Cloud Custodian

Introduction

Getting Started
Generic Filters
Generic Actions
- Webhook Action
Advanced Usage
Example tag compliance policy
Deployment

AWS

Getting Started
Example Policies
Monitoring your environment
Lambda Support
AWS Topics
Developer Guide
Adding New AWS Resources
AWS Reference
- AWS Execution Modes
  - pull
  - asg-instance-state
  - cloudtrail
  - config-poll-rule
  - config-rule
  - ec2-instance-state
  - guard-duty
  - hub-finding
  - hub-finding
  - periodic
  - phd
  - pull
- AWS Common Actions
- AWS Common Filters
  - alarm
  - api-cache
  - check-permissions
  - client-properties
  - config-compliance
  - connection-aliases
  - domain-options
  - engine
  - event
  - finding
  - health-event
  - iam-analyzer
  - image
  - instance-attribute
  - list-item
  - logging
  - login-profile
  - marked-for-op
  - metrics
  - network-location
  - offhour
  - onhour
  - ops-item
  - ownership
  - reduce
  - safety-rule
  - security-group
  - ses-agg-send-stats
  - shield-metrics
  - subnet
  - subscription-filter
  - tag-count
  - usage
  - usage-metric
  - value
  - vpc
- account resources
  - aws.account
    - Filters
    - Actions
- acm resources
  - aws.acm-certificate
    - Filters
    - Actions
- apigateway resources
  - aws.apigw-domain-name
    - Filters
    - Actions
  - aws.rest-account
    - Filters
    - Actions
  - aws.rest-api
    - Filters
    - Actions
  - aws.rest-client-certificate
    - Filters
    - Actions
  - aws.rest-resource
    - Filters
    - Actions
  - aws.rest-stage
    - Filters
    - Actions
  - aws.rest-vpclink
    - Filters
    - Actions
- apigatewayv2 resources
  - aws.apigwv2
    - Filters
    - Actions
- appflow resources
  - aws.app-flow
    - Filters
    - Actions
- appsync resources
  - aws.graphql-api
    - Filters
    - Actions
- autoscaling resources
  - aws.asg
    - Filters
    - Actions
  - aws.launch-config
    - Filters
    - Actions
  - aws.scaling-policy
    - Filters
    - Actions
- backup resources
  - aws.backup-plan
    - Filters
    - Actions
  - aws.backup-vault
    - Filters
    - Actions
- batch resources
- clouddirectory resources
  - aws.cloud-directory
    - Filters
    - Actions
- cloudformation resources
  - aws.cfn
    - Filters
    - Actions
- cloudfront resources
  - aws.distribution
    - Filters
    - Actions
  - aws.streaming-distribution
    - Filters
    - Actions
- cloudhsm resources
  - aws.hsm
    - Filters
    - Actions
  - aws.hsm-client
    - Filters
    - Actions
  - aws.hsm-hapg
    - Filters
    - Actions
- cloudhsmv2 resources
  - aws.cloudhsm-cluster
    - Filters
    - Actions
- cloudsearch resources
  - aws.cloudsearch
    - Filters
    - Actions
- cloudtrail resources
  - aws.cloudtrail
    - Filters
    - Actions
- cloudwatch resources
  - aws.alarm
    - Filters
    - Actions
  - aws.composite-alarm
    - Filters
    - Actions
  - aws.insight-rule
    - Filters
    - Actions
- codeartifact resources
  - aws.artifact-domain
    - Filters
    - Actions
  - aws.artifact-repo
    - Filters
    - Actions
- codebuild resources
  - aws.codebuild
    - Filters
    - Actions
- codecommit resources
  - aws.codecommit
    - Filters
    - Actions
- codedeploy resources
- codepipeline resources
  - aws.codepipeline
    - Filters
    - Actions
- cognito-identity resources
  - aws.identity-pool
    - Filters
    - Actions
- cognito-idp resources
  - aws.user-pool
    - Filters
    - Actions
- config resources
  - aws.config-recorder
    - Filters
    - Actions
  - aws.config-rule
    - Filters
    - Actions
- connect resources
  - aws.connect-instance
    - Filters
    - Actions
- datapipeline resources
  - aws.datapipeline
    - Filters
    - Actions
- dax resources
  - aws.dax
    - Filters
    - Actions
- directconnect resources
  - aws.directconnect
    - Filters
    - Actions
- dlm resources
  - aws.dlm-policy
    - Filters
    - Actions
- dms resources
  - aws.dms-endpoint
    - Filters
    - Actions
  - aws.dms-instance
    - Filters
    - Actions
- ds resources
  - aws.directory
    - Filters
    - Actions
- dynamodb resources
  - aws.dynamodb-backup
    - Filters
    - Actions
  - aws.dynamodb-table
    - Filters
    - Actions
- dynamodbstreams resources
  - aws.dynamodb-stream
    - Filters
    - Actions
- ec2 resources
  - aws.ami
    - Filters
    - Actions
  - aws.customer-gateway
    - Filters
    - Actions
  - aws.ebs
    - Filters
    - Actions
  - aws.ebs-snapshot
    - Filters
    - Actions
  - aws.ec2
    - Filters
    - Actions
  - aws.ec2-host
    - Filters
    - Actions
  - aws.ec2-reserved
    - Filters
    - Actions
  - aws.ec2-spot-fleet-request
    - Filters
    - Actions
  - aws.elastic-ip
    - Filters
    - Actions
  - aws.eni
    - Filters
    - Actions
  - aws.internet-gateway
    - Filters
    - Actions
  - aws.key-pair
    - Filters
    - Actions
  - aws.launch-template-version
    - Filters
    - Actions
  - aws.mirror-session
    - Filters
    - Actions
  - aws.mirror-target
    - Filters
    - Actions
  - aws.nat-gateway
    - Filters
    - Actions
  - aws.network-acl
    - Filters
    - Actions
  - aws.peering-connection
    - Filters
    - Actions
  - aws.prefix-list
    - Filters
    - Actions
  - aws.route-table
    - Filters
    - Actions
  - aws.security-group
    - Filters
    - Actions
  - aws.subnet
    - Filters
    - Actions
  - aws.transit-attachment
    - Filters
    - Actions
  - aws.transit-gateway
    - Filters
    - Actions
  - aws.vpc
    - Filters
    - Actions
  - aws.vpc-endpoint
    - Filters
    - Actions
  - aws.vpn-connection
    - Filters
    - Actions
  - aws.vpn-gateway
    - Filters
    - Actions
- ecr resources
  - aws.ecr
    - Filters
    - Actions
  - aws.ecr-image
    - Filters
    - Actions
- ecs resources
  - aws.ecs
    - Filters
    - Actions
  - aws.ecs-container-instance
    - Filters
    - Actions
  - aws.ecs-service
    - Filters
    - Actions
  - aws.ecs-task
    - Filters
    - Actions
  - aws.ecs-task-definition
    - Filters
    - Actions
- efs resources
  - aws.efs
    - Filters
    - Actions
  - aws.efs-mount-target
    - Filters
    - Actions
- eks resources
  - aws.eks
    - Filters
    - Actions
  - aws.eks-nodegroup
    - Filters
    - Actions
- elasticache resources
- elasticbeanstalk resources
  - aws.elasticbeanstalk
    - Filters
    - Actions
  - aws.elasticbeanstalk-environment
    - Filters
    - Actions
- elb resources
  - aws.elb
    - Filters
    - Actions
- elbv2 resources
  - aws.app-elb
    - Filters
    - Actions
  - aws.app-elb-target-group
    - Filters
    - Actions
- emr resources
  - aws.emr
    - Filters
    - Actions
  - aws.emr-security-configuration
    - Filters
    - Actions
- emr-serverless resources
  - aws.emr-serverless-app
    - Filters
    - Actions
- es resources
  - aws.elasticsearch
    - Filters
    - Actions
  - aws.elasticsearch-reserved
    - Filters
    - Actions
- events resources
  - aws.event-bus
    - Filters
    - Actions
  - aws.event-rule
    - Filters
    - Actions
  - aws.event-rule-target
    - Filters
    - Actions
- firehose resources
  - aws.firehose
    - Filters
    - Actions
- fis resources
  - aws.fis-experiment
    - Filters
    - Actions
  - aws.fis-template
    - Filters
    - Actions
- fsx resources
  - aws.fsx
    - Filters
    - Actions
  - aws.fsx-backup
    - Filters
    - Actions
- gamelift resources
  - aws.gamelift-build
    - Filters
    - Actions
  - aws.gamelift-fleet
    - Filters
    - Actions
- glacier resources
  - aws.glacier
    - Filters
    - Actions
- glue resources
  - aws.glue-catalog
    - Filters
    - Actions
  - aws.glue-classifier
    - Filters
    - Actions
  - aws.glue-connection
    - Filters
    - Actions
  - aws.glue-crawler
    - Filters
    - Actions
  - aws.glue-database
    - Filters
    - Actions
  - aws.glue-dev-endpoint
    - Filters
    - Actions
  - aws.glue-job
    - Filters
    - Actions
  - aws.glue-ml-transform
    - Filters
    - Actions
  - aws.glue-security-configuration
    - Filters
    - Actions
  - aws.glue-table
    - Filters
    - Actions
  - aws.glue-trigger
    - Filters
    - Actions
  - aws.glue-workflow
    - Filters
    - Actions
- health resources
  - aws.health-event
    - Filters
    - Actions
- iam resources
  - aws.iam-certificate
    - Filters
    - Actions
  - aws.iam-group
    - Filters
    - Actions
  - aws.iam-oidc-provider
    - Filters
    - Actions
  - aws.iam-policy
    - Filters
    - Actions
  - aws.iam-profile
    - Filters
    - Actions
  - aws.iam-role
    - Filters
    - Actions
  - aws.iam-saml-provider
    - Filters
    - Actions
  - aws.iam-user
    - Filters
    - Actions
- iot resources
  - aws.iot
    - Filters
    - Actions
- kafka resources
  - aws.kafka
    - Filters
    - Actions
- kinesis resources
  - aws.kinesis
    - Filters
    - Actions
- kinesisanalytics resources
  - aws.kinesis-analytics
    - Filters
    - Actions
- kinesisanalyticsv2 resources
  - aws.kinesis-analyticsv2
    - Filters
    - Actions
- kinesisvideo resources
  - aws.kinesis-video
    - Filters
    - Actions
- kms resources
  - aws.kms
    - Filters
    - Actions
  - aws.kms-key
    - Filters
    - Actions
- lakeformation resources
  - aws.datalake-location
    - Filters
    - Actions
- lambda resources
  - aws.lambda
    - Filters
    - Actions
  - aws.lambda-layer
    - Filters
    - Actions
- lightsail resources
- logs resources
  - aws.log-group
    - Filters
    - Actions
  - aws.log-metric
    - Filters
    - Actions
- machinelearning resources
  - aws.ml-model
    - Filters
    - Actions
- mq resources
  - aws.message-broker
    - Filters
    - Actions
  - aws.message-config
    - Filters
    - Actions
- mwaa resources
  - aws.airflow
    - Filters
    - Actions
- network-firewall resources
  - aws.firewall
    - Filters
    - Actions
- opsworks resources
  - aws.opswork-stack
    - Filters
    - Actions
- opsworkscm resources
  - aws.opswork-cm
    - Filters
    - Actions
- pinpoint resources
  - aws.pinpoint-app
    - Filters
    - Actions
- qldb resources
  - aws.qldb
    - Filters
    - Actions
- rds resources
  - aws.rds
    - Filters
    - Actions
  - aws.rds-cluster
    - Filters
    - Actions
  - aws.rds-cluster-param-group
    - Filters
    - Actions
  - aws.rds-cluster-snapshot
    - Filters
    - Actions
  - aws.rds-param-group
    - Filters
    - Actions
  - aws.rds-proxy
    - Filters
    - Actions
  - aws.rds-reserved
    - Filters
    - Actions
  - aws.rds-snapshot
    - Filters
    - Actions
  - aws.rds-subnet-group
    - Filters
    - Actions
  - aws.rds-subscription
    - Filters
    - Actions
- redshift resources
- route53 resources
  - aws.healthcheck
    - Filters
    - Actions
  - aws.hostedzone
    - Filters
    - Actions
  - aws.rrset
    - Filters
    - Actions
- route53-recovery-control-config resources
  - aws.recovery-cluster
    - Filters
    - Actions
  - aws.recovery-control-panel
    - Filters
    - Actions
- route53-recovery-readiness resources
  - aws.readiness-check
    - Filters
    - Actions
- route53domains resources
  - aws.r53domain
    - Filters
    - Actions
- route53resolver resources
  - aws.resolver-logs
    - Filters
    - Actions
- s3 resources
  - aws.s3
    - Filters
    - Actions
- s3control resources
  - aws.s3-access-point
    - Filters
    - Actions
  - aws.s3-access-point-multi
    - Filters
    - Actions
- sagemaker resources
- sdb resources
  - aws.simpledb
    - Filters
    - Actions
- secretsmanager resources
  - aws.secrets-manager
    - Filters
    - Actions
- serverlessrepo resources
  - aws.serverless-app
    - Filters
    - Actions
- service-quotas resources
  - aws.service-quota
    - Filters
    - Actions
  - aws.service-quota-request
    - Filters
    - Actions
- servicecatalog resources
  - aws.catalog-portfolio
    - Filters
    - Actions
  - aws.catalog-product
    - Filters
    - Actions
- ses resources
  - aws.ses-configuration-set
    - Filters
    - Actions
- shield resources
  - aws.shield-attack
    - Filters
    - Actions
  - aws.shield-protection
    - Filters
    - Actions
- snowball resources
  - aws.snowball
    - Filters
    - Actions
  - aws.snowball-cluster
    - Filters
    - Actions
- sns resources
  - aws.sns
    - Filters
    - Actions
  - aws.sns-subscription
    - Filters
    - Actions
- sqs resources
  - aws.sqs
    - Filters
    - Actions
- ssm resources
  - aws.ops-item
    - Filters
    - Actions
  - aws.ssm-activation
    - Filters
    - Actions
  - aws.ssm-data-sync
    - Filters
    - Actions
  - aws.ssm-document
    - Filters
    - Actions
  - aws.ssm-managed-instance
    - Filters
    - Actions
  - aws.ssm-parameter
    - Filters
    - Actions
- stepfunctions resources
  - aws.step-machine
    - Filters
    - Actions
- storagegateway resources
  - aws.storage-gateway
    - Filters
    - Actions
- support resources
  - aws.support-case
    - Filters
    - Actions
- swf resources
  - aws.swf-domain
    - Filters
    - Actions
- timestream-write resources
  - aws.timestream-database
    - Filters
    - Actions
  - aws.timestream-table
    - Filters
    - Actions
- transfer resources
  - aws.transfer-server
    - Filters
    - Actions
  - aws.transfer-user
    - Filters
    - Actions
- waf resources
  - aws.waf
    - Filters
    - Actions
- waf-regional resources
  - aws.waf-regional
    - Filters
    - Actions
- wafv2 resources
  - aws.wafv2
    - Filters
    - Actions
- workspaces resources

Azure

Getting Started
Configuring Azure Policies
Examples
Advanced Usage
Azure Reference

GCP

Getting Started (Beta)
Examples
Policies
- Generic Actions
  - Notify
- Load Balancer
Developer Guide
Adding New GCP Resources
- Create New GCP Resource
- Load New GCP Resource
Testing
- Updating Existing Tests
GCP Reference

Tencent Cloud

Tencent Cloud
Installation
Usage
Tencent Cloud Reference

Kubernetes

Getting Started (Alpha)
Kubernetes Controller Mode
- Install the Server
Option 1: Manual installation
Option 2: Helm chart
- Testing
- Authoring Policies
Examples

Tools

c7n-org: Multi Account Custodian Execution
c7n-mailer: Custodian Mailer
Custodian policies for Infrastructure Code
Custodian Kubernetes Support
cask: easy custodian exec via docker
- Install
- Run
- Build
c7n-log-exporter: Cloud watch log exporter automation
c7n-trailcreator: Retroactive Resource Creator Tagging
c7n-policystream: Policy Changes from Git
- Install
- Build
- Usage
- Options
OmniSSM - EC2 Systems Manager Automation
c7n-guardian: Automated multi-account Guard Duty setup
- Accounts Credentials
- Using custodian policies for remediation
c7n-salactus: Distributed Scale out S3 processing

Contributing

Contributing to Cloud Custodian
Developer Guide
Installing for Developers
- Installing Prerequisites
  - Install Python 3
  - Install Poetry
    - On Mac/Linux
    - On Windows with Powershell
- Installing Custodian
Testing for Developers
Documentation For Developers
Packaging Custodian
- Usage
- Caveats

Cloud Custodian

AWS Reference
storagegateway resources
aws.storage-gateway

Previous Next

aws.storage-gateway¶

Filters¶

event

finding

health-event

list-item

ops-item

reduce

value

Actions¶

invoke-lambda

invoke-sfn

notify

post-finding

post-item

put-metric

webhook

Previous Next

© Copyright .

Built with Sphinx using a theme provided by Read the Docs.