tjstansell: Linking this to the ticket ... #3165 
diff --git a/c7n/policy.py b/c7n/policy.py
index 63b9b9d2b..bae8e04cb 100644
--- a/c7n/policy.py
+++ b/c7n/policy.py
@@ -600,6 +600,8 @@ class CloudTrailMode(LambdaMode):
 
     schema = utils.type_schema(
         'cloudtrail',
+        delay={'type': 'integer',
+               'description': 'sleep for delay seconds before processing an event'},
         events={'type': 'array', 'items': {
             'oneOf': [
                 {'type': 'string'},
@@ -629,6 +631,13 @@ class CloudTrailMode(LambdaMode):
                     "resource:%s does not support cloudtrail mode policies" % (
                         self.policy.resource_type))
 
+    def resolve_resources(self, event):
+        # override to enable delay before fetching resources
+        delay = self.policy.data.get('mode', {}).get('delay')
+        if delay:
+            time.sleep(delay)
+        return super().resolve_resources(event)
+
 
 @execution.register('ec2-instance-state')
 class EC2InstanceState(LambdaMode):

Action Delay
So I have made this rule.

```
policies:
  - name: untagged-offhour-ec2-rule
    resource: ec2
    mode:
     type: cloudtrail
     role: arn:aws:iam::************:role/cloudcustodian_lambda_role
     events:
       - source: ec2.amazonaws.com
         event: StartInstances
         ids: "responseElements.instancesSet.items[].instanceId"
       - source: ec2.amazonaws.com
         event: RunInstances
         ids: "responseElements.instancesSet.items[].instanceId"
       - source: ec2.amazonaws.com
         event: RebootInstances
         ids: "responseElements.instancesSet.items[].instanceId"
    filters:
     - "tag:OffHour": empty
    actions:
      - terminate
```

This works fine. Besides when creating other resources that create EC2's, since it takes too long for the console to tag the EC2 it gets deleted too fast.

Is there a way to add a delay before the action? Eg: find a newly created EC2 without the correct tagging, then wait a minute before deleting. (rather than deleting it the second it is created) 

Ps I'm aware of 'CRON' but I need a 1 minute delay if possible.
diff --git a/tests/test_mu.py b/tests/test_mu.py
index 44a2c36d9..f4d713178 100644
--- a/tests/test_mu.py
+++ b/tests/test_mu.py
@@ -229,6 +229,35 @@ class PolicyLambdaProvision(BaseTest):
              'source': ['aws.health']}
         )
 
+    def test_cloudtrail_delay(self):
+        p = self.load_policy({
+            'name': 'aws-account',
+            'resource': 'aws.account',
+            'mode': {
+                'type': 'cloudtrail',
+                'delay': 32,
+                'role': 'CustodianRole',
+                'events': ['RunInstances']}})
+        from c7n import policy
+
+        class time:
+
+            invokes = []
+
+            @classmethod
+            def sleep(cls, duration):
+                cls.invokes.append(duration)
+
+        self.patch(policy, 'time', time)
+        trail_mode = p.get_execution_mode()
+        results = trail_mode.run({
+            'detail': {
+                'eventSource': 'ec2.amazonaws.com',
+                'eventName': 'RunInstances'}},
+            None)
+        self.assertEqual(len(results), 0)
+        self.assertEqual(time.invokes, [32])
+
     def test_user_pattern_merge(self):
         p = self.load_policy({
             'name': 'ec2-retire',

pip install -e .[dev]
parse_log_pytest
requirements.txt
pytest pytest-cov pytest-xdist pytest-mock pytest-asyncio pytest
apt-get update apt-get install -y gcc
3.8
requirements.txt
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
apipkg==1.5
appdirs==1.4.4
argcomplete==1.11.1
attrs==19.3.0
aws-xray-sdk==2.5.0
bleach==3.1.5
boto3==1.13.14
botocore==1.16.14
-e git+https://github.com/cloud-custodian/cloud-custodian.git@55e93f4deb2929edb32ab9a6927f7a214bc2ca90#egg=c7n
certifi==2020.4.5.1
cffi==1.14.0
chardet==3.0.4
coverage==5.1
cryptography==2.9.2
distlib==0.3.0
docutils==0.15.2
exceptiongroup==1.2.2
execnet==1.7.1
filelock==3.0.12
flake8==3.8.1
future==0.18.2
idna==2.9
importlib-metadata==1.6.0
iniconfig==2.1.0
jeepney==0.4.3
jmespath==0.10.0
jsonpatch==1.25
jsonpickle==1.4.1
jsonpointer==2.0
jsonschema==3.2.0
keyring==21.2.1
mccabe==0.6.1
mock==4.0.2
more-itertools==8.3.0
multidict==4.7.6
packaging==20.4
pkginfo==1.5.0.1
placebo==0.9.0
pluggy==1.5.0
psutil==5.7.0
py==1.8.1
pycodestyle==2.6.0
pycparser==2.20
pyflakes==2.2.0
Pygments==2.6.1
pyparsing==2.4.7
pyrsistent==0.16.0
pytest==8.3.5
pytest-asyncio==0.24.0
pytest-cov==2.8.1
pytest-forked==1.1.3
pytest-mock==3.14.0
pytest-sugar==0.9.3
pytest-xdist==1.32.0
python-dateutil==2.8.1
PyYAML==5.3.1
readme-renderer==26.0
requests==2.23.0
requests-toolbelt==0.9.1
s3transfer==0.3.3
SecretStorage==3.1.2
six==1.14.0
tabulate==0.8.7
termcolor==1.1.0
toml==0.10.1
tomli==2.2.1
tox==3.15.1
tqdm==4.46.0
twine==3.1.1
urllib3==1.25.9
vcrpy==4.0.2
virtualenv==20.0.21
wcwidth==0.1.9
webencodings==0.5.1
wrapt==1.12.1
yarl==1.4.2
zipp==3.1.0

name: cloud-custodian
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.4.4=h6a678d5_1
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=3.0.16=h5eee18b_0
  - pip=24.2=py38h06a4308_0
  - python=3.8.20=he870216_0
  - readline=8.2=h5eee18b_0
  - setuptools=75.1.0=py38h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - wheel=0.44.0=py38h06a4308_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - apipkg==1.5
      - appdirs==1.4.4
      - argcomplete==1.11.1
      - attrs==19.3.0
      - aws-xray-sdk==2.5.0
      - bleach==3.1.5
      - boto3==1.13.14
      - botocore==1.16.14
      - c7n==0.9.2
      - certifi==2020.4.5.1
      - cffi==1.14.0
      - chardet==3.0.4
      - coverage==5.1
      - cryptography==2.9.2
      - distlib==0.3.0
      - docutils==0.15.2
      - exceptiongroup==1.2.2
      - execnet==1.7.1
      - filelock==3.0.12
      - flake8==3.8.1
      - future==0.18.2
      - idna==2.9
      - importlib-metadata==1.6.0
      - iniconfig==2.1.0
      - jeepney==0.4.3
      - jmespath==0.10.0
      - jsonpatch==1.25
      - jsonpickle==1.4.1
      - jsonpointer==2.0
      - jsonschema==3.2.0
      - keyring==21.2.1
      - mccabe==0.6.1
      - mock==4.0.2
      - more-itertools==8.3.0
      - multidict==4.7.6
      - packaging==20.4
      - pkginfo==1.5.0.1
      - placebo==0.9.0
      - pluggy==1.5.0
      - psutil==5.7.0
      - py==1.8.1
      - pycodestyle==2.6.0
      - pycparser==2.20
      - pyflakes==2.2.0
      - pygments==2.6.1
      - pyparsing==2.4.7
      - pyrsistent==0.16.0
      - pytest==8.3.5
      - pytest-asyncio==0.24.0
      - pytest-cov==2.8.1
      - pytest-forked==1.1.3
      - pytest-mock==3.14.0
      - pytest-sugar==0.9.3
      - pytest-xdist==1.32.0
      - python-dateutil==2.8.1
      - pyyaml==5.3.1
      - readme-renderer==26.0
      - requests==2.23.0
      - requests-toolbelt==0.9.1
      - s3transfer==0.3.3
      - secretstorage==3.1.2
      - six==1.14.0
      - tabulate==0.8.7
      - termcolor==1.1.0
      - toml==0.10.1
      - tomli==2.2.1
      - tox==3.15.1
      - tqdm==4.46.0
      - twine==3.1.1
      - urllib3==1.25.9
      - vcrpy==4.0.2
      - virtualenv==20.0.21
      - wcwidth==0.1.9
      - webencodings==0.5.1
      - wrapt==1.12.1
      - yarl==1.4.2
      - zipp==3.1.0
prefix: /opt/conda/envs/cloud-custodian

tests/test_mu.py::PolicyLambdaProvision::test_cloudtrail_delay
tests/test_mu.py::PythonArchiveTest::test_handles_namespace_packages
tests/test_mu.py::test_generate_requirements tests/test_mu.py::Publish::test_can_switch_runtimes tests/test_mu.py::Publish::test_publish_a_lambda_with_layer_and_concurrency tests/test_mu.py::Publish::test_publishes_a_lambda tests/test_mu.py::PolicyLambdaProvision::test_config_coverage_for_lambda_creation tests/test_mu.py::PolicyLambdaProvision::test_config_coverage_for_lambda_update_from_complex tests/test_mu.py::PolicyLambdaProvision::test_config_coverage_for_lambda_update_from_plain tests/test_mu.py::PolicyLambdaProvision::test_config_defaults tests/test_mu.py::PolicyLambdaProvision::test_config_poll_rule_evaluation tests/test_mu.py::PolicyLambdaProvision::test_config_rule_evaluation tests/test_mu.py::PolicyLambdaProvision::test_config_rule_provision tests/test_mu.py::PolicyLambdaProvision::test_cwe_asg_instance tests/test_mu.py::PolicyLambdaProvision::test_cwe_instance tests/test_mu.py::PolicyLambdaProvision::test_cwe_schedule tests/test_mu.py::PolicyLambdaProvision::test_cwe_security_hub_action tests/test_mu.py::PolicyLambdaProvision::test_cwe_trail tests/test_mu.py::PolicyLambdaProvision::test_cwe_update_config_and_code tests/test_mu.py::PolicyLambdaProvision::test_delta_config_diff tests/test_mu.py::PolicyLambdaProvision::test_optional_packages tests/test_mu.py::PolicyLambdaProvision::test_phd_account_mode tests/test_mu.py::PolicyLambdaProvision::test_phd_mode tests/test_mu.py::PolicyLambdaProvision::test_sns_subscriber_and_ipaddress tests/test_mu.py::PolicyLambdaProvision::test_sqs_subscriber tests/test_mu.py::PolicyLambdaProvision::test_user_pattern_merge tests/test_mu.py::PythonArchiveTest::test_cache_zip_file tests/test_mu.py::PythonArchiveTest::test_can_add_a_file_with_contents_from_a_string tests/test_mu.py::PythonArchiveTest::test_can_add_additional_files_while_open tests/test_mu.py::PythonArchiveTest::test_can_set_path_when_adding_files tests/test_mu.py::PythonArchiveTest::test_cant_add_contents_when_closed tests/test_mu.py::PythonArchiveTest::test_cant_add_files_when_closed tests/test_mu.py::PythonArchiveTest::test_cant_get_bytes_when_open tests/test_mu.py::PythonArchiveTest::test_custodian_archive_creates_a_custodian_archive tests/test_mu.py::PythonArchiveTest::test_even_unreadable_files_become_readable tests/test_mu.py::PythonArchiveTest::test_excludes_non_py_files tests/test_mu.py::PythonArchiveTest::test_files_are_all_readable tests/test_mu.py::PythonArchiveTest::test_handles_packages tests/test_mu.py::PythonArchiveTest::test_handles_stdlib_modules tests/test_mu.py::PythonArchiveTest::test_handles_third_party_modules tests/test_mu.py::PythonArchiveTest::test_unless_you_make_your_own_zipinfo tests/test_mu.py::Constructor::test_class_constructor_only_accepts_py_modules_not_pyc tests/test_mu.py::AddPyFile::test_can_add_py_file tests/test_mu.py::AddPyFile::test_fails_if_py_not_available tests/test_mu.py::AddPyFile::test_reverts_to_py_if_available tests/test_mu.py::DiffTags::test_addition tests/test_mu.py::DiffTags::test_empty tests/test_mu.py::DiffTags::test_removal tests/test_mu.py::DiffTags::test_update
c7n/policy.py
c7n/policy.py