prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  Any way to filter on tags for Cognito identity-pool or user-pool?
  ### Discussed in https://github.com/orgs/cloud-custodian/discussions/7616
  
  <div type='discussions-op-text'>
  
  <sup>Originally posted by **stepkirk** August  5, 2022</sup>
  We normally enforce tags on AWS resources by using Custodian to look for certain required tags on a resource and then, if the tags don't exist or aren't in the correct format, we mark the resource for deletion after a certain grace period. With the Cognito identity-pool and user-pool resources, it doesn't look like we can check for tags the normal way and it doesn't look like we can mark a resource for later deletion. Is that true or am I missing something?
  
  Any plans to add tagging/marking support in the future for these Cognito resources?</div>
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `c7n/resources/cognito.py`
  Content:
  ```
  1 # Copyright The Cloud Custodian Authors.
  2 # SPDX-License-Identifier: Apache-2.0
  3 from botocore.exceptions import ClientError
  4 
  5 from c7n.actions import BaseAction
  6 from c7n.manager import resources
  7 from c7n.query import QueryResourceManager, TypeInfo
  8 from c7n.utils import local_session, type_schema
  9 
  10 
  11 @resources.register('identity-pool')
  12 class CognitoIdentityPool(QueryResourceManager):
  13 
  14     class resource_type(TypeInfo):
  15         service = 'cognito-identity'
  16         enum_spec = ('list_identity_pools', 'IdentityPools', {'MaxResults': 60})
  17         detail_spec = (
  18             'describe_identity_pool', 'IdentityPoolId', 'IdentityPoolId', None)
  19         id = 'IdentityPoolId'
  20         name = 'IdentityPoolName'
  21         arn_type = "identitypool"
  22         cfn_type = 'AWS::Cognito::IdentityPool'
  23 
  24 
  25 @CognitoIdentityPool.action_registry.register('delete')
  26 class DeleteIdentityPool(BaseAction):
  27     """Action to delete cognito identity pool
  28 
  29     It is recommended to use a filter to avoid unwanted deletion of pools
  30 
  31     :example:
  32 
  33     .. code-block:: yaml
  34 
  35             policies:
  36               - name: identity-pool-delete
  37                 resource: identity-pool
  38                 actions:
  39                   - delete
  40     """
  41 
  42     schema = type_schema('delete')
  43     permissions = ("cognito-identity:DeleteIdentityPool",)
  44 
  45     def process(self, pools):
  46         with self.executor_factory(max_workers=2) as w:
  47             list(w.map(self.process_pool, pools))
  48 
  49     def process_pool(self, pool):
  50         client = local_session(
  51             self.manager.session_factory).client('cognito-identity')
  52         try:
  53             client.delete_identity_pool(IdentityPoolId=pool['IdentityPoolId'])
  54         except ClientError as e:
  55             self.log.exception(
  56                 "Exception deleting identity pool:\n %s" % e)
  57 
  58 
  59 @resources.register('user-pool')
  60 class CognitoUserPool(QueryResourceManager):
  61 
  62     class resource_type(TypeInfo):
  63         service = "cognito-idp"
  64         enum_spec = ('list_user_pools', 'UserPools', {'MaxResults': 60})
  65         detail_spec = (
  66             'describe_user_pool', 'UserPoolId', 'Id', 'UserPool')
  67         id = 'Id'
  68         name = 'Name'
  69         arn_type = "userpool"
  70         cfn_type = 'AWS::Cognito::UserPool'
  71 
  72 
  73 @CognitoUserPool.action_registry.register('delete')
  74 class DeleteUserPool(BaseAction):
  75     """Action to delete cognito user pool
  76 
  77     It is recommended to use a filter to avoid unwanted deletion of pools
  78 
  79     :example:
  80 
  81     .. code-block:: yaml
  82 
  83             policies:
  84               - name: user-pool-delete
  85                 resource: user-pool
  86                 actions:
  87                   - delete
  88     """
  89 
  90     schema = type_schema('delete')
  91     permissions = ("cognito-idp:DeleteUserPool",)
  92 
  93     def process(self, pools):
  94         with self.executor_factory(max_workers=2) as w:
  95             list(w.map(self.process_pool, pools))
  96 
  97     def process_pool(self, pool):
  98         client = local_session(
  99             self.manager.session_factory).client('cognito-idp')
  100         try:
  101             client.delete_user_pool(UserPoolId=pool['Id'])
  102         except ClientError as e:
  103             self.log.exception(
  104                 "Exception deleting user pool:\n %s" % e)
  105
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/c7n/resources/cognito.py b/c7n/resources/cognito.py
  --- a/c7n/resources/cognito.py
  +++ b/c7n/resources/cognito.py
  @@ -4,10 +4,21 @@
   
   from c7n.actions import BaseAction
   from c7n.manager import resources
  -from c7n.query import QueryResourceManager, TypeInfo
  +from c7n.query import QueryResourceManager, TypeInfo, DescribeSource
  +from c7n.tags import universal_augment
   from c7n.utils import local_session, type_schema
   
   
  +class DescribeIdentityPool(DescribeSource):
  +    def augment(self, resources):
  +        return universal_augment(self.manager, resources)
  +
  +
  +class DescribeUserPool(DescribeSource):
  +    def augment(self, resources):
  +        return universal_augment(self.manager, resources)
  +
  +
   @resources.register('identity-pool')
   class CognitoIdentityPool(QueryResourceManager):
   
  @@ -20,6 +31,11 @@
           name = 'IdentityPoolName'
           arn_type = "identitypool"
           cfn_type = 'AWS::Cognito::IdentityPool'
  +        universal_taggable = object()
  +
  +    source_mapping = {
  +        'describe': DescribeIdentityPool,
  +    }
   
   
   @CognitoIdentityPool.action_registry.register('delete')
  @@ -69,6 +85,10 @@
           arn_type = "userpool"
           cfn_type = 'AWS::Cognito::UserPool'
   
  +    source_mapping = {
  +        'describe': DescribeUserPool,
  +    }
  +
   
   @CognitoUserPool.action_registry.register('delete')
   class DeleteUserPool(BaseAction):
  
verification_info: {"golden_diff": "diff --git a/c7n/resources/cognito.py b/c7n/resources/cognito.py\n--- a/c7n/resources/cognito.py\n+++ b/c7n/resources/cognito.py\n@@ -4,10 +4,21 @@\n \n from c7n.actions import BaseAction\n from c7n.manager import resources\n-from c7n.query import QueryResourceManager, TypeInfo\n+from c7n.query import QueryResourceManager, TypeInfo, DescribeSource\n+from c7n.tags import universal_augment\n from c7n.utils import local_session, type_schema\n \n \n+class DescribeIdentityPool(DescribeSource):\n+    def augment(self, resources):\n+        return universal_augment(self.manager, resources)\n+\n+\n+class DescribeUserPool(DescribeSource):\n+    def augment(self, resources):\n+        return universal_augment(self.manager, resources)\n+\n+\n @resources.register('identity-pool')\n class CognitoIdentityPool(QueryResourceManager):\n \n@@ -20,6 +31,11 @@\n         name = 'IdentityPoolName'\n         arn_type = \"identitypool\"\n         cfn_type = 'AWS::Cognito::IdentityPool'\n+        universal_taggable = object()\n+\n+    source_mapping = {\n+        'describe': DescribeIdentityPool,\n+    }\n \n \n @CognitoIdentityPool.action_registry.register('delete')\n@@ -69,6 +85,10 @@\n         arn_type = \"userpool\"\n         cfn_type = 'AWS::Cognito::UserPool'\n \n+    source_mapping = {\n+        'describe': DescribeUserPool,\n+    }\n+\n \n @CognitoUserPool.action_registry.register('delete')\n class DeleteUserPool(BaseAction):\n", "issue": "Any way to filter on tags for Cognito identity-pool or user-pool?\n### Discussed in https://github.com/orgs/cloud-custodian/discussions/7616\r\n\r\n<div type='discussions-op-text'>\r\n\r\n<sup>Originally posted by **stepkirk** August  5, 2022</sup>\r\nWe normally enforce tags on AWS resources by using Custodian to look for certain required tags on a resource and then, if the tags don't exist or aren't in the correct format, we mark the resource for deletion after a certain grace period. With the Cognito identity-pool and user-pool resources, it doesn't look like we can check for tags the normal way and it doesn't look like we can mark a resource for later deletion. Is that true or am I missing something?\r\n\r\nAny plans to add tagging/marking support in the future for these Cognito resources?</div>\n", "before_files": [{"content": "# Copyright The Cloud Custodian Authors.\n# SPDX-License-Identifier: Apache-2.0\nfrom botocore.exceptions import ClientError\n\nfrom c7n.actions import BaseAction\nfrom c7n.manager import resources\nfrom c7n.query import QueryResourceManager, TypeInfo\nfrom c7n.utils import local_session, type_schema\n\n\n@resources.register('identity-pool')\nclass CognitoIdentityPool(QueryResourceManager):\n\n    class resource_type(TypeInfo):\n        service = 'cognito-identity'\n        enum_spec = ('list_identity_pools', 'IdentityPools', {'MaxResults': 60})\n        detail_spec = (\n            'describe_identity_pool', 'IdentityPoolId', 'IdentityPoolId', None)\n        id = 'IdentityPoolId'\n        name = 'IdentityPoolName'\n        arn_type = \"identitypool\"\n        cfn_type = 'AWS::Cognito::IdentityPool'\n\n\n@CognitoIdentityPool.action_registry.register('delete')\nclass DeleteIdentityPool(BaseAction):\n    \"\"\"Action to delete cognito identity pool\n\n    It is recommended to use a filter to avoid unwanted deletion of pools\n\n    :example:\n\n    .. code-block:: yaml\n\n            policies:\n              - name: identity-pool-delete\n                resource: identity-pool\n                actions:\n                  - delete\n    \"\"\"\n\n    schema = type_schema('delete')\n    permissions = (\"cognito-identity:DeleteIdentityPool\",)\n\n    def process(self, pools):\n        with self.executor_factory(max_workers=2) as w:\n            list(w.map(self.process_pool, pools))\n\n    def process_pool(self, pool):\n        client = local_session(\n            self.manager.session_factory).client('cognito-identity')\n        try:\n            client.delete_identity_pool(IdentityPoolId=pool['IdentityPoolId'])\n        except ClientError as e:\n            self.log.exception(\n                \"Exception deleting identity pool:\\n %s\" % e)\n\n\n@resources.register('user-pool')\nclass CognitoUserPool(QueryResourceManager):\n\n    class resource_type(TypeInfo):\n        service = \"cognito-idp\"\n        enum_spec = ('list_user_pools', 'UserPools', {'MaxResults': 60})\n        detail_spec = (\n            'describe_user_pool', 'UserPoolId', 'Id', 'UserPool')\n        id = 'Id'\n        name = 'Name'\n        arn_type = \"userpool\"\n        cfn_type = 'AWS::Cognito::UserPool'\n\n\n@CognitoUserPool.action_registry.register('delete')\nclass DeleteUserPool(BaseAction):\n    \"\"\"Action to delete cognito user pool\n\n    It is recommended to use a filter to avoid unwanted deletion of pools\n\n    :example:\n\n    .. code-block:: yaml\n\n            policies:\n              - name: user-pool-delete\n                resource: user-pool\n                actions:\n                  - delete\n    \"\"\"\n\n    schema = type_schema('delete')\n    permissions = (\"cognito-idp:DeleteUserPool\",)\n\n    def process(self, pools):\n        with self.executor_factory(max_workers=2) as w:\n            list(w.map(self.process_pool, pools))\n\n    def process_pool(self, pool):\n        client = local_session(\n            self.manager.session_factory).client('cognito-idp')\n        try:\n            client.delete_user_pool(UserPoolId=pool['Id'])\n        except ClientError as e:\n            self.log.exception(\n                \"Exception deleting user pool:\\n %s\" % e)\n", "path": "c7n/resources/cognito.py"}], "after_files": [{"content": "# Copyright The Cloud Custodian Authors.\n# SPDX-License-Identifier: Apache-2.0\nfrom botocore.exceptions import ClientError\n\nfrom c7n.actions import BaseAction\nfrom c7n.manager import resources\nfrom c7n.query import QueryResourceManager, TypeInfo, DescribeSource\nfrom c7n.tags import universal_augment\nfrom c7n.utils import local_session, type_schema\n\n\nclass DescribeIdentityPool(DescribeSource):\n    def augment(self, resources):\n        return universal_augment(self.manager, resources)\n\n\nclass DescribeUserPool(DescribeSource):\n    def augment(self, resources):\n        return universal_augment(self.manager, resources)\n\n\n@resources.register('identity-pool')\nclass CognitoIdentityPool(QueryResourceManager):\n\n    class resource_type(TypeInfo):\n        service = 'cognito-identity'\n        enum_spec = ('list_identity_pools', 'IdentityPools', {'MaxResults': 60})\n        detail_spec = (\n            'describe_identity_pool', 'IdentityPoolId', 'IdentityPoolId', None)\n        id = 'IdentityPoolId'\n        name = 'IdentityPoolName'\n        arn_type = \"identitypool\"\n        cfn_type = 'AWS::Cognito::IdentityPool'\n        universal_taggable = object()\n\n    source_mapping = {\n        'describe': DescribeIdentityPool,\n    }\n\n\n@CognitoIdentityPool.action_registry.register('delete')\nclass DeleteIdentityPool(BaseAction):\n    \"\"\"Action to delete cognito identity pool\n\n    It is recommended to use a filter to avoid unwanted deletion of pools\n\n    :example:\n\n    .. code-block:: yaml\n\n            policies:\n              - name: identity-pool-delete\n                resource: identity-pool\n                actions:\n                  - delete\n    \"\"\"\n\n    schema = type_schema('delete')\n    permissions = (\"cognito-identity:DeleteIdentityPool\",)\n\n    def process(self, pools):\n        with self.executor_factory(max_workers=2) as w:\n            list(w.map(self.process_pool, pools))\n\n    def process_pool(self, pool):\n        client = local_session(\n            self.manager.session_factory).client('cognito-identity')\n        try:\n            client.delete_identity_pool(IdentityPoolId=pool['IdentityPoolId'])\n        except ClientError as e:\n            self.log.exception(\n                \"Exception deleting identity pool:\\n %s\" % e)\n\n\n@resources.register('user-pool')\nclass CognitoUserPool(QueryResourceManager):\n\n    class resource_type(TypeInfo):\n        service = \"cognito-idp\"\n        enum_spec = ('list_user_pools', 'UserPools', {'MaxResults': 60})\n        detail_spec = (\n            'describe_user_pool', 'UserPoolId', 'Id', 'UserPool')\n        id = 'Id'\n        name = 'Name'\n        arn_type = \"userpool\"\n        cfn_type = 'AWS::Cognito::UserPool'\n\n    source_mapping = {\n        'describe': DescribeUserPool,\n    }\n\n\n@CognitoUserPool.action_registry.register('delete')\nclass DeleteUserPool(BaseAction):\n    \"\"\"Action to delete cognito user pool\n\n    It is recommended to use a filter to avoid unwanted deletion of pools\n\n    :example:\n\n    .. code-block:: yaml\n\n            policies:\n              - name: user-pool-delete\n                resource: user-pool\n                actions:\n                  - delete\n    \"\"\"\n\n    schema = type_schema('delete')\n    permissions = (\"cognito-idp:DeleteUserPool\",)\n\n    def process(self, pools):\n        with self.executor_factory(max_workers=2) as w:\n            list(w.map(self.process_pool, pools))\n\n    def process_pool(self, pool):\n        client = local_session(\n            self.manager.session_factory).client('cognito-idp')\n        try:\n            client.delete_user_pool(UserPoolId=pool['Id'])\n        except ClientError as e:\n            self.log.exception(\n                \"Exception deleting user pool:\\n %s\" % e)\n", "path": "c7n/resources/cognito.py"}]}