aws

• asg - use mixed instances policy launch template if present (#5006)
• aws - account glue encryption filter (#4338)
• aws - appelb web-acl filter restore support for any webacl (#5148)
• aws - aurora cluster and snapshot using resource group tagging (#4941)
• aws - backup plan tag action/filters and bug fix (#5252)
• aws - cloud trail tagging augment/actions/filters (#5100)
• aws - config s3 normalization of location for us-east-1 buckets (#4891)
• aws - ebs snapshot action, copy-volume-tags when Snapshotting (#5119)
• aws - ec2 - start action - add new error code for graviton instances insufficient capacity (#5244)
• aws - ec2 - set-monitoring action (#5268)
• aws - ecr set-immutable & set-scanning actions (#5062)
• aws - eks tag actions/filters (#5061)
• aws - eks tag normalization (#4947)
• aws - enabled region check for --region all (#4866)
• aws - fix cloud watch log group name construction (#5014)
• aws - fix typo in account registry names (#5083)
• aws - flow-log filter handle s3 destinations when checking log-groups and log-format support (#5149)
• aws - glacier - support name for id instead of arn (#5168)
• aws - iam policy is "used" if it is used as a permissions boundary (#4989)
• aws - iam-user - allow access key filter chaining (#5233)
• aws - kinesis firehose and analytics tagging (#5051)
• aws - lightsail-db - fix resource type describe metadata (#5257)
• aws - phd mode - allow 'events' to be optional on account resource (#5066)
• aws - phd mode - fix all events support (#5133)
• aws - phd mode use global health endpoint in us-east-1 (#5147)
• aws - python 3.8 lambda policy support in schema (#5219)
• aws - rds upgrade filter and action fix pagination of available engine versions (#5058)
• aws - redshift filter & action for logging (#5179)
• aws - rest-stage fix tag, untag operation (#5022)
• aws - retries for config rule put to workaround iam eventual consistency (#4859)
• aws - revert sts regional endpoints (#4900)
• aws - route53 domain - simplify and retry tag augment (#5198)
• aws - sechub custom action uses self filtering pattern (#5042)
• aws - security group ingress/egress filters - ToPort and FromPort update schema to support full value filters, not just integers. (#5000)
• aws - security hub - allow post finding to up date record state (#5223)
• aws - security hub - hub modes support cross account execution (#5230)
• aws - ssm ops center - restrict dedupe size per breaking api change (#5025)
• aws - storage gateway tagging augment bug fix (#4933)
• aws - storage gateway tags (#4767)
• aws - sts global region default, don't pass endpoint url, release - 0.8.45.3 (#5052)
• aws - sts regional endpoint support (#4875)
• aws - sts regional endpoints are off by default for now (#5043)
• aws - universal augment arn type check (#4981)
• aws - use sts regional endpoints revisit (#4987)
• aws - validate and fix iam permission annotations (#5242)
• aws.rds - modify sg action fix missing vpcid expression when using sg names (#4867)
• aws.rds-snapshot - default create time if not present to None (#4975)
• aws.redshift-snapshot - fix tag augment and actions (#4990)
• aws.rest-api - delete action (#4954)
• aws.route53 - set query logging bug fix (#4869)

azure

• azure - Added documentation on using resource tags (#4917)
• azure - Update lock prefixing (#4895)
• azure - Update nightly tests paths (#4904)
• azure - add azure resource graph as a query provider (#4924)
• azure - add extra exception type (#5045)
• azure - add patch for auth in tests (#4843)
• azure - add support for azure search resource (#4996)
• azure - added lock name and notes feature to lock action (#4824)
• azure - aliasing for key vault keys (#4896)
• azure - arm resource type validation (#4935)
• azure - container host docs (#4800)
• azure - container host mp (#4831)
• azure - disable flaky tests for now (#5104)
• azure - doc updates (#4883)
• azure - event resource type validation (#4923)
• azure - fix Azure nightly tests (#5060)
• azure - fix cosmos db test (#4880)
• azure - fix merge (#4960)
• azure - fix metrics dimension (#4888)
• azure - fix nic effective route test (#5117)
• azure - function increase timeout and logging (#5114)
• azure - include report example in getting started (#4835)
• azure - log and metric tweaks (#4865)
• azure - pin major version for azure storage sdks (#5019)
• azure - refactor lock action test & replace expensive sku (#5151)
• azure - resource type in app insights log (#4902)
• azure - review default fields (#4804)
• azure - sql firewall action (#4811)
• azure - test regressions(#4914)
• azure - tests folder rearrangement (#4840)
• azure - update AppServicePlan & Subscription tests (#4928)
• azure - update tests for azure sdk breaking change (#4889)
• azure - updated functions structure & updated azure-mgmt-resource (#5035)
• azure - use bash to run nightly tests & use LKG commit for sphinx_rtd_theme (#4909)

core

• c7n - resource aliases (#4699)
• cli - report - fix --raw output on py3 encode (#5274)
• cli - run add support for multiple --policies and --resource arguments (#4897)
• cli - validate - structure parsing should exit 1 on error (#5101)
• core - dependency updates (#4638)
• core - extend structure validation to policy verification (#4982)
• core - fix bag/config attribute mutation (#5081)
• core - frozen requirements generator (#5127)
• core - improve missing provider import error (#5150)
• core - move structure parsing to separate module (#4986)
• core - schema semantic error should handle filters/actions with a resource key (#5005)
• core - structural parser for more better top level error messages (#4967)
• core - update dependency freezes (#5120)
• core - value filter add a version value type (#4936)
• core - webhook action - use date aware json serializer (#4951)
• docker - exclude .git directory from docker build context (#4991)

docs

• docs - additional mugc information (#5107)
• docs - mailer - add more info about custom owner contact tags (#5210)
• docs - minor readme corrections in additional tools section (#5126)
• docs - security hub - document mapping from CloudCustodian attributes to the ASFF (#5192)
• docs - security hub - post-finding add schema defaults (#5190)
• docs - update iam policy document for quick start (#5176
• docs - gcp regex example update description, add quotes and more examples (#5263)

gcp

• gcp - label/tagging actions/filters support (#5015)
• gcp - set iam policy action for resource manager resources (#4894)
• gcp - actions fix ignore_error_codes name typo (#4978)
• gcp - add option to set project_id where to save metrics (#5002)
• gcp - disk snapshot - allow user formatting of name (#5053)
• gcp - entrypoint import common infra modules for registration (#4976)
• gcp - fix disk snapshot action and add option to delete disks (#4930)
• gcp - offhours fix default label value (#4995)
• gcp - pubsub add option to delete subscriptions/topics/snapshots (#5033)
• gcp -load balancer delete address action (#4974)

tests

• build - publish docker nightly after functionals (#4932)
• ci - address boto3 and azure sdk install issues (#5030)
• ci - azure fix tests to work around sdk breaking change (#5195)
• ci - change additional schema validation to py3.7 runner only (#4925)
• ci - disable windows builds (#5047)
• ci - enable python 3.8 test runner (#5082)
• ci - fix another azure sdk breakage for cosmosdb mgmt (#5078)
• ci - fix some test deprecation warnings (#5099)
• ci - mailer build context (#4963)
• ci - re-enable windows runners via pywin32 pin on win32 (#5048)
• ci - switch badge url (#5103)
• ci - windows testing with pip wheel cache (#4870)
• packaging - minor release tweaks for readmes (#4850)
• tests - test infra pytest support fixture for non unittest based tests (#4919)

tools

• tools - automatic dependency pinning (#4901)
• tools/c7n-mailer - template functions add from_json as a filter (#5054)
• tools/c7n-mailer - utils fix incorrect resource_type provider prefix stripping (#5152)
• tools/c7n-mailer, azure - update templates to use full path (#4913)
• tools/c7n-mailer - fix format util for cloudtrail (#5272)
• tools/c7n-org - aws account id regex schema validation (#5077)
• tools/c7n-org - run-script exit(1) on failure (#5131)
• tools/c7n-trailcreator - fix athena loading and update readme (#5135)
• tools/c7n_mailer - add mailer logging of provisioned lambda region (#4882)
• tools/c7n_mailer - fix tests, update doc build (#4979)
• tools/c7n_mailer - handle plaintext response from Slack Webhook API (#4654)
• tools/c7n_mailer - slack default template add newline as delimiter for resources (#4656)
• tools/c7n_mailer - update dependencies (#4910)
• tools/c7n_org - fix vars usage for gcp and azure accounts (#5010)
• tools/c7n_org - respect policy region (#4868)
• tools/dev - changelog generator support since date and a few more aliases (#5141)
• tools/dev - changelog tool (#4860)
• tools/dev - pinned package generator use mu library (#5142)
• tools/ops/mugc - fix prefix compatibility and document new features (#5098)
• tools/ops/mugc - support removal of policies in file and regex policy selection (#5067)