Post finding for events with errorCode field

[jjjjjjjj987]

Greetings!

I'm trying to create a security hub finding for some APIs that has detail.errorCode on it, like the DeleteGroup API Call with the error code AccessDenied.

So far I made the policy below but it keeps getting skipped due to C7N_SKIP_ERR_EVENT (tried to follow #3122 with no success) and even if I remove the return statement from its validation it does not create a new Security Hub finding.

May I have help on this, please?

policies:
  - name: failed-to-delete-group
    description: |
      testing
    resource: aws.cloudtrail
    mode:
      type: cloudtrail
      role: arn:aws:iam::000000000000:role/custodian-lambda
      events:
        - source: iam.amazonaws.com
          event: DeleteGroup
          ids: "detail.errorCode"
      execution-options:
        C7N_SKIP_ERR_EVENT: 'no'
    filters:
      - type: value
        key: "detail.errorCode"
        op: in
        value: [NoSuchEntityException, DeleteConflictException, AccessDenied]
        value_type: swap
    actions:
      - type: post-finding
        description: |
          finding description
        types:
          - "TTPs/Persistence/Account Manipulation"
          - "Unusual Behaviors/User"
        compliance_status: WARNING
        confidence: 100
        severity_label: LOW
        title: "failed-to-delete-group"
        recommendation: "Enable shield"
        recommendation_url: "https://www.example.com/policies/AntiDDoS.html"