[jtroup]

ENG-8730

what

Merges upstream cloud-custodian a83dda5c9..e4c099e03 into
stacklet/integration and restamps the workspace onto a new alpha
series: c7n becomes 0.9.53a1+e4c099e03, with the provider and
tool packages bumped in step.

The merge was clean apart from the version fields in
pyproject.toml/c7n/version.py and the resulting uv.lock churn.
No Stacklet-side code changed.

Upstream content picked up:

• core: dynamic tagging is centralised — the "default-value with no
  key" lookup pattern now applies to Azure and GCP as well as AWS,
  and ASG-specific tag logic shares a mixin with the generic path.
• aws: new vpc-lattice-rule and SageMaker Studio (app,
  user-profile, space) resources; emr-serverless-app detail
  spec; members filter on cleanrooms collaborations; wafv2-enabled
  no longer ignores CLOUDFRONT scope; ForAnyValue handling in the
  cross-account filter; InternalServerException retried by default;
  IAM tag updates retried on concurrent modification; configurable
  server-side encryption for S3 policy log output.
• azure: function app deployment uses an Entra ID bearer token instead
  of SCM basic auth; new budget, private DNS zone/record set and
  machine-learning-model-version resources; machine learning job
  archive action.
• gcp: region-parented resources enumerate correctly when no explicit
  region is given; disk actions support regional persistent disks;
  cloud-run label mutations drop non-schema fields; notebook-v2 get
  and update-metadata actions; Vertex AI evaluation run resource.
• k8s: resource listing follows pagination continuation tokens.
• c7n-org: orgaccounts.py reads State rather than Status when
  deciding whether an account is active.

Upstream's 2026-08 dependency refresh is included.

---

🤖 Generated with Claude Code

[greptile-apps]

Too many files changed for review (258 files, 100 file limit).

Bypass the limit by tagging @greptile-apps to review.

[cubic-dev-ai]

21 issues found across 258 files

Not reviewed (too large): tools/c7n_gcp/tests/data/flights/disk-regional-delete/get-compute.googleapis.com-compute-v1-projects-cloud-custodian-aggregated-disks_1.json (~2,136 lines), tools/c7n_gcp/tests/data/flights/disk-regional-label/get-compute.googleapis.com-compute-v1-projects-cloud-custodian-aggregated-disks_1.json (~2,136 lines), tools/c7n_gcp/tests/data/flights/disk-regional-snapshot/get-compute.googleapis.com-compute-v1-projects-cloud-custodian-aggregated-disks_1.json (~2,136 lines) - if these are generated or fixture files, add them to ignored paths to exclude them from future reviews.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="tools/c7n_azure/tests_azure/templates/machine-learning-model-version.json">

<violation number="1" location="tools/c7n_azure/tests_azure/templates/machine-learning-model-version.json:77">
P2: During fixture provisioning, ARM passes `{sub}`, `{rg}`, and `{ws}` literally, so Azure ML receives an invalid datastore URI instead of the deployed workspace URI. Build this value with `subscription().subscriptionId`, `resourceGroup().name`, and `variables('workspaceName')` in both model-version resources.</violation>
</file>

<file name="tests/terraform/lattice_rule_query_listener/main.tf">

<violation number="1" location="tests/terraform/lattice_rule_query_listener/main.tf:46">
P3: The entire second resource set (test_service2/test_listener2/test_rule2, lines 46-85) is unused: test_lattice_rule_query_listener only reads the first listener's listener_id, and no other test references these resources. Remove the block so the terraform fixture doesn't provision two services when one suffices.</violation>
</file>

<file name="tools/c7n_azure/tests_azure/templates/provision.sh">

<violation number="1" location="tools/c7n_azure/tests_azure/templates/provision.sh:299">
P2: When the subscription deployment fails, `deploy_resource` still reaches the success echo and returns 0. Append `|| return 1` so `provision.sh` reports the budget provisioning failure.</violation>
</file>

<file name="c7n/resources/iam.py">

<violation number="1" location="c7n/resources/iam.py:48">
P2: These tag actions used `QueryResourceManager.retry`, which retries `InternalServerException`; this replacement drops that transient error while adding `ConcurrentModification`. Include `InternalServerException` in `_iam_tag_retry` to preserve the existing retry behavior.</violation>
</file>

<file name="tools/c7n_azure/tests_azure/templates/cleanup.sh">

<violation number="1" location="tools/c7n_azure/tests_azure/templates/cleanup.sh:40">
P2: When the script is run using the template README's documented `az account set` setup, `AZURE_SUBSCRIPTION_ID` is unset. Derive the subscription ID from `az account show` or validate the environment variable before constructing this URL, otherwise budget cleanup silently leaves both subscription budgets behind.</violation>

<violation number="2" location="tools/c7n_azure/tests_azure/templates/cleanup.sh:41">
P2: When Azure returns an HTTP error for either budget DELETE, `curl` still exits successfully without `--fail`, so cleanup reports completion and leaves the budget behind. Make both requests fail or explicitly handle their status before continuing.</violation>
</file>

<file name="c7n/resources/cleanrooms.py">

<violation number="1" location="c7n/resources/cleanrooms.py:71">
P2: When `ListMembers` fails transiently while fetching a page, this wrapper does not retry the request because `paginate()` is lazy and only returns a `PageIterator`. Configure the paginator with `RetryPageIterator` before calling `build_full_result()`.</violation>
</file>

<file name="tools/c7n_azure/tests_azure/templates/machine-learning-job-archive.json">

<violation number="1" location="tools/c7n_azure/tests_azure/templates/machine-learning-job-archive.json:89">
P2: Provisioning this test template exposes the AML compute's remote-login port publicly. Disable public remote login, or restrict it through an explicit network configuration, because this template provisions real resources in the user's subscription.</violation>
</file>

<file name="tools/ops/azure/functionslc.py">

<violation number="1" location="tools/ops/azure/functionslc.py:99">
P1: When this tool runs in Azure China, Germany, or US Government, the hard-coded hostname points at the public Azure App Service endpoint instead of that cloud's SCM endpoint. Derive the SCM URI from the app's actual hostname or the selected cloud's App Service suffix rather than hard-coding `.azurewebsites.net`.</violation>

<violation number="2" location="tools/ops/azure/functionslc.py:102">
P2: When a remote build lasts longer than the bearer token lifetime, this cached token expires while `wait_for_remote_builds` continues polling. The loop treats the resulting authentication errors as `Active` and has no timeout, so refresh the token before polling or on a 401 instead of storing one token for the entire wait.</violation>
</file>

<file name="docs/source/gcp/examples/audit-event-recording.rst">

<violation number="1" location="docs/source/gcp/examples/audit-event-recording.rst:42">
P2: This basic-usage block is not runnable as shown: `@terraform` has no import, and `project_id` and `database_id` are referenced without definitions. Add the import and initialize those values, or clearly mark the omitted context, so readers do not copy a test that fails at collection or runtime.</violation>

<violation number="2" location="docs/source/gcp/examples/audit-event-recording.rst:188">
P2: When another project ID contains the recording project ID, `_sanitize` rewrites that reference too because it performs a global string replacement. Make replacement path-aware or qualify this statement instead of promising that other project references are left alone.</violation>
</file>

<file name="tests/terraform/vpc_lattice_rule/tf_resources.json">

<violation number="1" location="tests/terraform/vpc_lattice_rule/tf_resources.json:1">
P3: The new `vpc_lattice_rule` fixture is never referenced: no test in the tree decorates `@terraform('vpc_lattice_rule')` (tests/test_lattice.py uses the `lattice_rule_*` fixtures), and its `main.tf` is byte-identical to `lattice_rule_query_service/main.tf` with the same resource set. This is an orphaned duplicate of an existing fixture; drop it (or its separate resources) to avoid maintaining two copies of the same terraform test data.</violation>
</file>

<file name="tools/c7n_azure/c7n_azure/actions/tagging.py">

<violation number="1" location="tools/c7n_azure/c7n_azure/actions/tagging.py:80">
P2: Policies such as `tags: {enabled: true}` now pass validation but send a boolean or number to Azure, which rejects the tag update instead of failing policy validation. Keep the mapping value schema string-valued, or coerce values before building the Azure tags payload.</violation>

<violation number="2" location="tools/c7n_azure/c7n_azure/actions/tagging.py:112">
P2: When an existing Azure tag differs from the policy key only by case, conditional defaults do not recognize it as present and can overwrite it with the default. Normalize both existing tag keys and the requested name before calling `Lookup.resolve_value`.</violation>
</file>

<file name="c7n/resources/sagemaker.py">

<violation number="1" location="c7n/resources/sagemaker.py:1299">
P1: Event-mode resolution fails for these resources because `DescribeSource.get_resources()` filters the list response by `resource_type.id` before `augment()` runs. Since the list summaries lack the configured ARN key, this raises `KeyError` instead of resolving the event resource; add an ID-aware `get_resources()` path that describes the event resource before filtering.</violation>
</file>

<file name="tools/c7n_azure/c7n_azure/functionapp_utils.py">

<violation number="1" location="tools/c7n_azure/c7n_azure/functionapp_utils.py:109">
P1: When deploying in Azure China, Government, or German clouds, this URI targets the public App Service hostname and cannot reach the deployed Function App. Build the SCM URI from the app's cloud-specific `default_host_name` or the API-returned `scmUri` instead of hard-coding `.azurewebsites.net`.</violation>
</file>

<file name="tools/c7n_gcp/c7n_gcp/resources/compute.py">

<violation number="1" location="tools/c7n_gcp/c7n_gcp/resources/compute.py:510">
P2: When a disk audit event omits `protoPayload.resourceName`, `ApiAuditMode` passes its zonal labels unchanged, so this access raises `KeyError` instead of resolving the disk. Fall back to the existing `project_id`/`zone`/`disk_id` fields when no path is available.</violation>
</file>

<file name="tests/data/placebo/test_distribution_wafv2_filter_scope/cloudfront.ListDistributions_1.json">

<violation number="1" location="tests/data/placebo/test_distribution_wafv2_filter_scope/cloudfront.ListDistributions_1.json:15">
P3: LastModifiedTime is serialized as a bare dict without the `__class__: "datetime"` marker that placebo's deserializer requires to reconstruct a datetime object, so on replay this field stays a plain dict instead of a datetime. The current test never reads the field, so it passes, but the fixture deviates from the format every other recorded fixture uses (see test_distribution_wafv2's ListDistributions JSON). Add `"__class__": "datetime"` so the value round-trips correctly if any test later reads it.</violation>
</file>

<file name="tools/c7n_gcp/c7n_gcp/resources/vertexai.py">

<violation number="1" location="tools/c7n_gcp/c7n_gcp/resources/vertexai.py:826">
P2: When a policy uses this documented retention example, the list response lacks `completionTime`, so the age filter matches no evaluation runs. Use a field returned by `list` such as `createTime`, or enrich each resource before filtering; remove `completionTime` from `default_report_fields` as well.</violation>
</file>

<file name="tools/c7n_azure/tests_azure/tests_resources/terraform/budget/main.tf">

<violation number="1" location="tools/c7n_azure/tests_azure/tests_resources/terraform/budget/main.tf:46">
P2: Every Terraform plan reevaluates `timestamp()`, making both budgets non-idempotent and causing an update or replacement on each run. Use a stable input or a `time_static` resource for the budget start date.</violation>
</file>

<sub>Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.
Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: When this tool runs in Azure China, Germany, or US Government, the hard-coded hostname points at the public Azure App Service endpoint instead of that cloud's SCM endpoint. Derive the SCM URI from the app's actual hostname or the selected cloud's App Service suffix rather than hard-coding .azurewebsites.net.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At tools/ops/azure/functionslc.py, line 99:

<comment>When this tool runs in Azure China, Germany, or US Government, the hard-coded hostname points at the public Azure App Service endpoint instead of that cloud's SCM endpoint. Derive the SCM URI from the app's actual hostname or the selected cloud's App Service suffix rather than hard-coding `.azurewebsites.net`.</comment>

<file context>
@@ -94,13 +95,15 @@ def cli(**kwargs):
-            deployments[p.name] = {'scm_uri': creds.scm_uri, 'status': None}
-            log.info('Retrieved deployment credentials for %s policy', p.name)
+            app_name = params.function_app['name']
+            scm_uri = 'https://{}.scm.azurewebsites.net'.format(app_name)
+            token_scope = session.cloud_endpoints.endpoints.resource_manager.rstrip('/') \
+                + '/.default'
</file context>

[cubic-dev-ai]

P1: Event-mode resolution fails for these resources because DescribeSource.get_resources() filters the list response by resource_type.id before augment() runs. Since the list summaries lack the configured ARN key, this raises KeyError instead of resolving the event resource; add an ID-aware get_resources() path that describes the event resource before filtering.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At c7n/resources/sagemaker.py, line 1299:

<comment>Event-mode resolution fails for these resources because `DescribeSource.get_resources()` filters the list response by `resource_type.id` before `augment()` runs. Since the list summaries lack the configured ARN key, this raises `KeyError` instead of resolving the event resource; add an ID-aware `get_resources()` path that describes the event resource before filtering.</comment>

<file context>
@@ -1261,3 +1261,140 @@ class resource_type(TypeInfo):
+    class resource_type(TypeInfo):
+        service = 'sagemaker'
+        enum_spec = ('list_user_profiles', 'UserProfiles', None)
+        arn = id = 'UserProfileArn'
+        name = 'UserProfileName'
+        date = 'CreationTime'
</file context>

[cubic-dev-ai]

P1: When deploying in Azure China, Government, or German clouds, this URI targets the public App Service hostname and cannot reach the deployed Function App. Build the SCM URI from the app's cloud-specific default_host_name or the API-returned scmUri instead of hard-coding .azurewebsites.net.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At tools/c7n_azure/c7n_azure/functionapp_utils.py, line 109:

<comment>When deploying in Azure China, Government, or German clouds, this URI targets the public App Service hostname and cannot reach the deployed Function App. Build the SCM URI from the app's cloud-specific `default_host_name` or the API-returned `scmUri` instead of hard-coding `.azurewebsites.net`.</comment>

<file context>
@@ -98,16 +98,20 @@ def get_function_name(policy_name, suffix):
+        # Use an Entra ID bearer token instead of SCM Basic Auth publishing credentials, so
+        # deployment works in tenants where Basic Auth is disabled by policy. Requires the
+        # deploying identity to hold Website Contributor (or equivalent) on the Function App.
+        scm_uri = 'https://{}.scm.azurewebsites.net'.format(app_name)
+        token_scope = session.cloud_endpoints.endpoints.resource_manager.rstrip('/') + '/.default'
+        token = session.get_credentials().get_token(token_scope).token
</file context>

[cubic-dev-ai]

P2: During fixture provisioning, ARM passes {sub}, {rg}, and {ws} literally, so Azure ML receives an invalid datastore URI instead of the deployed workspace URI. Build this value with subscription().subscriptionId, resourceGroup().name, and variables('workspaceName') in both model-version resources.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At tools/c7n_azure/tests_azure/templates/machine-learning-model-version.json, line 77:

<comment>During fixture provisioning, ARM passes `{sub}`, `{rg}`, and `{ws}` literally, so Azure ML receives an invalid datastore URI instead of the deployed workspace URI. Build this value with `subscription().subscriptionId`, `resourceGroup().name`, and `variables('workspaceName')` in both model-version resources.</comment>

<file context>
@@ -0,0 +1,99 @@
+            "apiVersion": "2023-04-01",
+            "name": "[format('{0}/{1}/{2}', variables('workspaceName'), parameters('modelName'), parameters('modelVersion'))]",
+            "properties": {
+                "modelUri": "azureml://subscriptions/{sub}/resourceGroups/{rg}/workspaces/{ws}/datastores/workspaceblobstore/paths/model.pkl",
+                "modelType": "CustomModel",
+                "isArchived": false
</file context>

[cubic-dev-ai]

P2: When the subscription deployment fails, deploy_resource still reaches the success echo and returns 0. Append || return 1 so provision.sh reports the budget provisioning failure.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At tools/c7n_azure/tests_azure/templates/provision.sh, line 299:

<comment>When the subscription deployment fails, `deploy_resource` still reaches the success echo and returns 0. Append `|| return 1` so `provision.sh` reports the budget provisioning failure.</comment>

<file context>
@@ -294,6 +294,10 @@ deploy_resource() {
 
+    elif [[ "$fileName" == "budget.json" ]]; then
+
+        az deployment sub create --location $resourceLocation --name cctest-budget \
+            --template-file $file --output None
     elif [[ "$fileName" == "ai-foundry-application.json" ]]; then
</file context>

Suggested change

	az deployment sub create --location $resourceLocation --name cctest-budget \
	--template-file $file --output None
	az deployment sub create --location $resourceLocation --name cctest-budget \
	--template-file $file --output None || return 1

[cubic-dev-ai]

P2: When a policy uses this documented retention example, the list response lacks completionTime, so the age filter matches no evaluation runs. Use a field returned by list such as createTime, or enrich each resource before filtering; remove completionTime from default_report_fields as well.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At tools/c7n_gcp/c7n_gcp/resources/vertexai.py, line 826:

<comment>When a policy uses this documented retention example, the list response lacks `completionTime`, so the age filter matches no evaluation runs. Use a field returned by `list` such as `createTime`, or enrich each resource before filtering; remove `completionTime` from `default_report_fields` as well.</comment>

<file context>
@@ -787,6 +784,61 @@ class resource_type(VertexAITypeInfo):
+                    key: state
+                    value: CANCELLED
+              - type: value
+                key: completionTime
+                value_type: age
+                op: greater-than
</file context>

[cubic-dev-ai]

P2: Every Terraform plan reevaluates timestamp(), making both budgets non-idempotent and causing an update or replacement on each run. Use a stable input or a time_static resource for the budget start date.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At tools/c7n_azure/tests_azure/tests_resources/terraform/budget/main.tf, line 46:

<comment>Every Terraform plan reevaluates `timestamp()`, making both budgets non-idempotent and causing an update or replacement on each run. Use a stable input or a `time_static` resource for the budget start date.</comment>

<file context>
@@ -0,0 +1,52 @@
+}
+
+locals {
+  today          = timestamp()
+  current_year   = formatdate("YYYY", local.today)
+  current_month  = formatdate("MM", local.today)
</file context>

[cubic-dev-ai]

P3: The entire second resource set (test_service2/test_listener2/test_rule2, lines 46-85) is unused: test_lattice_rule_query_listener only reads the first listener's listener_id, and no other test references these resources. Remove the block so the terraform fixture doesn't provision two services when one suffices.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At tests/terraform/lattice_rule_query_listener/main.tf, line 46:

<comment>The entire second resource set (test_service2/test_listener2/test_rule2, lines 46-85) is unused: test_lattice_rule_query_listener only reads the first listener's listener_id, and no other test references these resources. Remove the block so the terraform fixture doesn't provision two services when one suffices.</comment>

<file context>
@@ -0,0 +1,85 @@
+}
+
+
+resource "aws_vpclattice_service" "test_service2" {
+  name      = "test-service2"
+  auth_type = "NONE"
</file context>

[cubic-dev-ai]

P3: The new vpc_lattice_rule fixture is never referenced: no test in the tree decorates @terraform('vpc_lattice_rule') (tests/test_lattice.py uses the lattice_rule_* fixtures), and its main.tf is byte-identical to lattice_rule_query_service/main.tf with the same resource set. This is an orphaned duplicate of an existing fixture; drop it (or its separate resources) to avoid maintaining two copies of the same terraform test data.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At tests/terraform/vpc_lattice_rule/tf_resources.json, line 1:

<comment>The new `vpc_lattice_rule` fixture is never referenced: no test in the tree decorates `@terraform('vpc_lattice_rule')` (tests/test_lattice.py uses the `lattice_rule_*` fixtures), and its `main.tf` is byte-identical to `lattice_rule_query_service/main.tf` with the same resource set. This is an orphaned duplicate of an existing fixture; drop it (or its separate resources) to avoid maintaining two copies of the same terraform test data.</comment>

<file context>
@@ -0,0 +1,194 @@
+{
+    "pytest-terraform": 1,
+    "outputs": {},
</file context>

[cubic-dev-ai]

P3: LastModifiedTime is serialized as a bare dict without the __class__: "datetime" marker that placebo's deserializer requires to reconstruct a datetime object, so on replay this field stays a plain dict instead of a datetime. The current test never reads the field, so it passes, but the fixture deviates from the format every other recorded fixture uses (see test_distribution_wafv2's ListDistributions JSON). Add "__class__": "datetime" so the value round-trips correctly if any test later reads it.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At tests/data/placebo/test_distribution_wafv2_filter_scope/cloudfront.ListDistributions_1.json, line 15:

<comment>LastModifiedTime is serialized as a bare dict without the `__class__: "datetime"` marker that placebo's deserializer requires to reconstruct a datetime object, so on replay this field stays a plain dict instead of a datetime. The current test never reads the field, so it passes, but the fixture deviates from the format every other recorded fixture uses (see test_distribution_wafv2's ListDistributions JSON). Add `"__class__": "datetime"` so the value round-trips correctly if any test later reads it.</comment>

<file context>
@@ -0,0 +1,72 @@
+                    "Id": "E1EXAMPLE1234",
+                    "ARN": "arn:aws:cloudfront::123456789012:distribution/E1EXAMPLE1234",
+                    "Status": "Deployed",
+                    "LastModifiedTime": {
+                        "hour": 0,
+                        "microsecond": 0,
</file context>

[kevin-birkett]

Thanks @jtroup