We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Mugc ignored Global Services policy with region and did not remove policy from other regions
**Describe the bug**
A clear and concise description of what the bug is.
According to documentation `https://cloudcustodian.io/docs/aws/examples/accountservicelimit.html` added region to one of our policies. Did redeploy and pipeline c7n-org step did update policy in specified us-east-1 region, but mugc step did not remove from us-east-2

**To Reproduce**
Steps to reproduce the behavior:
deploy policy for resource s3 in 2 regions: us-east-1 and us-east-2
add region: us-east-1 to the policy
deploy using c7n-org
run mugc

**Expected behavior**
A clear and concise description of what you expected to happen.
I would expect mugc to remove policy from all other regions

**Background (please complete the following information):**
 - Python Version: [e.g. python 3.8.1] virtual environment CPython3.8.3.final.0-64
 - Custodian Version: [e.g. 0.8.46.1] c7n 0.9.6, c7n-mailer 0.6.5, c7n-org 0.6.5
 - Tool Version: [if applicable] codebuild pipeline
 - Cloud Provider: [e.g. gcp, aws, azure] aws
 - Policy: [please exclude any account/sensitive information]
```yaml
policies: 
   - name: list-buckets
      resource: s3
      region: us-east-1
```

**Additional context**
Add any other context about the problem here.


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `tools/ops/mugc.py`
Content:
```
1 # Copyright The Cloud Custodian Authors.
2 # SPDX-License-Identifier: Apache-2.0
3 import argparse
4 import itertools
5 import json
6 import os
7 import re
8 import logging
9 import sys
10 
11 from c7n.credentials import SessionFactory
12 from c7n.config import Config
13 from c7n.policy import load as policy_load, PolicyCollection
14 from c7n import mu
15 
16 # TODO: mugc has alot of aws assumptions
17 
18 from c7n.resources.aws import AWS
19 from botocore.exceptions import ClientError
20 
21 
22 log = logging.getLogger('mugc')
23 
24 
25 def load_policies(options, config):
26     policies = PolicyCollection([], config)
27     for f in options.config_files:
28         policies += policy_load(config, f).filter(options.policy_filter)
29     return policies
30 
31 
32 def region_gc(options, region, policy_config, policies):
33 
34     log.debug("Region:%s Starting garbage collection", region)
35     session_factory = SessionFactory(
36         region=region,
37         assume_role=policy_config.assume_role,
38         profile=policy_config.profile,
39         external_id=policy_config.external_id)
40 
41     manager = mu.LambdaManager(session_factory)
42     funcs = list(manager.list_functions(options.prefix))
43     client = session_factory().client('lambda')
44 
45     remove = []
46     current_policies = [p.name for p in policies]
47     pattern = re.compile(options.policy_regex)
48     for f in funcs:
49         if not pattern.match(f['FunctionName']):
50             continue
51         match = False
52         for pn in current_policies:
53             if f['FunctionName'].endswith(pn):
54                 match = True
55         if options.present:
56             if match:
57                 remove.append(f)
58         elif not match:
59             remove.append(f)
60 
61     for n in remove:
62         events = []
63         try:
64             result = client.get_policy(FunctionName=n['FunctionName'])
65         except ClientError as e:
66             if e.response['Error']['Code'] == 'ResourceNotFoundException':
67                 log.warning(
68                     "Region:%s Lambda Function or Access Policy Statement missing: %s",
69                     region, n['FunctionName'])
70             else:
71                 log.warning(
72                     "Region:%s Unexpected error: %s for function %s",
73                     region, e, n['FunctionName'])
74 
75             # Continue on with next function instead of raising an exception
76             continue
77 
78         if 'Policy' not in result:
79             pass
80         else:
81             p = json.loads(result['Policy'])
82             for s in p['Statement']:
83                 principal = s.get('Principal')
84                 if not isinstance(principal, dict):
85                     log.info("Skipping function %s" % n['FunctionName'])
86                     continue
87                 if principal == {'Service': 'events.amazonaws.com'}:
88                     events.append(
89                         mu.CloudWatchEventSource({}, session_factory))
90                 elif principal == {'Service': 'config.amazonaws.com'}:
91                     events.append(
92                         mu.ConfigRule({}, session_factory))
93 
94         f = mu.LambdaFunction({
95             'name': n['FunctionName'],
96             'role': n['Role'],
97             'handler': n['Handler'],
98             'timeout': n['Timeout'],
99             'memory_size': n['MemorySize'],
100             'description': n['Description'],
101             'runtime': n['Runtime'],
102             'events': events}, None)
103 
104         log.info("Region:%s Removing %s", region, n['FunctionName'])
105         if options.dryrun:
106             log.info("Dryrun skipping removal")
107             continue
108         manager.remove(f)
109         log.info("Region:%s Removed %s", region, n['FunctionName'])
110 
111 
112 def resources_gc_prefix(options, policy_config, policy_collection):
113     """Garbage collect old custodian policies based on prefix.
114 
115     We attempt to introspect to find the event sources for a policy
116     but without the old configuration this is implicit.
117     """
118 
119     # Classify policies by region
120     policy_regions = {}
121     for p in policy_collection:
122         if p.execution_mode == 'poll':
123             continue
124         policy_regions.setdefault(p.options.region, []).append(p)
125 
126     regions = get_gc_regions(options.regions, policy_config)
127     for r in regions:
128         region_gc(options, r, policy_config, policy_regions.get(r, []))
129 
130 
131 def get_gc_regions(regions, policy_config):
132     if 'all' in regions:
133         session_factory = SessionFactory(
134             region='us-east-1',
135             assume_role=policy_config.assume_role,
136             profile=policy_config.profile,
137             external_id=policy_config.external_id)
138 
139         client = session_factory().client('ec2')
140         return [region['RegionName'] for region in client.describe_regions()['Regions']]
141     return regions
142 
143 
144 def setup_parser():
145     parser = argparse.ArgumentParser()
146     parser.add_argument("configs", nargs='*', help="Policy configuration file(s)")
147     parser.add_argument(
148         '-c', '--config', dest="config_files", nargs="*", action='append',
149         help="Policy configuration files(s)", default=[])
150     parser.add_argument(
151         "--present", action="store_true", default=False,
152         help='Target policies present in config files for removal instead of skipping them.')
153     parser.add_argument(
154         '-r', '--region', action='append', dest='regions', metavar='REGION',
155         help="AWS Region to target. Can be used multiple times, also supports `all`")
156     parser.add_argument('--dryrun', action="store_true", default=False)
157     parser.add_argument(
158         "--profile", default=os.environ.get('AWS_PROFILE'),
159         help="AWS Account Config File Profile to utilize")
160     parser.add_argument(
161         "--prefix", default="custodian-",
162         help="The Lambda name prefix to use for clean-up")
163     parser.add_argument(
164         "--policy-regex",
165         help="The policy must match the regex")
166     parser.add_argument("-p", "--policies", default=None, dest='policy_filter',
167                         help="Only use named/matched policies")
168     parser.add_argument(
169         "--assume", default=None, dest="assume_role",
170         help="Role to assume")
171     parser.add_argument(
172         "-v", dest="verbose", action="store_true", default=False,
173         help='toggle verbose logging')
174     return parser
175 
176 
177 def main():
178     parser = setup_parser()
179     options = parser.parse_args()
180 
181     log_level = logging.INFO
182     if options.verbose:
183         log_level = logging.DEBUG
184     logging.basicConfig(
185         level=log_level,
186         format="%(asctime)s: %(name)s:%(levelname)s %(message)s")
187     logging.getLogger('botocore').setLevel(logging.ERROR)
188     logging.getLogger('urllib3').setLevel(logging.ERROR)
189     logging.getLogger('c7n.cache').setLevel(logging.WARNING)
190 
191     if not options.policy_regex:
192         options.policy_regex = f"^{options.prefix}.*"
193 
194     if not options.regions:
195         options.regions = [os.environ.get('AWS_DEFAULT_REGION', 'us-east-1')]
196 
197     files = []
198     files.extend(itertools.chain(*options.config_files))
199     files.extend(options.configs)
200     options.config_files = files
201 
202     if not files:
203         parser.print_help()
204         sys.exit(1)
205 
206     policy_config = Config.empty(
207         regions=options.regions,
208         profile=options.profile,
209         assume_role=options.assume_role)
210 
211     # use cloud provider to initialize policies to get region expansion
212     policies = AWS().initialize_policies(
213         PolicyCollection([
214             p for p in load_policies(
215                 options, policy_config)
216             if p.provider_name == 'aws'],
217             policy_config),
218         policy_config)
219 
220     resources_gc_prefix(options, policy_config, policies)
221 
222 
223 if __name__ == '__main__':
224     main()
225
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/tools/ops/mugc.py b/tools/ops/mugc.py
--- a/tools/ops/mugc.py
+++ b/tools/ops/mugc.py
@@ -43,15 +43,15 @@
     client = session_factory().client('lambda')
 
     remove = []
-    current_policies = [p.name for p in policies]
     pattern = re.compile(options.policy_regex)
     for f in funcs:
         if not pattern.match(f['FunctionName']):
             continue
         match = False
-        for pn in current_policies:
-            if f['FunctionName'].endswith(pn):
-                match = True
+        for p in policies:
+            if f['FunctionName'].endswith(p.name):
+                if 'region' not in p.data or p.data['region'] == region:
+                    match = True
         if options.present:
             if match:
                 remove.append(f)

{"golden_diff": "diff --git a/tools/ops/mugc.py b/tools/ops/mugc.py\n--- a/tools/ops/mugc.py\n+++ b/tools/ops/mugc.py\n@@ -43,15 +43,15 @@\n     client = session_factory().client('lambda')\n \n     remove = []\n-    current_policies = [p.name for p in policies]\n     pattern = re.compile(options.policy_regex)\n     for f in funcs:\n         if not pattern.match(f['FunctionName']):\n             continue\n         match = False\n-        for pn in current_policies:\n-            if f['FunctionName'].endswith(pn):\n-                match = True\n+        for p in policies:\n+            if f['FunctionName'].endswith(p.name):\n+                if 'region' not in p.data or p.data['region'] == region:\n+                    match = True\n         if options.present:\n             if match:\n                 remove.append(f)\n", "issue": "Mugc ignored Global Services policy with region and did not remove policy from other regions\n**Describe the bug**\r\nA clear and concise description of what the bug is.\r\nAccording to documentation `https://cloudcustodian.io/docs/aws/examples/accountservicelimit.html` added region to one of our policies. Did redeploy and pipeline c7n-org step did update policy in specified us-east-1 region, but mugc step did not remove from us-east-2\r\n\r\n**To Reproduce**\r\nSteps to reproduce the behavior:\r\ndeploy policy for resource s3 in 2 regions: us-east-1 and us-east-2\r\nadd region: us-east-1 to the policy\r\ndeploy using c7n-org\r\nrun mugc\r\n\r\n**Expected behavior**\r\nA clear and concise description of what you expected to happen.\r\nI would expect mugc to remove policy from all other regions\r\n\r\n**Background (please complete the following information):**\r\n - Python Version: [e.g. python 3.8.1] virtual environment CPython3.8.3.final.0-64\r\n - Custodian Version: [e.g. 0.8.46.1] c7n 0.9.6, c7n-mailer 0.6.5, c7n-org 0.6.5\r\n - Tool Version: [if applicable] codebuild pipeline\r\n - Cloud Provider: [e.g. gcp, aws, azure] aws\r\n - Policy: [please exclude any account/sensitive information]\r\n```yaml\r\npolicies: \r\n   - name: list-buckets\r\n      resource: s3\r\n      region: us-east-1\r\n```\r\n\r\n**Additional context**\r\nAdd any other context about the problem here.\r\n\n", "before_files": [{"content": "# Copyright The Cloud Custodian Authors.\n# SPDX-License-Identifier: Apache-2.0\nimport argparse\nimport itertools\nimport json\nimport os\nimport re\nimport logging\nimport sys\n\nfrom c7n.credentials import SessionFactory\nfrom c7n.config import Config\nfrom c7n.policy import load as policy_load, PolicyCollection\nfrom c7n import mu\n\n# TODO: mugc has alot of aws assumptions\n\nfrom c7n.resources.aws import AWS\nfrom botocore.exceptions import ClientError\n\n\nlog = logging.getLogger('mugc')\n\n\ndef load_policies(options, config):\n    policies = PolicyCollection([], config)\n    for f in options.config_files:\n        policies += policy_load(config, f).filter(options.policy_filter)\n    return policies\n\n\ndef region_gc(options, region, policy_config, policies):\n\n    log.debug(\"Region:%s Starting garbage collection\", region)\n    session_factory = SessionFactory(\n        region=region,\n        assume_role=policy_config.assume_role,\n        profile=policy_config.profile,\n        external_id=policy_config.external_id)\n\n    manager = mu.LambdaManager(session_factory)\n    funcs = list(manager.list_functions(options.prefix))\n    client = session_factory().client('lambda')\n\n    remove = []\n    current_policies = [p.name for p in policies]\n    pattern = re.compile(options.policy_regex)\n    for f in funcs:\n        if not pattern.match(f['FunctionName']):\n            continue\n        match = False\n        for pn in current_policies:\n            if f['FunctionName'].endswith(pn):\n                match = True\n        if options.present:\n            if match:\n                remove.append(f)\n        elif not match:\n            remove.append(f)\n\n    for n in remove:\n        events = []\n        try:\n            result = client.get_policy(FunctionName=n['FunctionName'])\n        except ClientError as e:\n            if e.response['Error']['Code'] == 'ResourceNotFoundException':\n                log.warning(\n                    \"Region:%s Lambda Function or Access Policy Statement missing: %s\",\n                    region, n['FunctionName'])\n            else:\n                log.warning(\n                    \"Region:%s Unexpected error: %s for function %s\",\n                    region, e, n['FunctionName'])\n\n            # Continue on with next function instead of raising an exception\n            continue\n\n        if 'Policy' not in result:\n            pass\n        else:\n            p = json.loads(result['Policy'])\n            for s in p['Statement']:\n                principal = s.get('Principal')\n                if not isinstance(principal, dict):\n                    log.info(\"Skipping function %s\" % n['FunctionName'])\n                    continue\n                if principal == {'Service': 'events.amazonaws.com'}:\n                    events.append(\n                        mu.CloudWatchEventSource({}, session_factory))\n                elif principal == {'Service': 'config.amazonaws.com'}:\n                    events.append(\n                        mu.ConfigRule({}, session_factory))\n\n        f = mu.LambdaFunction({\n            'name': n['FunctionName'],\n            'role': n['Role'],\n            'handler': n['Handler'],\n            'timeout': n['Timeout'],\n            'memory_size': n['MemorySize'],\n            'description': n['Description'],\n            'runtime': n['Runtime'],\n            'events': events}, None)\n\n        log.info(\"Region:%s Removing %s\", region, n['FunctionName'])\n        if options.dryrun:\n            log.info(\"Dryrun skipping removal\")\n            continue\n        manager.remove(f)\n        log.info(\"Region:%s Removed %s\", region, n['FunctionName'])\n\n\ndef resources_gc_prefix(options, policy_config, policy_collection):\n    \"\"\"Garbage collect old custodian policies based on prefix.\n\n    We attempt to introspect to find the event sources for a policy\n    but without the old configuration this is implicit.\n    \"\"\"\n\n    # Classify policies by region\n    policy_regions = {}\n    for p in policy_collection:\n        if p.execution_mode == 'poll':\n            continue\n        policy_regions.setdefault(p.options.region, []).append(p)\n\n    regions = get_gc_regions(options.regions, policy_config)\n    for r in regions:\n        region_gc(options, r, policy_config, policy_regions.get(r, []))\n\n\ndef get_gc_regions(regions, policy_config):\n    if 'all' in regions:\n        session_factory = SessionFactory(\n            region='us-east-1',\n            assume_role=policy_config.assume_role,\n            profile=policy_config.profile,\n            external_id=policy_config.external_id)\n\n        client = session_factory().client('ec2')\n        return [region['RegionName'] for region in client.describe_regions()['Regions']]\n    return regions\n\n\ndef setup_parser():\n    parser = argparse.ArgumentParser()\n    parser.add_argument(\"configs\", nargs='*', help=\"Policy configuration file(s)\")\n    parser.add_argument(\n        '-c', '--config', dest=\"config_files\", nargs=\"*\", action='append',\n        help=\"Policy configuration files(s)\", default=[])\n    parser.add_argument(\n        \"--present\", action=\"store_true\", default=False,\n        help='Target policies present in config files for removal instead of skipping them.')\n    parser.add_argument(\n        '-r', '--region', action='append', dest='regions', metavar='REGION',\n        help=\"AWS Region to target. Can be used multiple times, also supports `all`\")\n    parser.add_argument('--dryrun', action=\"store_true\", default=False)\n    parser.add_argument(\n        \"--profile\", default=os.environ.get('AWS_PROFILE'),\n        help=\"AWS Account Config File Profile to utilize\")\n    parser.add_argument(\n        \"--prefix\", default=\"custodian-\",\n        help=\"The Lambda name prefix to use for clean-up\")\n    parser.add_argument(\n        \"--policy-regex\",\n        help=\"The policy must match the regex\")\n    parser.add_argument(\"-p\", \"--policies\", default=None, dest='policy_filter',\n                        help=\"Only use named/matched policies\")\n    parser.add_argument(\n        \"--assume\", default=None, dest=\"assume_role\",\n        help=\"Role to assume\")\n    parser.add_argument(\n        \"-v\", dest=\"verbose\", action=\"store_true\", default=False,\n        help='toggle verbose logging')\n    return parser\n\n\ndef main():\n    parser = setup_parser()\n    options = parser.parse_args()\n\n    log_level = logging.INFO\n    if options.verbose:\n        log_level = logging.DEBUG\n    logging.basicConfig(\n        level=log_level,\n        format=\"%(asctime)s: %(name)s:%(levelname)s %(message)s\")\n    logging.getLogger('botocore').setLevel(logging.ERROR)\n    logging.getLogger('urllib3').setLevel(logging.ERROR)\n    logging.getLogger('c7n.cache').setLevel(logging.WARNING)\n\n    if not options.policy_regex:\n        options.policy_regex = f\"^{options.prefix}.*\"\n\n    if not options.regions:\n        options.regions = [os.environ.get('AWS_DEFAULT_REGION', 'us-east-1')]\n\n    files = []\n    files.extend(itertools.chain(*options.config_files))\n    files.extend(options.configs)\n    options.config_files = files\n\n    if not files:\n        parser.print_help()\n        sys.exit(1)\n\n    policy_config = Config.empty(\n        regions=options.regions,\n        profile=options.profile,\n        assume_role=options.assume_role)\n\n    # use cloud provider to initialize policies to get region expansion\n    policies = AWS().initialize_policies(\n        PolicyCollection([\n            p for p in load_policies(\n                options, policy_config)\n            if p.provider_name == 'aws'],\n            policy_config),\n        policy_config)\n\n    resources_gc_prefix(options, policy_config, policies)\n\n\nif __name__ == '__main__':\n    main()\n", "path": "tools/ops/mugc.py"}], "after_files": [{"content": "# Copyright The Cloud Custodian Authors.\n# SPDX-License-Identifier: Apache-2.0\nimport argparse\nimport itertools\nimport json\nimport os\nimport re\nimport logging\nimport sys\n\nfrom c7n.credentials import SessionFactory\nfrom c7n.config import Config\nfrom c7n.policy import load as policy_load, PolicyCollection\nfrom c7n import mu\n\n# TODO: mugc has alot of aws assumptions\n\nfrom c7n.resources.aws import AWS\nfrom botocore.exceptions import ClientError\n\n\nlog = logging.getLogger('mugc')\n\n\ndef load_policies(options, config):\n    policies = PolicyCollection([], config)\n    for f in options.config_files:\n        policies += policy_load(config, f).filter(options.policy_filter)\n    return policies\n\n\ndef region_gc(options, region, policy_config, policies):\n\n    log.debug(\"Region:%s Starting garbage collection\", region)\n    session_factory = SessionFactory(\n        region=region,\n        assume_role=policy_config.assume_role,\n        profile=policy_config.profile,\n        external_id=policy_config.external_id)\n\n    manager = mu.LambdaManager(session_factory)\n    funcs = list(manager.list_functions(options.prefix))\n    client = session_factory().client('lambda')\n\n    remove = []\n    pattern = re.compile(options.policy_regex)\n    for f in funcs:\n        if not pattern.match(f['FunctionName']):\n            continue\n        match = False\n        for p in policies:\n            if f['FunctionName'].endswith(p.name):\n                if 'region' not in p.data or p.data['region'] == region:\n                    match = True\n        if options.present:\n            if match:\n                remove.append(f)\n        elif not match:\n            remove.append(f)\n\n    for n in remove:\n        events = []\n        try:\n            result = client.get_policy(FunctionName=n['FunctionName'])\n        except ClientError as e:\n            if e.response['Error']['Code'] == 'ResourceNotFoundException':\n                log.warning(\n                    \"Region:%s Lambda Function or Access Policy Statement missing: %s\",\n                    region, n['FunctionName'])\n            else:\n                log.warning(\n                    \"Region:%s Unexpected error: %s for function %s\",\n                    region, e, n['FunctionName'])\n\n            # Continue on with next function instead of raising an exception\n            continue\n\n        if 'Policy' not in result:\n            pass\n        else:\n            p = json.loads(result['Policy'])\n            for s in p['Statement']:\n                principal = s.get('Principal')\n                if not isinstance(principal, dict):\n                    log.info(\"Skipping function %s\" % n['FunctionName'])\n                    continue\n                if principal == {'Service': 'events.amazonaws.com'}:\n                    events.append(\n                        mu.CloudWatchEventSource({}, session_factory))\n                elif principal == {'Service': 'config.amazonaws.com'}:\n                    events.append(\n                        mu.ConfigRule({}, session_factory))\n\n        f = mu.LambdaFunction({\n            'name': n['FunctionName'],\n            'role': n['Role'],\n            'handler': n['Handler'],\n            'timeout': n['Timeout'],\n            'memory_size': n['MemorySize'],\n            'description': n['Description'],\n            'runtime': n['Runtime'],\n            'events': events}, None)\n\n        log.info(\"Region:%s Removing %s\", region, n['FunctionName'])\n        if options.dryrun:\n            log.info(\"Dryrun skipping removal\")\n            continue\n        manager.remove(f)\n        log.info(\"Region:%s Removed %s\", region, n['FunctionName'])\n\n\ndef resources_gc_prefix(options, policy_config, policy_collection):\n    \"\"\"Garbage collect old custodian policies based on prefix.\n\n    We attempt to introspect to find the event sources for a policy\n    but without the old configuration this is implicit.\n    \"\"\"\n\n    # Classify policies by region\n    policy_regions = {}\n    for p in policy_collection:\n        if p.execution_mode == 'poll':\n            continue\n        policy_regions.setdefault(p.options.region, []).append(p)\n\n    regions = get_gc_regions(options.regions, policy_config)\n    for r in regions:\n        region_gc(options, r, policy_config, policy_regions.get(r, []))\n\n\ndef get_gc_regions(regions, policy_config):\n    if 'all' in regions:\n        session_factory = SessionFactory(\n            region='us-east-1',\n            assume_role=policy_config.assume_role,\n            profile=policy_config.profile,\n            external_id=policy_config.external_id)\n\n        client = session_factory().client('ec2')\n        return [region['RegionName'] for region in client.describe_regions()['Regions']]\n    return regions\n\n\ndef setup_parser():\n    parser = argparse.ArgumentParser()\n    parser.add_argument(\"configs\", nargs='*', help=\"Policy configuration file(s)\")\n    parser.add_argument(\n        '-c', '--config', dest=\"config_files\", nargs=\"*\", action='append',\n        help=\"Policy configuration files(s)\", default=[])\n    parser.add_argument(\n        \"--present\", action=\"store_true\", default=False,\n        help='Target policies present in config files for removal instead of skipping them.')\n    parser.add_argument(\n        '-r', '--region', action='append', dest='regions', metavar='REGION',\n        help=\"AWS Region to target. Can be used multiple times, also supports `all`\")\n    parser.add_argument('--dryrun', action=\"store_true\", default=False)\n    parser.add_argument(\n        \"--profile\", default=os.environ.get('AWS_PROFILE'),\n        help=\"AWS Account Config File Profile to utilize\")\n    parser.add_argument(\n        \"--prefix\", default=\"custodian-\",\n        help=\"The Lambda name prefix to use for clean-up\")\n    parser.add_argument(\n        \"--policy-regex\",\n        help=\"The policy must match the regex\")\n    parser.add_argument(\"-p\", \"--policies\", default=None, dest='policy_filter',\n                        help=\"Only use named/matched policies\")\n    parser.add_argument(\n        \"--assume\", default=None, dest=\"assume_role\",\n        help=\"Role to assume\")\n    parser.add_argument(\n        \"-v\", dest=\"verbose\", action=\"store_true\", default=False,\n        help='toggle verbose logging')\n    return parser\n\n\ndef main():\n    parser = setup_parser()\n    options = parser.parse_args()\n\n    log_level = logging.INFO\n    if options.verbose:\n        log_level = logging.DEBUG\n    logging.basicConfig(\n        level=log_level,\n        format=\"%(asctime)s: %(name)s:%(levelname)s %(message)s\")\n    logging.getLogger('botocore').setLevel(logging.ERROR)\n    logging.getLogger('urllib3').setLevel(logging.ERROR)\n    logging.getLogger('c7n.cache').setLevel(logging.WARNING)\n\n    if not options.policy_regex:\n        options.policy_regex = f\"^{options.prefix}.*\"\n\n    if not options.regions:\n        options.regions = [os.environ.get('AWS_DEFAULT_REGION', 'us-east-1')]\n\n    files = []\n    files.extend(itertools.chain(*options.config_files))\n    files.extend(options.configs)\n    options.config_files = files\n\n    if not files:\n        parser.print_help()\n        sys.exit(1)\n\n    policy_config = Config.empty(\n        regions=options.regions,\n        profile=options.profile,\n        assume_role=options.assume_role)\n\n    # use cloud provider to initialize policies to get region expansion\n    policies = AWS().initialize_policies(\n        PolicyCollection([\n            p for p in load_policies(\n                options, policy_config)\n            if p.provider_name == 'aws'],\n            policy_config),\n        policy_config)\n\n    resources_gc_prefix(options, policy_config, policies)\n\n\nif __name__ == '__main__':\n    main()\n", "path": "tools/ops/mugc.py"}]}