ASG policy not failing when AWS api call fails

When I query for invalid ASGs, I’m intermittently hitting rate limit issues. The rate limit errors show up in the AWS api logs, but custodian reports 0 of 0 in the logs. Custodian should fail the run if it is not able to successfully pull back all resources to find invalid ASGs.

Custodian Logs

2018-03-27 02:31:51,925 - custodian.resources.securitygroup - DEBUG - Using cached c7n.resources.vpc.SecurityGroup: 0
2018-03-27 02:31:51,925 - custodian.resources.securitygroup - DEBUG - Filtered from 0 to 0 securitygroup

Cloudtrail Logs

DescribeSecurityGroups    us-west-2      CloudCustodian/0.8.28.1 Python/2.7.14 Linux/4.9.81-35.56.amzn1.x86_64 Botocore/1.8.48    Client.RequestLimitExceeded    Request limit exceeded.

[mandeepbal]

I’m not sure how to replicate this issue. Similar to @domingosnovo 's account, my account has a bunch of stuff as well. I feel like at a minimum custodian should just throw an exception with Request limit exceeded., rather than returning 0 of 0.

[domingosnovo]

So in resume, this is what’s happening for me:

1. User runs a policy via CloudCustodian CLI (with caching disabled, so I wouldn’t expect the issue to be related to cache)
2. Calls to the AWS API are rate limited, and eventually CloudCustodian gives up (doesn’t seem to be related to ELB only, as @mandeepbal experienced similar issues with EC2 calls)
3. CloudCustodian exits with an exit code 0, while it should have bugged out instead (as the policy failed to run)