Security Groups Detect And Remediate with exception

[joyceol]

Hello,

I'm creating a policy to remediate Security Groups open to the Internet, using the example: https://cloudcustodian.io/docs/usecases/securitygroupsdetectremediate.html

But, I need to add an exception to some Security Groups with a specific Tag.

So, the Security Group with the tag: exception will not be remediated.

For that, I tried a few filters:

    filters:
      - or:
        - type: ingress
          Ports: *sg_block_ports
          Cidr:
            value: "0.0.0.0/0"
        - type: ingress
          Ports: *sg_block_ports
          CidrV6:
            value: "::/0"
        - type: ingress
          SGReferences:
            key: "tag:exception"
            value: "test"
            op: not-equal

and

  filters:
      - or:
        - type: ingress
          Ports: *sg_block_ports
          Cidr:
            value: "0.0.0.0/0"
        - "tag:exception": not-null  
        - type: ingress
          Ports: *sg_block_ports
          CidrV6:
            value: "::/0"
        - "tag:exception": not-null

But the remediation happens the same way.