We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Any way to filter on tags for Cognito identity-pool or user-pool?
### Discussed in https://github.com/orgs/cloud-custodian/discussions/7616

<div type='discussions-op-text'>

<sup>Originally posted by **stepkirk** August  5, 2022</sup>
We normally enforce tags on AWS resources by using Custodian to look for certain required tags on a resource and then, if the tags don't exist or aren't in the correct format, we mark the resource for deletion after a certain grace period. With the Cognito identity-pool and user-pool resources, it doesn't look like we can check for tags the normal way and it doesn't look like we can mark a resource for later deletion. Is that true or am I missing something?

Any plans to add tagging/marking support in the future for these Cognito resources?</div>

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `c7n/resources/cognito.py`
Content:
```
1 # Copyright The Cloud Custodian Authors.
2 # SPDX-License-Identifier: Apache-2.0
3 from botocore.exceptions import ClientError
4 
5 from c7n.actions import BaseAction
6 from c7n.manager import resources
7 from c7n.query import QueryResourceManager, TypeInfo
8 from c7n.utils import local_session, type_schema
9 
10 
11 @resources.register('identity-pool')
12 class CognitoIdentityPool(QueryResourceManager):
13 
14     class resource_type(TypeInfo):
15         service = 'cognito-identity'
16         enum_spec = ('list_identity_pools', 'IdentityPools', {'MaxResults': 60})
17         detail_spec = (
18             'describe_identity_pool', 'IdentityPoolId', 'IdentityPoolId', None)
19         id = 'IdentityPoolId'
20         name = 'IdentityPoolName'
21         arn_type = "identitypool"
22         cfn_type = 'AWS::Cognito::IdentityPool'
23 
24 
25 @CognitoIdentityPool.action_registry.register('delete')
26 class DeleteIdentityPool(BaseAction):
27     """Action to delete cognito identity pool
28 
29     It is recommended to use a filter to avoid unwanted deletion of pools
30 
31     :example:
32 
33     .. code-block:: yaml
34 
35             policies:
36               - name: identity-pool-delete
37                 resource: identity-pool
38                 actions:
39                   - delete
40     """
41 
42     schema = type_schema('delete')
43     permissions = ("cognito-identity:DeleteIdentityPool",)
44 
45     def process(self, pools):
46         with self.executor_factory(max_workers=2) as w:
47             list(w.map(self.process_pool, pools))
48 
49     def process_pool(self, pool):
50         client = local_session(
51             self.manager.session_factory).client('cognito-identity')
52         try:
53             client.delete_identity_pool(IdentityPoolId=pool['IdentityPoolId'])
54         except ClientError as e:
55             self.log.exception(
56                 "Exception deleting identity pool:\n %s" % e)
57 
58 
59 @resources.register('user-pool')
60 class CognitoUserPool(QueryResourceManager):
61 
62     class resource_type(TypeInfo):
63         service = "cognito-idp"
64         enum_spec = ('list_user_pools', 'UserPools', {'MaxResults': 60})
65         detail_spec = (
66             'describe_user_pool', 'UserPoolId', 'Id', 'UserPool')
67         id = 'Id'
68         name = 'Name'
69         arn_type = "userpool"
70         cfn_type = 'AWS::Cognito::UserPool'
71 
72 
73 @CognitoUserPool.action_registry.register('delete')
74 class DeleteUserPool(BaseAction):
75     """Action to delete cognito user pool
76 
77     It is recommended to use a filter to avoid unwanted deletion of pools
78 
79     :example:
80 
81     .. code-block:: yaml
82 
83             policies:
84               - name: user-pool-delete
85                 resource: user-pool
86                 actions:
87                   - delete
88     """
89 
90     schema = type_schema('delete')
91     permissions = ("cognito-idp:DeleteUserPool",)
92 
93     def process(self, pools):
94         with self.executor_factory(max_workers=2) as w:
95             list(w.map(self.process_pool, pools))
96 
97     def process_pool(self, pool):
98         client = local_session(
99             self.manager.session_factory).client('cognito-idp')
100         try:
101             client.delete_user_pool(UserPoolId=pool['Id'])
102         except ClientError as e:
103             self.log.exception(
104                 "Exception deleting user pool:\n %s" % e)
105
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/c7n/resources/cognito.py b/c7n/resources/cognito.py
--- a/c7n/resources/cognito.py
+++ b/c7n/resources/cognito.py
@@ -4,10 +4,21 @@
 
 from c7n.actions import BaseAction
 from c7n.manager import resources
-from c7n.query import QueryResourceManager, TypeInfo
+from c7n.query import QueryResourceManager, TypeInfo, DescribeSource
+from c7n.tags import universal_augment
 from c7n.utils import local_session, type_schema
 
 
+class DescribeIdentityPool(DescribeSource):
+    def augment(self, resources):
+        return universal_augment(self.manager, resources)
+
+
+class DescribeUserPool(DescribeSource):
+    def augment(self, resources):
+        return universal_augment(self.manager, resources)
+
+
 @resources.register('identity-pool')
 class CognitoIdentityPool(QueryResourceManager):
 
@@ -20,6 +31,11 @@
         name = 'IdentityPoolName'
         arn_type = "identitypool"
         cfn_type = 'AWS::Cognito::IdentityPool'
+        universal_taggable = object()
+
+    source_mapping = {
+        'describe': DescribeIdentityPool,
+    }
 
 
 @CognitoIdentityPool.action_registry.register('delete')
@@ -69,6 +85,10 @@
         arn_type = "userpool"
         cfn_type = 'AWS::Cognito::UserPool'
 
+    source_mapping = {
+        'describe': DescribeUserPool,
+    }
+
 
 @CognitoUserPool.action_registry.register('delete')
 class DeleteUserPool(BaseAction):

{"golden_diff": "diff --git a/c7n/resources/cognito.py b/c7n/resources/cognito.py\n--- a/c7n/resources/cognito.py\n+++ b/c7n/resources/cognito.py\n@@ -4,10 +4,21 @@\n \n from c7n.actions import BaseAction\n from c7n.manager import resources\n-from c7n.query import QueryResourceManager, TypeInfo\n+from c7n.query import QueryResourceManager, TypeInfo, DescribeSource\n+from c7n.tags import universal_augment\n from c7n.utils import local_session, type_schema\n \n \n+class DescribeIdentityPool(DescribeSource):\n+    def augment(self, resources):\n+        return universal_augment(self.manager, resources)\n+\n+\n+class DescribeUserPool(DescribeSource):\n+    def augment(self, resources):\n+        return universal_augment(self.manager, resources)\n+\n+\n @resources.register('identity-pool')\n class CognitoIdentityPool(QueryResourceManager):\n \n@@ -20,6 +31,11 @@\n         name = 'IdentityPoolName'\n         arn_type = \"identitypool\"\n         cfn_type = 'AWS::Cognito::IdentityPool'\n+        universal_taggable = object()\n+\n+    source_mapping = {\n+        'describe': DescribeIdentityPool,\n+    }\n \n \n @CognitoIdentityPool.action_registry.register('delete')\n@@ -69,6 +85,10 @@\n         arn_type = \"userpool\"\n         cfn_type = 'AWS::Cognito::UserPool'\n \n+    source_mapping = {\n+        'describe': DescribeUserPool,\n+    }\n+\n \n @CognitoUserPool.action_registry.register('delete')\n class DeleteUserPool(BaseAction):\n", "issue": "Any way to filter on tags for Cognito identity-pool or user-pool?\n### Discussed in https://github.com/orgs/cloud-custodian/discussions/7616\r\n\r\n<div type='discussions-op-text'>\r\n\r\n<sup>Originally posted by **stepkirk** August  5, 2022</sup>\r\nWe normally enforce tags on AWS resources by using Custodian to look for certain required tags on a resource and then, if the tags don't exist or aren't in the correct format, we mark the resource for deletion after a certain grace period. With the Cognito identity-pool and user-pool resources, it doesn't look like we can check for tags the normal way and it doesn't look like we can mark a resource for later deletion. Is that true or am I missing something?\r\n\r\nAny plans to add tagging/marking support in the future for these Cognito resources?</div>\n", "before_files": [{"content": "# Copyright The Cloud Custodian Authors.\n# SPDX-License-Identifier: Apache-2.0\nfrom botocore.exceptions import ClientError\n\nfrom c7n.actions import BaseAction\nfrom c7n.manager import resources\nfrom c7n.query import QueryResourceManager, TypeInfo\nfrom c7n.utils import local_session, type_schema\n\n\n@resources.register('identity-pool')\nclass CognitoIdentityPool(QueryResourceManager):\n\n    class resource_type(TypeInfo):\n        service = 'cognito-identity'\n        enum_spec = ('list_identity_pools', 'IdentityPools', {'MaxResults': 60})\n        detail_spec = (\n            'describe_identity_pool', 'IdentityPoolId', 'IdentityPoolId', None)\n        id = 'IdentityPoolId'\n        name = 'IdentityPoolName'\n        arn_type = \"identitypool\"\n        cfn_type = 'AWS::Cognito::IdentityPool'\n\n\n@CognitoIdentityPool.action_registry.register('delete')\nclass DeleteIdentityPool(BaseAction):\n    \"\"\"Action to delete cognito identity pool\n\n    It is recommended to use a filter to avoid unwanted deletion of pools\n\n    :example:\n\n    .. code-block:: yaml\n\n            policies:\n              - name: identity-pool-delete\n                resource: identity-pool\n                actions:\n                  - delete\n    \"\"\"\n\n    schema = type_schema('delete')\n    permissions = (\"cognito-identity:DeleteIdentityPool\",)\n\n    def process(self, pools):\n        with self.executor_factory(max_workers=2) as w:\n            list(w.map(self.process_pool, pools))\n\n    def process_pool(self, pool):\n        client = local_session(\n            self.manager.session_factory).client('cognito-identity')\n        try:\n            client.delete_identity_pool(IdentityPoolId=pool['IdentityPoolId'])\n        except ClientError as e:\n            self.log.exception(\n                \"Exception deleting identity pool:\\n %s\" % e)\n\n\n@resources.register('user-pool')\nclass CognitoUserPool(QueryResourceManager):\n\n    class resource_type(TypeInfo):\n        service = \"cognito-idp\"\n        enum_spec = ('list_user_pools', 'UserPools', {'MaxResults': 60})\n        detail_spec = (\n            'describe_user_pool', 'UserPoolId', 'Id', 'UserPool')\n        id = 'Id'\n        name = 'Name'\n        arn_type = \"userpool\"\n        cfn_type = 'AWS::Cognito::UserPool'\n\n\n@CognitoUserPool.action_registry.register('delete')\nclass DeleteUserPool(BaseAction):\n    \"\"\"Action to delete cognito user pool\n\n    It is recommended to use a filter to avoid unwanted deletion of pools\n\n    :example:\n\n    .. code-block:: yaml\n\n            policies:\n              - name: user-pool-delete\n                resource: user-pool\n                actions:\n                  - delete\n    \"\"\"\n\n    schema = type_schema('delete')\n    permissions = (\"cognito-idp:DeleteUserPool\",)\n\n    def process(self, pools):\n        with self.executor_factory(max_workers=2) as w:\n            list(w.map(self.process_pool, pools))\n\n    def process_pool(self, pool):\n        client = local_session(\n            self.manager.session_factory).client('cognito-idp')\n        try:\n            client.delete_user_pool(UserPoolId=pool['Id'])\n        except ClientError as e:\n            self.log.exception(\n                \"Exception deleting user pool:\\n %s\" % e)\n", "path": "c7n/resources/cognito.py"}], "after_files": [{"content": "# Copyright The Cloud Custodian Authors.\n# SPDX-License-Identifier: Apache-2.0\nfrom botocore.exceptions import ClientError\n\nfrom c7n.actions import BaseAction\nfrom c7n.manager import resources\nfrom c7n.query import QueryResourceManager, TypeInfo, DescribeSource\nfrom c7n.tags import universal_augment\nfrom c7n.utils import local_session, type_schema\n\n\nclass DescribeIdentityPool(DescribeSource):\n    def augment(self, resources):\n        return universal_augment(self.manager, resources)\n\n\nclass DescribeUserPool(DescribeSource):\n    def augment(self, resources):\n        return universal_augment(self.manager, resources)\n\n\n@resources.register('identity-pool')\nclass CognitoIdentityPool(QueryResourceManager):\n\n    class resource_type(TypeInfo):\n        service = 'cognito-identity'\n        enum_spec = ('list_identity_pools', 'IdentityPools', {'MaxResults': 60})\n        detail_spec = (\n            'describe_identity_pool', 'IdentityPoolId', 'IdentityPoolId', None)\n        id = 'IdentityPoolId'\n        name = 'IdentityPoolName'\n        arn_type = \"identitypool\"\n        cfn_type = 'AWS::Cognito::IdentityPool'\n        universal_taggable = object()\n\n    source_mapping = {\n        'describe': DescribeIdentityPool,\n    }\n\n\n@CognitoIdentityPool.action_registry.register('delete')\nclass DeleteIdentityPool(BaseAction):\n    \"\"\"Action to delete cognito identity pool\n\n    It is recommended to use a filter to avoid unwanted deletion of pools\n\n    :example:\n\n    .. code-block:: yaml\n\n            policies:\n              - name: identity-pool-delete\n                resource: identity-pool\n                actions:\n                  - delete\n    \"\"\"\n\n    schema = type_schema('delete')\n    permissions = (\"cognito-identity:DeleteIdentityPool\",)\n\n    def process(self, pools):\n        with self.executor_factory(max_workers=2) as w:\n            list(w.map(self.process_pool, pools))\n\n    def process_pool(self, pool):\n        client = local_session(\n            self.manager.session_factory).client('cognito-identity')\n        try:\n            client.delete_identity_pool(IdentityPoolId=pool['IdentityPoolId'])\n        except ClientError as e:\n            self.log.exception(\n                \"Exception deleting identity pool:\\n %s\" % e)\n\n\n@resources.register('user-pool')\nclass CognitoUserPool(QueryResourceManager):\n\n    class resource_type(TypeInfo):\n        service = \"cognito-idp\"\n        enum_spec = ('list_user_pools', 'UserPools', {'MaxResults': 60})\n        detail_spec = (\n            'describe_user_pool', 'UserPoolId', 'Id', 'UserPool')\n        id = 'Id'\n        name = 'Name'\n        arn_type = \"userpool\"\n        cfn_type = 'AWS::Cognito::UserPool'\n\n    source_mapping = {\n        'describe': DescribeUserPool,\n    }\n\n\n@CognitoUserPool.action_registry.register('delete')\nclass DeleteUserPool(BaseAction):\n    \"\"\"Action to delete cognito user pool\n\n    It is recommended to use a filter to avoid unwanted deletion of pools\n\n    :example:\n\n    .. code-block:: yaml\n\n            policies:\n              - name: user-pool-delete\n                resource: user-pool\n                actions:\n                  - delete\n    \"\"\"\n\n    schema = type_schema('delete')\n    permissions = (\"cognito-idp:DeleteUserPool\",)\n\n    def process(self, pools):\n        with self.executor_factory(max_workers=2) as w:\n            list(w.map(self.process_pool, pools))\n\n    def process_pool(self, pool):\n        client = local_session(\n            self.manager.session_factory).client('cognito-idp')\n        try:\n            client.delete_user_pool(UserPoolId=pool['Id'])\n        except ClientError as e:\n            self.log.exception(\n                \"Exception deleting user pool:\\n %s\" % e)\n", "path": "c7n/resources/cognito.py"}]}