptiongroup==1.2.2
execnet==1.7.1
filelock==3.0.12
flake8==3.8.2
future==0.18.2
idna==2.9
importlib-metadata==1.6.0
iniconfig==2.1.0
jeepney==0.4.3
jmespath==0.10.0
jsonpatch==1.25
jsonpickle==1.4.1
jsonpointer==2.0
jsonschema==3.2.0
keyring==21.2.1
mccabe==0.6.1
mock==4.0.2
more-itertools==8.3.0
multidict==4.7.6
packaging==20.4
pkginfo==1.5.0.1
placebo==0.9.0
pluggy==1.5.0
psutil==5.7.0
py==1.8.1
pycodestyle==2.6.0
pycparser==2.20
pyflakes==2.2.0
Pygments==2.6.1
pyparsing==2.4.7
pyrsistent==0.16.0
pytest==8.3.5
pytest-cov==2.9.0
pytest-forked==1.1.3
pytest-mock==3.14.0
pytest-sugar==0.9.3
pytest-xdist==1.32.0
python-dateutil==2.8.1
PyYAML==5.3.1
readme-renderer==26.0
requests==2.23.0
requests-toolbelt==0.9.1
s3transfer==0.3.3
SecretStorage==3.1.2
six==1.15.0
tabulate==0.8.7
termcolor==1.1.0
toml==0.10.1
tomli==2.2.1
tox==3.15.1
tqdm==4.46.0
twine==3.1.1
urllib3==1.25.9
vcrpy==4.0.2
virtualenv==20.0.21
wcwidth==0.1.9
webencodings==0.5.1
wrapt==1.12.1
yarl==1.4.2
zipp==3.1.0

name: cloud-custodian
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.4.4=h6a678d5_1
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=3.0.16=h5eee18b_0
  - pip=24.2=py38h06a4308_0
  - python=3.8.20=he870216_0
  - readline=8.2=h5eee18b_0
  - setuptools=75.1.0=py38h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - wheel=0.44.0=py38h06a4308_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - apipkg==1.5
      - appdirs==1.4.4
      - argcomplete==1.11.1
      - attrs==19.3.0
      - aws-xray-sdk==2.5.0
      - bleach==3.1.5
      - boto3==1.13.18
      - botocore==1.16.18
      - c7n==0.9.3
      - certifi==2020.4.5.1
      - cffi==1.14.0
      - chardet==3.0.4
      - coverage==5.1
      - cryptography==2.9.2
      - distlib==0.3.0
      - docutils==0.15.2
      - exceptiongroup==1.2.2
      - execnet==1.7.1
      - filelock==3.0.12
      - flake8==3.8.2
      - future==0.18.2
      - idna==2.9
      - importlib-metadata==1.6.0
      - iniconfig==2.1.0
      - jeepney==0.4.3
      - jmespath==0.10.0
      - jsonpatch==1.25
      - jsonpickle==1.4.1
      - jsonpointer==2.0
      - jsonschema==3.2.0
      - keyring==21.2.1
      - mccabe==0.6.1
      - mock==4.0.2
      - more-itertools==8.3.0
      - multidict==4.7.6
      - packaging==20.4
      - pkginfo==1.5.0.1
      - placebo==0.9.0
      - pluggy==1.5.0
      - psutil==5.7.0
      - py==1.8.1
      - pycodestyle==2.6.0
      - pycparser==2.20
      - pyflakes==2.2.0
      - pygments==2.6.1
      - pyparsing==2.4.7
      - pyrsistent==0.16.0
      - pytest==8.3.5
      - pytest-cov==2.9.0
      - pytest-forked==1.1.3
      - pytest-mock==3.14.0
      - pytest-sugar==0.9.3
      - pytest-xdist==1.32.0
      - python-dateutil==2.8.1
      - pyyaml==5.3.1
      - readme-renderer==26.0
      - requests==2.23.0
      - requests-toolbelt==0.9.1
      - s3transfer==0.3.3
      - secretstorage==3.1.2
      - six==1.15.0
      - tabulate==0.8.7
      - termcolor==1.1.0
      - toml==0.10.1
      - tomli==2.2.1
      - tox==3.15.1
      - tqdm==4.46.0
      - twine==3.1.1
      - urllib3==1.25.9
      - vcrpy==4.0.2
      - virtualenv==20.0.21
      - wcwidth==0.1.9
      - webencodings==0.5.1
      - wrapt==1.12.1
      - yarl==1.4.2
      - zipp==3.1.0
prefix: /opt/conda/envs/cloud-custodian

tests/test_glue.py::TestGlueDataCatalog::test_catalog_remove_matched tests/test_iam.py::CrossAccountChecker::test_principal_org_id tests/test_sar.py::SARTest::test_cross_account tests/test_sar.py::SARTest::test_query
tests/test_iam.py::UserCredentialReportTest::test_credential_access_key_multifilter_delete tests/test_iam.py::UserCredentialReportTest::test_credential_access_key_reverse_filter_delete tests/test_iam.py::IamUserTest::test_iam_user_access_key_multi_chain
tests/test_glue.py::TestGlueConnections::test_connection_delete tests/test_glue.py::TestGlueConnections::test_connection_sg_filter tests/test_glue.py::TestGlueConnections::test_connection_subnet_filter tests/test_glue.py::TestGlueConnections::test_connections_query tests/test_glue.py::TestGlueDevEndpoints::test_dev_endpoints_delete tests/test_glue.py::TestGlueDevEndpoints::test_dev_endpoints_query tests/test_glue.py::TestGlueTag::test_glue_crawler_tag tests/test_glue.py::TestGlueTag::test_glue_crawler_untag tests/test_glue.py::TestGlueTag::test_glue_job_tag tests/test_glue.py::TestGlueTag::test_glue_job_untag tests/test_glue.py::TestGlueTag::test_glue_tags tests/test_glue.py::TestGlueTag::test_glue_untag tests/test_glue.py::TestGlueJobs::test_jobs_delete tests/test_glue.py::TestGlueCrawlers::test_crawlers_delete tests/test_glue.py::TestGlueCrawlers::test_security_config_filter tests/test_glue.py::TestGlueCrawlers::test_security_config_missing_filter tests/test_glue.py::TestGlueTables::test_tables_delete tests/test_glue.py::TestGlueDatabases::test_databases_delete tests/test_glue.py::TestGlueClassifiers::test_classifiers_delete tests/test_glue.py::GlueMLTransform::test_ml_transforms_delete tests/test_glue.py::TestGlueSecurityConfiguration::test_security_configurations_delete tests/test_glue.py::TestGlueTriggers::test_triggers_delete tests/test_glue.py::TestGlueWorkflows::test_workflows_delete tests/test_glue.py::TestGlueDataCatalog::test_glue_catalog_cross_account tests/test_glue.py::TestGlueDataCatalog::test_glue_datacat_put_encryption tests/test_glue.py::TestGlueDataCatalog::test_remove_statements_validation_error tests/test_iam.py::UserCredentialReportTest::test_access_key_last_service tests/test_iam.py::UserCredentialReportTest::test_credential_report_generate tests/test_iam.py::UserCredentialReportTest::test_old_console_users tests/test_iam.py::UserCredentialReportTest::test_record_transform tests/test_iam.py::UserCredentialReportTest::test_record_transform_with_keys tests/test_iam.py::IamUserTag::test_iam_user_actions tests/test_iam.py::IamUserTag::test_iam_user_add_remove_groups tests/test_iam.py::IAMMFAFilter::test_iam_mfa_filter tests/test_iam.py::IamRoleTest::test_iam_role_actions tests/test_iam.py::IamRoleTest::test_iam_role_get_resources tests/test_iam.py::IamRoleTest::test_iam_role_inuse tests/test_iam.py::IamRoleTest::test_iam_role_post tests/test_iam.py::IamRoleTest::test_iam_role_remove_boundary tests/test_iam.py::IamRoleTest::test_iam_role_set_boundary tests/test_iam.py::IamRoleTest::test_iam_role_unused tests/test_iam.py::IamUserTest::test_iam_user_access_key_filter tests/test_iam.py::IamUserTest::test_iam_user_access_key_multi tests/test_iam.py::IamUserTest::test_iam_user_boundary_remove tests/test_iam.py::IamUserTest::test_iam_user_check_permissions tests/test_iam.py::IamUserTest::test_iam_user_delete tests/test_iam.py::IamUserTest::test_iam_user_delete_some_access tests/test_iam.py::IamUserTest::test_iam_user_policy tests/test_iam.py::IamUserTest::test_iam_user_set_boundary tests/test_iam.py::IamUserTest::test_iam_user_usage tests/test_iam.py::IamUserTest::test_iam_user_usage_no_such_entity tests/test_iam.py::IamUserGroupMembership::test_iam_user_group_membership tests/test_iam.py::IamInstanceProfileFilterUsage::test_iam_instance_profile_inuse tests/test_iam.py::IamInstanceProfileFilterUsage::test_iam_instance_profile_unused tests/test_iam.py::IamPolicyFilterUsage::test_iam_attached_policies tests/test_iam.py::IamPolicyFilterUsage::test_iam_policy_get_resources tests/test_iam.py::IamPolicyFilterUsage::test_iam_unattached_policies tests/test_iam.py::IamPolicyFilterUsage::test_iam_user_policy_permission tests/test_iam.py::IamPolicy::test_iam_has_allow_all_policies tests/test_iam.py::IamPolicy::test_iam_policy_delete tests/test_iam.py::IamPolicy::test_iam_query_parser tests/test_iam.py::IamGroupFilterUsage::test_iam_group_get_resources tests/test_iam.py::IamGroupFilterUsage::test_iam_group_unused_users tests/test_iam.py::IamGroupFilterUsage::test_iam_group_used_users tests/test_iam.py::IamManagedPolicyUsage::test_iam_role_has_specific_managed_policy tests/test_iam.py::IamManagedPolicyUsage::test_iam_role_no_specific_managed_policy tests/test_iam.py::IamInlinePolicyUsage::test_iam_group_has_inline_policy tests/test_iam.py::IamInlinePolicyUsage::test_iam_group_has_inline_policy2 tests/test_iam.py::IamInlinePolicyUsage::test_iam_group_no_inline_policy tests/test_iam.py::IamInlinePolicyUsage::test_iam_role_has_inline_policy tests/test_iam.py::IamInlinePolicyUsage::test_iam_role_no_inline_policy tests/test_iam.py::IamInlinePolicyUsage::test_iam_user_has_inline_policy tests/test_iam.py::IamInlinePolicyUsage::test_iam_user_no_inline_policy tests/test_iam.py::KMSCrossAccount::test_kms_cross_account tests/test_iam.py::GlacierCrossAccount::test_glacier_cross_account tests/test_iam.py::LambdaCrossAccount::test_lambda_cross_account tests/test_iam.py::ECRCrossAccount::test_ecr_cross_account tests/test_iam.py::SQSCrossAccount::test_sqs_cross_account tests/test_iam.py::SNSCrossAccount::test_sns_cross_account tests/test_iam.py::SNSCrossAccount::test_sns_cross_account_endpoint_condition tests/test_iam.py::CrossAccountChecker::test_not_principal_allowed tests/test_iam.py::CrossAccountChecker::test_s3_everyone_only tests/test_iam.py::CrossAccountChecker::test_s3_policies tests/test_iam.py::CrossAccountChecker::test_s3_policies_multiple_conditions tests/test_iam.py::CrossAccountChecker::test_s3_policies_vpc tests/test_iam.py::CrossAccountChecker::test_s3_principal_org_id tests/test_iam.py::CrossAccountChecker::test_sqs_policies tests/test_iam.py::SetRolePolicyAction::test_set_policy_attached tests/test_iam.py::SetRolePolicyAction::test_set_policy_detached tests/test_iam.py::DeleteRoleAction::test_delete_role tests/test_iam.py::DeleteRoleAction::test_delete_role_error tests/test_iam.py::DeleteRoleAction::test_force_delete_role tests/test_iam.py::DeleteRoleAction::test_set_policy_validation_error tests/test_iam.py::DeleteRoleAction::test_set_policy_wildcard tests/test_policy.py::PolicyMetaLint::test_cfn_resource_validity tests/test_policy.py::PolicyMetaLint::test_config_resource_support tests/test_policy.py::PolicyMetaLint::test_filter_action_additional tests/test_policy.py::PolicyMetaLint::test_filter_action_type tests/test_policy.py::PolicyMetaLint::test_policy_detail_spec_permissions tests/test_policy.py::PolicyMetaLint::test_policy_missing_provider_session tests/test_policy.py::PolicyMetaLint::test_resource_arn_info tests/test_policy.py::PolicyMetaLint::test_resource_arn_override_generator tests/test_policy.py::PolicyMetaLint::test_resource_augment_universal_mask tests/test_policy.py::PolicyMetaLint::test_resource_legacy_type tests/test_policy.py::PolicyMetaLint::test_resource_meta_with_class tests/test_policy.py::PolicyMetaLint::test_resource_name tests/test_policy.py::PolicyMetaLint::test_resource_permissions tests/test_policy.py::PolicyMetaLint::test_resource_shadow_source_augment tests/test_policy.py::PolicyMetaLint::test_resource_type_empty_metadata tests/test_policy.py::PolicyMetaLint::test_resource_universal_taggable_arn_type tests/test_policy.py::PolicyMetaLint::test_schema tests/test_policy.py::PolicyMetaLint::test_schema_plugin_name_mismatch tests/test_policy.py::PolicyMetaLint::test_schema_serialization tests/test_policy.py::PolicyMetaLint::test_securityhub_resource_support tests/test_policy.py::PolicyMeta::test_policy_detail_spec_permissions tests/test_policy.py::PolicyMeta::test_policy_manager_custom_permissions tests/test_policy.py::TestPolicyCollection::test_expand_partitions tests/test_policy.py::TestPolicyCollection::test_policy_expand_group_region tests/test_policy.py::TestPolicyCollection::test_policy_region_expand_global tests/test_policy.py::TestPolicy::test_child_resource_trail_validation tests/test_policy.py::TestPolicy::test_file_not_found tests/test_policy.py::TestPolicy::test_get_resource_manager tests/test_policy.py::TestPolicy::test_load_policy_validation_error tests/test_policy.py::TestPolicy::test_policy_name_and_resource_type_filtering tests/test_policy.py::TestPolicy::test_policy_resource_limit_and_percent tests/test_policy.py::TestPolicy::test_policy_resource_limits tests/test_policy.py::TestPolicy::test_policy_resource_limits_count tests/test_policy.py::TestPolicy::test_policy_resource_limits_with_filter tests/test_policy.py::TestPolicy::test_policy_validation tests/test_policy.py::TestPolicy::test_policy_variable_interpolation tests/test_policy.py::TestPolicy::test_policy_variable_precedent tests/test_policy.py::TestPolicy::test_policy_with_role_complete tests/test_policy.py::TestPolicy::test_validate_policy_start_stop tests/test_policy.py::PolicyConditionsTest::test_boolean_and_blocks tests/test_policy.py::PolicyConditionsTest::test_boolean_not_blocks tests/test_policy.py::PolicyConditionsTest::test_boolean_not_event tests/test_policy.py::PolicyConditionsTest::test_boolean_or_blocks tests/test_policy.py::PolicyConditionsTest::test_dryrun_event_filter tests/test_policy.py::PolicyConditionsTest::test_env_var_extension tests/test_policy.py::PolicyConditionsTest::test_event_filter tests/test_policy.py::PolicyExecutionModeTest::test_get_logs_unimplemented tests/test_policy.py::PolicyExecutionModeTest::test_run_unimplemented tests/test_policy.py::LambdaModeTest::test_tags_injection tests/test_policy.py::LambdaModeTest::test_tags_validation tests/test_policy.py::PullModeTest::test_is_runnable_dates tests/test_policy.py::PullModeTest::test_is_runnable_mismatch_region tests/test_policy.py::PullModeTest::test_is_runnable_parse_dates tests/test_policy.py::PullModeTest::test_skip_when_region_not_equal tests/test_policy.py::PhdModeTest::test_validation tests/test_policy.py::ConfigModeTest::test_config_poll tests/test_policy.py::GuardModeTest::test_ec2_guard_event_pattern tests/test_policy.py::GuardModeTest::test_ec2_instance_guard tests/test_policy.py::GuardModeTest::test_iam_guard_event_pattern tests/test_policy.py::GuardModeTest::test_iam_user_access_key_annotate tests/test_policy.py::GuardModeTest::test_lambda_policy_validate_name tests/test_policy.py::GuardModeTest::test_unsupported_resource tests/test_vpc.py::VpcTest::test_attributes_filter_all tests/test_vpc.py::VpcTest::test_attributes_filter_hostnames tests/test_vpc.py::VpcTest::test_dhcp_options_filter tests/test_vpc.py::VpcTest::test_eni_vpc_filter tests/test_vpc.py::VpcTest::test_flow_logs tests/test_vpc.py::VpcTest::test_flow_logs_absent tests/test_vpc.py::VpcTest::test_flow_logs_misconfiguration tests/test_vpc.py::VpcTest::test_flow_logs_s3_destination tests/test_vpc.py::VpcTest::test_vpc_post_finding tests/test_vpc.py::NetworkLocationTest::test_network_location_ignore tests/test_vpc.py::NetworkLocationTest::test_network_location_resource_missing tests/test_vpc.py::NetworkLocationTest::test_network_location_sg_cardinality tests/test_vpc.py::NetworkLocationTest::test_network_location_sg_missing tests/test_vpc.py::NetworkLocationTest::test_network_location_triple_intersect tests/test_vpc.py::NetworkAclTest::test_s3_cidr_network_acl_not_present tests/test_vpc.py::NetworkAclTest::test_s3_cidr_network_acl_present tests/test_vpc.py::TransitGatewayTest::test_tgw_attachment tests/test_vpc.py::TransitGatewayTest::test_tgw_query tests/test_vpc.py::NetworkInterfaceTest::test_and_or_nest tests/test_vpc.py::NetworkInterfaceTest::test_interface_delete tests/test_vpc.py::NetworkInterfaceTest::test_interface_subnet tests/test_vpc.py::NetworkAddrTest::test_elasticip_alias tests/test_vpc.py::NetworkAddrTest::test_elasticip_error tests/test_vpc.py::NetworkAddrTest::test_norelease_attached_nif tests/test_vpc.py::NetworkAddrTest::test_release_attached_ec2 tests/test_vpc.py::NetworkAddrTest::test_release_attached_nif tests/test_vpc.py::NetworkAddrTest::test_release_detached_vpc tests/test_vpc.py::RouteTableTest::test_rt_route_filter tests/test_vpc.py::RouteTableTest::test_rt_subnet_filter tests/test_vpc.py::PeeringConnectionTest::test_peer_cross_account tests/test_vpc.py::PeeringConnectionTest::test_peer_missing_not_found tests/test_vpc.py::PeeringConnectionTest::test_peer_missing_one_route tests/test_vpc.py::PeeringConnectionTest::test_peer_missing_route tests/test_vpc.py::SecurityGroupTest::test_cidr_ingress tests/test_vpc.py::SecurityGroupTest::test_cidr_size_egress tests/test_vpc.py::SecurityGroupTest::test_config_rule tests/test_vpc.py::SecurityGroupTest::test_config_source tests/test_vpc.py::SecurityGroupTest::test_default_vpc tests/test_vpc.py::SecurityGroupTest::test_description_ingress tests/test_vpc.py::SecurityGroupTest::test_egress_ipv6 tests/test_vpc.py::SecurityGroupTest::test_egress_validation_error tests/test_vpc.py::SecurityGroupTest::test_id_selector tests/test_vpc.py::SecurityGroupTest::test_ingress_remove tests/test_vpc.py::SecurityGroupTest::test_match_resource_validator tests/test_vpc.py::SecurityGroupTest::test_multi_attribute_ingress tests/test_vpc.py::SecurityGroupTest::test_only_ports tests/test_vpc.py::SecurityGroupTest::test_only_ports_and_cidr_ingress tests/test_vpc.py::SecurityGroupTest::test_only_ports_ingress tests/test_vpc.py::SecurityGroupTest::test_permission_cidr_kv tests/test_vpc.py::SecurityGroupTest::test_permission_expansion tests/test_vpc.py::SecurityGroupTest::test_port_within_range tests/test_vpc.py::SecurityGroupTest::test_ports_ingress tests/test_vpc.py::SecurityGroupTest::test_security_group_delete tests/test_vpc.py::SecurityGroupTest::test_security_group_post_finding tests/test_vpc.py::SecurityGroupTest::test_security_group_reference_egress_filter tests/test_vpc.py::SecurityGroupTest::test_security_group_reference_ingress_filter tests/test_vpc.py::SecurityGroupTest::test_self_reference_ingress_false_positives tests/test_vpc.py::SecurityGroupTest::test_self_reference_once tests/test_vpc.py::SecurityGroupTest::test_stale tests/test_vpc.py::SecurityGroupTest::test_unused tests/test_vpc.py::SecurityGroupTest::test_unused_ecs tests/test_vpc.py::SecurityGroupTest::test_used tests/test_vpc.py::SecurityGroupTest::test_vpc_by_internet_gateway tests/test_vpc.py::SecurityGroupTest::test_vpc_by_nat_gateway tests/test_vpc.py::SecurityGroupTest::test_vpc_by_security_group tests/test_vpc.py::SecurityGroupTest::test_vpc_by_subnet tests/test_vpc.py::SecurityGroupTest::test_vpc_scenario_2 tests/test_vpc.py::EndpointTest::test_endpoint_cross_account tests/test_vpc.py::EndpointTest::test_endpoint_sg tests/test_vpc.py::EndpointTest::test_endpoint_subnet tests/test_vpc.py::EndpointTest::test_set_permission tests/test_vpc.py::InternetGatewayTest::test_delete_internet_gateways tests/test_vpc.py::InternetGatewayTest::test_delete_internet_gateways_error tests/test_vpc.py::NATGatewayTest::test_delete_nat_gateways tests/test_vpc.py::NATGatewayTest::test_query_nat_gateways tests/test_vpc.py::NATGatewayTest::test_tag_nat_gateways tests/test_vpc.py::FlowLogsTest::test_vpc_create_flow_logs tests/test_vpc.py::FlowLogsTest::test_vpc_delete_flow_logs tests/test_vpc.py::FlowLogsTest::test_vpc_flow_log_destination tests/test_vpc.py::FlowLogsTest::test_vpc_set_flow_logs_maxaggrinterval tests/test_vpc.py::FlowLogsTest::test_vpc_set_flow_logs_s3 tests/test_vpc.py::FlowLogsTest::test_vpc_set_flow_logs_validation tests/test_vpc.py::TestUnusedKeys::test_vpc_unused_key_not_filtered_error tests/test_vpc.py::TestUnusedKeys::test_vpc_unused_keys
c7n/resources/sar.py tools/dev/cfntypedb.py c7n/manager.py c7n/resources/resource_map.py c7n/resources/glue.py c7n/commands.py c7n/loader.py c7n/filters/iamaccess.py
c7n/resources/sar.py tools/dev/cfntypedb.py c7n/manager.py c7n/resources/resource_map.py c7n/resources/glue.py c7n/commands.py c7n/loader.py c7n/filters/iamaccess.py