We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
cloudtrail filter `is-shadow` always matches all resources


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `c7n/resources/cloudtrail.py`
Content:
```
1 # Copyright 2017-2019 Capital One Services, LLC
2 #
3 # Licensed under the Apache License, Version 2.0 (the "License");
4 # you may not use this file except in compliance with the License.
5 # You may obtain a copy of the License at
6 #
7 # http://www.apache.org/licenses/LICENSE-2.0
8 #
9 # Unless required by applicable law or agreed to in writing, software
10 # distributed under the License is distributed on an "AS IS" BASIS,
11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 # See the License for the specific language governing permissions and
13 # limitations under the License.
14 from __future__ import absolute_import, division, print_function, unicode_literals
15 
16 import logging
17 import operator
18 
19 from c7n.actions import Action
20 from c7n.exceptions import PolicyValidationError
21 from c7n.filters import ValueFilter, Filter
22 from c7n.manager import resources
23 from c7n.query import QueryResourceManager
24 from c7n.utils import local_session, type_schema
25 
26 from .aws import shape_validate, Arn
27 
28 log = logging.getLogger('c7n.resources.cloudtrail')
29 
30 
31 @resources.register('cloudtrail')
32 class CloudTrail(QueryResourceManager):
33 
34     class resource_type(object):
35         service = 'cloudtrail'
36         enum_spec = ('describe_trails', 'trailList', None)
37         filter_name = 'trailNameList'
38         filter_type = 'list'
39         arn = id = 'TrailARN'
40         name = 'Name'
41         dimension = None
42         config_type = "AWS::CloudTrail::Trail"
43 
44 
45 @CloudTrail.filter_registry.register('is-shadow')
46 class IsShadow(Filter):
47     """Identify shadow trails (secondary copies), shadow trails
48     can't be modified directly, the origin trail needs to be modified.
49 
50     Shadow trails are created for multi-region trails as well for
51     organizational trails.
52     """
53     schema = type_schema('is-shadow', state={'type': 'boolean'})
54     permissions = ('cloudtrail:DescribeTrails',)
55     embedded = False
56 
57     def process(self, resources, event=None):
58         anded = lambda x: True # NOQA
59         op = self.data.get('state', True) and anded or operator.__not__
60         rcount = len(resources)
61         trails = [t for t in resources if op(self.is_shadow(t))]
62         if len(trails) != rcount and self.embedded:
63             self.log.info("implicitly filtering shadow trails %d -> %d",
64                      rcount, len(trails))
65         return trails
66 
67     def is_shadow(self, t):
68         if t.get('IsOrganizationTrail') and self.manager.config.account_id not in t['TrailARN']:
69             return True
70         if t.get('IsMultiRegionTrail') and t['HomeRegion'] not in t['TrailARN']:
71             return True
72 
73 
74 @CloudTrail.filter_registry.register('status')
75 class Status(ValueFilter):
76     """Filter a cloudtrail by its status.
77 
78     :Example:
79 
80     .. code-block:: yaml
81 
82         policies:
83           - name: cloudtrail-not-active
84             resource: aws.cloudtrail
85             filters:
86             - type: status
87               key: IsLogging
88               value: False
89     """
90 
91     schema = type_schema('status', rinherit=ValueFilter.schema)
92     permissions = ('cloudtrail:GetTrailStatus',)
93     annotation_key = 'c7n:TrailStatus'
94 
95     def process(self, resources, event=None):
96         for r in resources:
97             region = self.manager.config.region
98             trail_arn = Arn.parse(r['TrailARN'])
99 
100             if (r.get('IsOrganizationTrail') and
101                     self.manager.config.account_id != trail_arn.account_id):
102                 continue
103             if r.get('HomeRegion') and r['HomeRegion'] != region:
104                 region = trail_arn.region
105             if self.annotation_key in r:
106                 continue
107             client = local_session(self.manager.session_factory).client(
108                 'cloudtrail', region_name=region)
109             status = client.get_trail_status(Name=r['Name'])
110             status.pop('ResponseMetadata')
111             r[self.annotation_key] = status
112 
113         return super(Status, self).process(resources)
114 
115     def __call__(self, r):
116         return self.match(r['c7n:TrailStatus'])
117 
118 
119 @CloudTrail.action_registry.register('update-trail')
120 class UpdateTrail(Action):
121     """Update trail attributes.
122 
123     :Example:
124 
125     .. code-block:: yaml
126 
127        policies:
128          - name: cloudtrail-set-log
129            resource: aws.cloudtrail
130            filters:
131             - or:
132               - KmsKeyId: empty
133               - LogFileValidationEnabled: false
134            actions:
135             - type: update-trail
136               attributes:
137                 KmsKeyId: arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef
138                 EnableLogFileValidation: true
139     """
140     schema = type_schema(
141         'update-trail',
142         attributes={'type': 'object'},
143         required=('attributes',))
144     shape = 'UpdateTrailRequest'
145     permissions = ('cloudtrail:UpdateTrail',)
146 
147     def validate(self):
148         attrs = dict(self.data['attributes'])
149         if 'Name' in attrs:
150             raise PolicyValidationError(
151                 "Can't include Name in update-trail action")
152         attrs['Name'] = 'PolicyValidation'
153         return shape_validate(
154             attrs,
155             self.shape,
156             self.manager.resource_type.service)
157 
158     def process(self, resources):
159         client = local_session(self.manager.session_factory).client('cloudtrail')
160         shadow_check = IsShadow({'state': False}, self.manager)
161         shadow_check.embedded = True
162         resources = shadow_check.process(resources)
163 
164         for r in resources:
165             client.update_trail(
166                 Name=r['Name'],
167                 **self.data['attributes'])
168 
169 
170 @CloudTrail.action_registry.register('set-logging')
171 class SetLogging(Action):
172     """Set the logging state of a trail
173 
174     :Example:
175 
176     .. code-block:: yaml
177 
178       policies:
179         - name: cloudtrail-not-active
180           resource: aws.cloudtrail
181           filters:
182            - type: status
183              key: IsLogging
184              value: False
185           actions:
186            - type: set-logging
187              enabled: True
188     """
189     schema = type_schema(
190         'set-logging', enabled={'type': 'boolean'})
191 
192     def get_permissions(self):
193         enable = self.data.get('enabled', True)
194         if enable is True:
195             return ('cloudtrail:StartLogging',)
196         else:
197             return ('cloudtrail:StopLogging',)
198 
199     def process(self, resources):
200         client = local_session(self.manager.session_factory).client('cloudtrail')
201         shadow_check = IsShadow({'state': False}, self.manager)
202         shadow_check.embedded = True
203         resources = shadow_check.process(resources)
204         enable = self.data.get('enabled', True)
205 
206         for r in resources:
207             if enable:
208                 client.start_logging(Name=r['Name'])
209             else:
210                 client.stop_logging(Name=r['Name'])
211
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/c7n/resources/cloudtrail.py b/c7n/resources/cloudtrail.py
--- a/c7n/resources/cloudtrail.py
+++ b/c7n/resources/cloudtrail.py
@@ -14,7 +14,6 @@
 from __future__ import absolute_import, division, print_function, unicode_literals
 
 import logging
-import operator
 
 from c7n.actions import Action
 from c7n.exceptions import PolicyValidationError
@@ -55,10 +54,8 @@
     embedded = False
 
     def process(self, resources, event=None):
-        anded = lambda x: True # NOQA
-        op = self.data.get('state', True) and anded or operator.__not__
         rcount = len(resources)
-        trails = [t for t in resources if op(self.is_shadow(t))]
+        trails = [t for t in resources if (self.is_shadow(t) == self.data.get('state', True))]
         if len(trails) != rcount and self.embedded:
             self.log.info("implicitly filtering shadow trails %d -> %d",
                      rcount, len(trails))
@@ -67,8 +64,9 @@
     def is_shadow(self, t):
         if t.get('IsOrganizationTrail') and self.manager.config.account_id not in t['TrailARN']:
             return True
-        if t.get('IsMultiRegionTrail') and t['HomeRegion'] not in t['TrailARN']:
+        if t.get('IsMultiRegionTrail') and t['HomeRegion'] != self.manager.config.region:
             return True
+        return False
 
 
 @CloudTrail.filter_registry.register('status')

{"golden_diff": "diff --git a/c7n/resources/cloudtrail.py b/c7n/resources/cloudtrail.py\n--- a/c7n/resources/cloudtrail.py\n+++ b/c7n/resources/cloudtrail.py\n@@ -14,7 +14,6 @@\n from __future__ import absolute_import, division, print_function, unicode_literals\n \n import logging\n-import operator\n \n from c7n.actions import Action\n from c7n.exceptions import PolicyValidationError\n@@ -55,10 +54,8 @@\n     embedded = False\n \n     def process(self, resources, event=None):\n-        anded = lambda x: True # NOQA\n-        op = self.data.get('state', True) and anded or operator.__not__\n         rcount = len(resources)\n-        trails = [t for t in resources if op(self.is_shadow(t))]\n+        trails = [t for t in resources if (self.is_shadow(t) == self.data.get('state', True))]\n         if len(trails) != rcount and self.embedded:\n             self.log.info(\"implicitly filtering shadow trails %d -> %d\",\n                      rcount, len(trails))\n@@ -67,8 +64,9 @@\n     def is_shadow(self, t):\n         if t.get('IsOrganizationTrail') and self.manager.config.account_id not in t['TrailARN']:\n             return True\n-        if t.get('IsMultiRegionTrail') and t['HomeRegion'] not in t['TrailARN']:\n+        if t.get('IsMultiRegionTrail') and t['HomeRegion'] != self.manager.config.region:\n             return True\n+        return False\n \n \n @CloudTrail.filter_registry.register('status')\n", "issue": "cloudtrail filter `is-shadow` always matches all resources\n\n", "before_files": [{"content": "# Copyright 2017-2019 Capital One Services, LLC\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\");\n# you may not use this file except in compliance with the License.\n# You may obtain a copy of the License at\n#\n# http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\nfrom __future__ import absolute_import, division, print_function, unicode_literals\n\nimport logging\nimport operator\n\nfrom c7n.actions import Action\nfrom c7n.exceptions import PolicyValidationError\nfrom c7n.filters import ValueFilter, Filter\nfrom c7n.manager import resources\nfrom c7n.query import QueryResourceManager\nfrom c7n.utils import local_session, type_schema\n\nfrom .aws import shape_validate, Arn\n\nlog = logging.getLogger('c7n.resources.cloudtrail')\n\n\n@resources.register('cloudtrail')\nclass CloudTrail(QueryResourceManager):\n\n    class resource_type(object):\n        service = 'cloudtrail'\n        enum_spec = ('describe_trails', 'trailList', None)\n        filter_name = 'trailNameList'\n        filter_type = 'list'\n        arn = id = 'TrailARN'\n        name = 'Name'\n        dimension = None\n        config_type = \"AWS::CloudTrail::Trail\"\n\n\n@CloudTrail.filter_registry.register('is-shadow')\nclass IsShadow(Filter):\n    \"\"\"Identify shadow trails (secondary copies), shadow trails\n    can't be modified directly, the origin trail needs to be modified.\n\n    Shadow trails are created for multi-region trails as well for\n    organizational trails.\n    \"\"\"\n    schema = type_schema('is-shadow', state={'type': 'boolean'})\n    permissions = ('cloudtrail:DescribeTrails',)\n    embedded = False\n\n    def process(self, resources, event=None):\n        anded = lambda x: True # NOQA\n        op = self.data.get('state', True) and anded or operator.__not__\n        rcount = len(resources)\n        trails = [t for t in resources if op(self.is_shadow(t))]\n        if len(trails) != rcount and self.embedded:\n            self.log.info(\"implicitly filtering shadow trails %d -> %d\",\n                     rcount, len(trails))\n        return trails\n\n    def is_shadow(self, t):\n        if t.get('IsOrganizationTrail') and self.manager.config.account_id not in t['TrailARN']:\n            return True\n        if t.get('IsMultiRegionTrail') and t['HomeRegion'] not in t['TrailARN']:\n            return True\n\n\n@CloudTrail.filter_registry.register('status')\nclass Status(ValueFilter):\n    \"\"\"Filter a cloudtrail by its status.\n\n    :Example:\n\n    .. code-block:: yaml\n\n        policies:\n          - name: cloudtrail-not-active\n            resource: aws.cloudtrail\n            filters:\n            - type: status\n              key: IsLogging\n              value: False\n    \"\"\"\n\n    schema = type_schema('status', rinherit=ValueFilter.schema)\n    permissions = ('cloudtrail:GetTrailStatus',)\n    annotation_key = 'c7n:TrailStatus'\n\n    def process(self, resources, event=None):\n        for r in resources:\n            region = self.manager.config.region\n            trail_arn = Arn.parse(r['TrailARN'])\n\n            if (r.get('IsOrganizationTrail') and\n                    self.manager.config.account_id != trail_arn.account_id):\n                continue\n            if r.get('HomeRegion') and r['HomeRegion'] != region:\n                region = trail_arn.region\n            if self.annotation_key in r:\n                continue\n            client = local_session(self.manager.session_factory).client(\n                'cloudtrail', region_name=region)\n            status = client.get_trail_status(Name=r['Name'])\n            status.pop('ResponseMetadata')\n            r[self.annotation_key] = status\n\n        return super(Status, self).process(resources)\n\n    def __call__(self, r):\n        return self.match(r['c7n:TrailStatus'])\n\n\n@CloudTrail.action_registry.register('update-trail')\nclass UpdateTrail(Action):\n    \"\"\"Update trail attributes.\n\n    :Example:\n\n    .. code-block:: yaml\n\n       policies:\n         - name: cloudtrail-set-log\n           resource: aws.cloudtrail\n           filters:\n            - or:\n              - KmsKeyId: empty\n              - LogFileValidationEnabled: false\n           actions:\n            - type: update-trail\n              attributes:\n                KmsKeyId: arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef\n                EnableLogFileValidation: true\n    \"\"\"\n    schema = type_schema(\n        'update-trail',\n        attributes={'type': 'object'},\n        required=('attributes',))\n    shape = 'UpdateTrailRequest'\n    permissions = ('cloudtrail:UpdateTrail',)\n\n    def validate(self):\n        attrs = dict(self.data['attributes'])\n        if 'Name' in attrs:\n            raise PolicyValidationError(\n                \"Can't include Name in update-trail action\")\n        attrs['Name'] = 'PolicyValidation'\n        return shape_validate(\n            attrs,\n            self.shape,\n            self.manager.resource_type.service)\n\n    def process(self, resources):\n        client = local_session(self.manager.session_factory).client('cloudtrail')\n        shadow_check = IsShadow({'state': False}, self.manager)\n        shadow_check.embedded = True\n        resources = shadow_check.process(resources)\n\n        for r in resources:\n            client.update_trail(\n                Name=r['Name'],\n                **self.data['attributes'])\n\n\n@CloudTrail.action_registry.register('set-logging')\nclass SetLogging(Action):\n    \"\"\"Set the logging state of a trail\n\n    :Example:\n\n    .. code-block:: yaml\n\n      policies:\n        - name: cloudtrail-not-active\n          resource: aws.cloudtrail\n          filters:\n           - type: status\n             key: IsLogging\n             value: False\n          actions:\n           - type: set-logging\n             enabled: True\n    \"\"\"\n    schema = type_schema(\n        'set-logging', enabled={'type': 'boolean'})\n\n    def get_permissions(self):\n        enable = self.data.get('enabled', True)\n        if enable is True:\n            return ('cloudtrail:StartLogging',)\n        else:\n            return ('cloudtrail:StopLogging',)\n\n    def process(self, resources):\n        client = local_session(self.manager.session_factory).client('cloudtrail')\n        shadow_check = IsShadow({'state': False}, self.manager)\n        shadow_check.embedded = True\n        resources = shadow_check.process(resources)\n        enable = self.data.get('enabled', True)\n\n        for r in resources:\n            if enable:\n                client.start_logging(Name=r['Name'])\n            else:\n                client.stop_logging(Name=r['Name'])\n", "path": "c7n/resources/cloudtrail.py"}], "after_files": [{"content": "# Copyright 2017-2019 Capital One Services, LLC\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\");\n# you may not use this file except in compliance with the License.\n# You may obtain a copy of the License at\n#\n# http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\nfrom __future__ import absolute_import, division, print_function, unicode_literals\n\nimport logging\n\nfrom c7n.actions import Action\nfrom c7n.exceptions import PolicyValidationError\nfrom c7n.filters import ValueFilter, Filter\nfrom c7n.manager import resources\nfrom c7n.query import QueryResourceManager\nfrom c7n.utils import local_session, type_schema\n\nfrom .aws import shape_validate, Arn\n\nlog = logging.getLogger('c7n.resources.cloudtrail')\n\n\n@resources.register('cloudtrail')\nclass CloudTrail(QueryResourceManager):\n\n    class resource_type(object):\n        service = 'cloudtrail'\n        enum_spec = ('describe_trails', 'trailList', None)\n        filter_name = 'trailNameList'\n        filter_type = 'list'\n        arn = id = 'TrailARN'\n        name = 'Name'\n        dimension = None\n        config_type = \"AWS::CloudTrail::Trail\"\n\n\n@CloudTrail.filter_registry.register('is-shadow')\nclass IsShadow(Filter):\n    \"\"\"Identify shadow trails (secondary copies), shadow trails\n    can't be modified directly, the origin trail needs to be modified.\n\n    Shadow trails are created for multi-region trails as well for\n    organizational trails.\n    \"\"\"\n    schema = type_schema('is-shadow', state={'type': 'boolean'})\n    permissions = ('cloudtrail:DescribeTrails',)\n    embedded = False\n\n    def process(self, resources, event=None):\n        rcount = len(resources)\n        trails = [t for t in resources if (self.is_shadow(t) == self.data.get('state', True))]\n        if len(trails) != rcount and self.embedded:\n            self.log.info(\"implicitly filtering shadow trails %d -> %d\",\n                     rcount, len(trails))\n        return trails\n\n    def is_shadow(self, t):\n        if t.get('IsOrganizationTrail') and self.manager.config.account_id not in t['TrailARN']:\n            return True\n        if t.get('IsMultiRegionTrail') and t['HomeRegion'] != self.manager.config.region:\n            return True\n        return False\n\n\n@CloudTrail.filter_registry.register('status')\nclass Status(ValueFilter):\n    \"\"\"Filter a cloudtrail by its status.\n\n    :Example:\n\n    .. code-block:: yaml\n\n        policies:\n          - name: cloudtrail-not-active\n            resource: aws.cloudtrail\n            filters:\n            - type: status\n              key: IsLogging\n              value: False\n    \"\"\"\n\n    schema = type_schema('status', rinherit=ValueFilter.schema)\n    permissions = ('cloudtrail:GetTrailStatus',)\n    annotation_key = 'c7n:TrailStatus'\n\n    def process(self, resources, event=None):\n        for r in resources:\n            region = self.manager.config.region\n            trail_arn = Arn.parse(r['TrailARN'])\n\n            if (r.get('IsOrganizationTrail') and\n                    self.manager.config.account_id != trail_arn.account_id):\n                continue\n            if r.get('HomeRegion') and r['HomeRegion'] != region:\n                region = trail_arn.region\n            if self.annotation_key in r:\n                continue\n            client = local_session(self.manager.session_factory).client(\n                'cloudtrail', region_name=region)\n            status = client.get_trail_status(Name=r['Name'])\n            status.pop('ResponseMetadata')\n            r[self.annotation_key] = status\n\n        return super(Status, self).process(resources)\n\n    def __call__(self, r):\n        return self.match(r['c7n:TrailStatus'])\n\n\n@CloudTrail.action_registry.register('update-trail')\nclass UpdateTrail(Action):\n    \"\"\"Update trail attributes.\n\n    :Example:\n\n    .. code-block:: yaml\n\n       policies:\n         - name: cloudtrail-set-log\n           resource: aws.cloudtrail\n           filters:\n            - or:\n              - KmsKeyId: empty\n              - LogFileValidationEnabled: false\n           actions:\n            - type: update-trail\n              attributes:\n                KmsKeyId: arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef\n                EnableLogFileValidation: true\n    \"\"\"\n    schema = type_schema(\n        'update-trail',\n        attributes={'type': 'object'},\n        required=('attributes',))\n    shape = 'UpdateTrailRequest'\n    permissions = ('cloudtrail:UpdateTrail',)\n\n    def validate(self):\n        attrs = dict(self.data['attributes'])\n        if 'Name' in attrs:\n            raise PolicyValidationError(\n                \"Can't include Name in update-trail action\")\n        attrs['Name'] = 'PolicyValidation'\n        return shape_validate(\n            attrs,\n            self.shape,\n            self.manager.resource_type.service)\n\n    def process(self, resources):\n        client = local_session(self.manager.session_factory).client('cloudtrail')\n        shadow_check = IsShadow({'state': False}, self.manager)\n        shadow_check.embedded = True\n        resources = shadow_check.process(resources)\n\n        for r in resources:\n            client.update_trail(\n                Name=r['Name'],\n                **self.data['attributes'])\n\n\n@CloudTrail.action_registry.register('set-logging')\nclass SetLogging(Action):\n    \"\"\"Set the logging state of a trail\n\n    :Example:\n\n    .. code-block:: yaml\n\n      policies:\n        - name: cloudtrail-not-active\n          resource: aws.cloudtrail\n          filters:\n           - type: status\n             key: IsLogging\n             value: False\n          actions:\n           - type: set-logging\n             enabled: True\n    \"\"\"\n    schema = type_schema(\n        'set-logging', enabled={'type': 'boolean'})\n\n    def get_permissions(self):\n        enable = self.data.get('enabled', True)\n        if enable is True:\n            return ('cloudtrail:StartLogging',)\n        else:\n            return ('cloudtrail:StopLogging',)\n\n    def process(self, resources):\n        client = local_session(self.manager.session_factory).client('cloudtrail')\n        shadow_check = IsShadow({'state': False}, self.manager)\n        shadow_check.embedded = True\n        resources = shadow_check.process(resources)\n        enable = self.data.get('enabled', True)\n\n        for r in resources:\n            if enable:\n                client.start_logging(Name=r['Name'])\n            else:\n                client.stop_logging(Name=r['Name'])\n", "path": "c7n/resources/cloudtrail.py"}]}