docs: def _default_options(p, blacklist=""):
      """ Add basic options ot the subparser.
  
      `blacklist` is a list of options to exclude from the default set.
      e.g.: ['region', 'log-group']
      """
      provider = p.add_argument_group(
          "provider", "AWS account information, defaults per the aws cli")
  
      if 'region' not in blacklist:
          provider.add_argument(
              "-r", "--region", action='append', default=[],
              dest='regions', metavar='REGION',
              help="AWS Region to target.  Can be used multiple times")
      provider.add_argument(
          "--profile",
          help="AWS Account Config File Profile to utilize")
      provider.add_argument("--assume", default=None, dest="assume_role",
                            help="Role to assume")
      provider.add_argument("--external-id", default=None, dest="external_id",
                            help="External Id to provide when assuming a role")
  
      config = p.add_argument_group(
          "config", "Policy config file(s) and policy selectors")
      # -c is deprecated.  Supported for legacy reasons
      config.add_argument("-c", "--config", help=argparse.SUPPRESS)
      config.add_argument("configs", nargs='*',
                          help="Policy configuration file(s)")
      config.add_argument("-p", "--policies", default=None, dest='policy_filter',
                          help="Only use named/matched policies")
      config.add_argument("-t", "--resource", default=None, dest='resource_type',
                          help="Only use policies with the given resource type")
  
      output = p.add_argument_group("output", "Output control")
      output.add_argument("-v", "--verbose", action="count", help="Verbose logging")
      if 'quiet' not in blacklist:
          output.add_argument("-q", "--quiet", action="count",
                              help="Less logging (repeatable, -qqq for no output)")
      else:
          output.add_argument("-q", "--quiet", action="count", help=argparse.SUPPRESS)
      output.add_argument("--debug", default=False, help=argparse.SUPPRESS,
                          action="store_true")
  
      if 'vars' not in blacklist:
          # p.add_argument('--vars', default=None,
          #               help='Vars file to substitute into policy')
          p.set_defaults(vars=None)
  
      if 'log-group' not in blacklist:
          p.add_argument(
              "-l", "--log-group", default=None,
              help="Cloudwatch Log Group to send policy logs")
      else:
          p.add_argument("--log-group", default=None, help=argparse.SUPPRESS)
  
      if 'output-dir' not in blacklist:
          p.add_argument("-s", "--output-dir", required=True,
                         help="[REQUIRED] Directory or S3 URL For policy output")
  
      if 'cache' not in blacklist:
          p.add_argument(
              "-f", "--cache", default="~/.cache/cloud-custodian.cache",
              help="Cache file (default %(default)s)")
          p.add_argument(
              "--cache-period", default=15, type=int,
              help="Cache validity in minutes (default %(default)i)")
      else:
          p.add_argument("--cache", default=None, help=argparse.SUPPRESS)