Support cross-account CloudWatch events

[cplee]

Address #1415 by assuming a member role from LambdaMode

• Call assume_member from within the LambdaMode resolve_resources
• Allow override of how to extract account_id from the event for subclasses of LambdaMode
• Allow override of how to extract region from the event for subclasses of LambdaMode
• Update existing SessionFactory rather than creating a new one since references have already been established to the old SessionFactory

[kapilt]

i'm convinced, thanks for the pr.

[kapilt]

based on #2001

[stevelaver]

Please can someone provide a simple of example policy of this change?does it mean I can run one lambda across multiple accounts? if so is there only periodic support or event too?

[cplee]

@stevelaver this is intended to work for events. Here's a sample policy to autotag all buckets from member accounts. The lambda is deployed once in a central account.

- name: s3-event-create-bucket-autotag
  mode:
    type: cloudtrail
    events:
      - source: s3.amazonaws.com
        ids: requestParameters.bucketName
        event: CreateBucket
    timeout: 300
    runtime: python3.6
    member-role: arn:aws:iam::{account_id}:role/cloud-custodian-action
  resource: s3
  description: |
    Tag new S3 buckets withowner
  filters:
    - tag:OwnerContact: absent
  actions:
    - type: auto-tag-user
      tag: OwnerContact

In order for this to work, you also need to deploy the following snippet of CloudFormation into each member account to send events back to the central account:

  EventForwarder:
    Type: AWS::Events::Rule
    Properties:
      Name: cloud-custodian-forwarder
      EventPattern:
        source:
          - aws.ec2
          - aws.s3
      State: ENABLED
      Targets:
        - Id: ToolsAccountEventBus
          Arn: !Sub arn:aws:events:${ToolsRegion}:${ToolsAccount}:event-bus/default

[rsandhu2]

@kapilt @cplee Does this also work for periodic mode? I would like to invoke a lambda deployed in the central account and pass the account id in the payload for the child accounts. If there is an example/doc somewhere that would be really helpful!