Allow policies ability to trigger off of failed events

[khapp]

Describe the feature

I would like to be able to write policies that trigger when certain failed events occur.

Use Case:

I would like to craft an SCP that restricts the creation of S3 buckets that don't have encryption enabled. I would like to write a policy that detects calls that do not enable encryption and send notifications based on that failed event. The notification would enable us to point our engineers towards documentation and resources for best practices.

Extra information or context

No response

[kapilt]

custodian does allow for this, you'll need to set an environment variable for the lambda mode policy C7N_SKIP_EVTERR=no