AJ Kerrigan

### Describe the bug The combination of an `aws.org-unit` resource and `cloudtrail` mode dies when resolving resources: ``` TypeError: cannot unpack non-iterable NoneType object ``` ### What did you expect...

Add `upgrade-available` filter for `aws.elasticsearch`, `aws.elasticache`, and `aws.kafka`

1

### Describe the feature The [upgrade-available filter for RDS](https://cloudcustodian.io/docs/aws/resources/rds.html#aws-rds-filters-upgrade-available) is helpful for displaying available engine version upgrades. It would be useful to add this filter for more resources, including: -...

Support Python 3.11 Lambda Runtime

1

### Describe the feature Sort of a sibling issue to #9034 , it would be useful to support (and potentially default to) Python 3.11 for Lambda-based policies. We've been using...

### Describe the feature The `aws.cfn` resource can see the stack instances that make up a stackset, but not the stackset itself. ### Extra information or context I'm not sure...

WIP - Dynamic tagging with resource JMESPath lookup

1

Looking at an incremental step directly addressing #5011 while also keeping other considerations in mind: - We've heard related use cases where tag values would be looked up _using_ resource...

### Describe the bug #9378 renamed a resource (`appmesh-virtual-gateway` --> `appmesh-virtualgateway`). It looks like a doc page for the original name (`docs/source/aws/resources/appmesh-virtual-gateway.rst`) got restored as part of the [CI docs...

### Describe the feature It would be helpful to support WAFv2 [IP Sets](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/wafv2/client/list_ip_sets.html) and [Rule Groups](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/wafv2/client/list_rule_groups.html). ### Extra information or context Custodian supports these resources today via the `awscc` provider,...

### Describe the feature The `aws.waf` resource provides some information about active rules, but doesn't include the detailed predicate information returned by [get_rule](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/waf/client/get_rule.html). It would be useful to support that...

Find Config retention settings

4

### Describe the feature It would be useful to expose [Config service retention settings](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/config/client/describe_retention_configurations.html#ConfigService.Client.describe_retention_configurations), either through a new resource/filter or as part of the existing account-level `check-config` filter. ### Extra...

Resource references don't seem to work when combined with `for_each`

2

In https://github.com/orgs/cloud-custodian/discussions/9181 there is a question about checking S3 server-side encryption settings that are defined in separate resources. That works fine for individual buckets: ```terraform resource "aws_s3_bucket" "sse_enabled_separately" { bucket...