Access Denied due to embedded iam policy cause policies to fail about cloud-custodian

[PratMis]

Error pattern for other resource types. Ugh there are different error types for each resources.

botocore.exceptions.ClientError: An error occurred (AccessDeniedException) when calling the GetRepositoryPolicy operation: User: CloudCustodian is not authorized to perform: ecr:GetRepositoryPolicy on resource: arn:aws:ecr:us-east-1:123456789012:repository/x with an explicit deny in a resource-based policy

botocore.exceptions.ClientError: An error occurred (AccessDeniedException) when calling the GetKeyPolicy operation: User: CloudCustodian is not authorized to perform: kms:GetKeyPolicy on resource: arn:aws:kms:us-east-1:219282823942:key/X because no resource-based policy allows the kms:GetKeyPolicy action

[PratMis]

I did some digging and found that out of the above listed 3 total failures we're seeing only one is caused within detail_spec. The other 2 failures that are shown below are coming from ecr_augment and kms_get_policy_augment and should be tackled separately imo.
I also think since ecr tags and kms embedded policies are additional metadata we capture via additional api calls, we should let those fail and raise errors vs catching them because they could cause a policy to be executed without fetching the right metadata

botocore.exceptions.ClientError: An error occurred (AccessDeniedException) when calling the GetRepositoryPolicy operation: User: CloudCustodian is not authorized to perform: ecr:GetRepositoryPolicy on resource: arn:aws:ecr:us-east-1:123456789012:repository/x with an explicit deny in a resource-based policy

botocore.exceptions.ClientError: An error occurred (AccessDeniedException) when calling the GetKeyPolicy operation: User: CloudCustodian is not authorized to perform: kms:GetKeyPolicy on resource: arn:aws:kms:us-east-1:219282823942:key/X because no resource-based policy allows the kms:GetKeyPolicy action