c7n-org: Nothing gets executed when specifying "-t" / "--tags" multiple times.

[ackjewtn]

Describe the bug

When i execute $ c7n-org run --verbose --debug -c accounts.yml -u ./policies/logs/cwl-subscriptions.yml -s output --region eu-west-1 -t path:/sandbox/cct -t path:/security

It returns

2022-01-04 16:13:13,602: c7n_org:INFO Policy resource counts Counter()

If i only specify -t once, e.g:
c7n-org run --dryrun -c accounts.yml -u ./policies/logs/cwl-subscriptions.yml -s output --region eu-west-1 -t path:/sandbox/cct or
c7n-org run --dryrun -c accounts.yml -u ./policies/logs/cwl-subscriptions.yml -s output --region eu-west-1 -t path:/security

It properly returns this for path:/security:

2022-01-04 16:19:30,692: c7n_org:INFO Policy resource counts Counter({'enable-subscription-filter-for-lambda-cwl': 57})

And this for path:/sandbox/cct

2022-01-04 16:20:10,522: c7n_org:INFO Policy resource counts Counter({'enable-subscription-filter-for-lambda-cwl': 11})

The tags exists in the config file, clearly, since it works when i only with -t once.

What did you expect to happen?

I expected that -t should work, as documented here: https://cloudcustodian.io/docs/tools/c7n-org.html#selecting-accounts-regions-policies-for-execution

Groups of accounts can also be selected for execution by specifying the -t tag filter. Account tags are specified in the config file. ie given the above accounts config file you can specify all prod accounts with -t type:prod. you can specify the -t flag multiple times or use a comma separated list.

Cloud Provider

Amazon Web Services (AWS)

Cloud Custodian version and dependency information

Please copy/paste the following info along with any bug reports:

Custodian:   0.9.13
Python:      3.8.12 (default, Aug 31 2021, 04:09:21) 
             [Clang 12.0.5 (clang-1205.0.22.9)]
Platform:    posix.uname_result(sysname='Darwin', nodename='meh', release='21.1.0', version='Darwin Kernel Version 21.1.0: Wed Oct 13 17:33:23 PDT 2021; root:xnu-8019.41.5~1/RELEASE_X86_64', machine='x86_64')
Using venv:  True
Docker: False
Installed: 

argcomplete==1.12.3
attrs==21.2.0
boto3==1.17.102
botocore==1.20.102
importlib-metadata==4.6.0
jmespath==0.10.0
jsonschema==3.2.0
pyrsistent==0.18.0
python-dateutil==2.8.1
pyyaml==5.4.1
s3transfer==0.4.2
setuptools==56.0.0
six==1.16.0
tabulate==0.8.9
typing-extensions==3.10.0.0
urllib3==1.26.6
zipp==3.4.1

Policy

policies:
  - name: enable-subscription-filter-for-lambda-cwl
    resource: aws.log-group
    filters:
      - type: value
        key: logGroupName
        op: regex
        value: '(/aws/lambda/foo-|/aws/lambda/bar-)\w+'
    actions:
      - type: invoke-lambda
        function: foobar-cwl-subscription-function
        vars:
          filterPattern: '[timestamp=*Z, request_id="*-*", event]'
          destinationArn: arn:aws:logs:eu-west-1:000000000000:destination:FoobarDestination
          roleArn: arn:aws:iam::{account_id}:role/service-role/cwl-subscription-filter.role

Relevant log/traceback output

No response

Extra information or context

No response

[kapilt]

its because multiple tags implies intersection not union

[ackjewtn]

That should probably be added to the documentation to avoid confusion in the future. Do you have any tips regarding my issue? I'd like to select multiple OU's and avoid to specify 50+ account id's

[lukczarnota]

as a workaround I've added dedicated tags for my workflow