Cloud Custodian

Introduction

Getting Started
Generic Filters
- Value Filter
- Event Filter
Generic Actions
- Webhook Action
Advanced Usage
Example tag compliance policy
Deployment

AWS

Getting Started
Example Policies
AWS Modes
Monitoring your environment
Lambda Support
AWS Topics
AWS Reference
- AWS Common Actions
- AWS Common Filters
  - check-permissions
  - config-compliance
  - event
  - finding
  - health-event
  - image
  - marked-for-op
  - metrics
  - network-location
  - offhour
  - onhour
  - ops-item
  - security-group
  - shield-metrics
  - subnet
  - tag-count
  - usage
  - value
  - vpc
- account resources
  - aws.account
    - Filters
    - Actions
- acm resources
  - aws.acm-certificate
    - Filters
    - Actions
- apigateway resources
  - aws.rest-account
    - Filters
    - Actions
  - aws.rest-api
    - Filters
    - Actions
  - aws.rest-resource
    - Filters
    - Actions
  - aws.rest-stage
    - Filters
    - Actions
  - aws.rest-vpclink
    - Filters
    - Actions
- autoscaling resources
  - aws.asg
    - Filters
    - Actions
  - aws.launch-config
    - Filters
    - Actions
- backup resources
  - aws.backup-plan
    - Filters
    - Actions
- batch resources
  - aws.batch-compute
    - Filters
    - Actions
  - aws.batch-definition
    - Filters
    - Actions
- clouddirectory resources
  - aws.cloud-directory
    - Filters
    - Actions
- cloudformation resources
  - aws.cfn
    - Filters
    - Actions
- cloudfront resources
  - aws.distribution
    - Filters
    - Actions
  - aws.streaming-distribution
    - Filters
    - Actions
- cloudhsm resources
  - aws.hsm
    - Filters
    - Actions
  - aws.hsm-client
    - Filters
    - Actions
  - aws.hsm-hapg
    - Filters
    - Actions
- cloudhsmv2 resources
  - aws.cloudhsm-cluster
    - Filters
    - Actions
- cloudsearch resources
  - aws.cloudsearch
    - Filters
    - Actions
- cloudtrail resources
  - aws.cloudtrail
    - Filters
    - Actions
- cloudwatch resources
  - aws.alarm
    - Filters
    - Actions
- codebuild resources
  - aws.codebuild
    - Filters
    - Actions
- codecommit resources
  - aws.codecommit
    - Filters
    - Actions
- codepipeline resources
  - aws.codepipeline
    - Filters
    - Actions
- cognito-identity resources
  - aws.identity-pool
    - Filters
    - Actions
- cognito-idp resources
  - aws.user-pool
    - Filters
    - Actions
- config resources
  - aws.config-recorder
    - Filters
    - Actions
  - aws.config-rule
    - Filters
    - Actions
- datapipeline resources
  - aws.datapipeline
    - Filters
    - Actions
- dax resources
  - aws.dax
    - Filters
    - Actions
- directconnect resources
  - aws.directconnect
    - Filters
    - Actions
- dlm resources
  - aws.dlm-policy
    - Filters
    - Actions
- dms resources
  - aws.dms-endpoint
    - Filters
    - Actions
  - aws.dms-instance
    - Filters
    - Actions
- ds resources
  - aws.directory
    - Filters
    - Actions
- dynamodb resources
  - aws.dynamodb-backup
    - Filters
    - Actions
  - aws.dynamodb-table
    - Filters
    - Actions
- dynamodbstreams resources
  - aws.dynamodb-stream
    - Filters
    - Actions
- ec2 resources
  - aws.ami
    - Filters
    - Actions
  - aws.customer-gateway
    - Filters
    - Actions
  - aws.ebs
    - Filters
    - Actions
  - aws.ebs-snapshot
    - Filters
    - Actions
  - aws.ec2
    - Filters
    - Actions
  - aws.ec2-reserved
    - Filters
    - Actions
  - aws.eni
    - Filters
    - Actions
  - aws.internet-gateway
    - Filters
    - Actions
  - aws.key-pair
    - Filters
    - Actions
  - aws.launch-template-version
    - Filters
    - Actions
  - aws.nat-gateway
    - Filters
    - Actions
  - aws.network-acl
    - Filters
    - Actions
  - aws.network-addr
    - Filters
    - Actions
  - aws.peering-connection
    - Filters
    - Actions
  - aws.route-table
    - Filters
    - Actions
  - aws.security-group
    - Filters
    - Actions
  - aws.subnet
    - Filters
    - Actions
  - aws.transit-attachment
    - Filters
    - Actions
  - aws.transit-gateway
    - Filters
    - Actions
  - aws.vpc
    - Filters
    - Actions
  - aws.vpc-endpoint
    - Filters
    - Actions
  - aws.vpn-connection
    - Filters
    - Actions
  - aws.vpn-gateway
    - Filters
    - Actions
- ecr resources
  - aws.ecr
    - Filters
    - Actions
- ecs resources
  - aws.ecs
    - Filters
    - Actions
  - aws.ecs-container-instance
    - Filters
    - Actions
  - aws.ecs-service
    - Filters
    - Actions
  - aws.ecs-task
    - Filters
    - Actions
  - aws.ecs-task-definition
    - Filters
    - Actions
- efs resources
  - aws.efs
    - Filters
    - Actions
  - aws.efs-mount-target
    - Filters
    - Actions
- eks resources
  - aws.eks
    - Filters
    - Actions
- elasticache resources
- elasticbeanstalk resources
  - aws.elasticbeanstalk
    - Filters
    - Actions
  - aws.elasticbeanstalk-environment
    - Filters
    - Actions
- elb resources
  - aws.elb
    - Filters
    - Actions
- elbv2 resources
  - aws.app-elb
    - Filters
    - Actions
  - aws.app-elb-target-group
    - Filters
    - Actions
- emr resources
  - aws.emr
    - Filters
    - Actions
- es resources
  - aws.elasticsearch
    - Filters
    - Actions
- events resources
  - aws.event-rule
    - Filters
    - Actions
  - aws.event-rule-target
    - Filters
    - Actions
- firehose resources
  - aws.firehose
    - Filters
    - Actions
- fsx resources
  - aws.fsx
    - Filters
    - Actions
  - aws.fsx-backup
    - Filters
    - Actions
- gamelift resources
  - aws.gamelift-build
    - Filters
    - Actions
  - aws.gamelift-fleet
    - Filters
    - Actions
- glacier resources
  - aws.glacier
    - Filters
    - Actions
- glue resources
  - aws.glue-connection
    - Filters
    - Actions
  - aws.glue-crawler
    - Filters
    - Actions
  - aws.glue-database
    - Filters
    - Actions
  - aws.glue-dev-endpoint
    - Filters
    - Actions
  - aws.glue-job
    - Filters
    - Actions
  - aws.glue-table
    - Filters
    - Actions
- health resources
  - aws.health-event
    - Filters
    - Actions
- iam resources
  - aws.iam-certificate
    - Filters
    - Actions
  - aws.iam-group
    - Filters
    - Actions
  - aws.iam-policy
    - Filters
    - Actions
  - aws.iam-profile
    - Filters
    - Actions
  - aws.iam-role
    - Filters
    - Actions
  - aws.iam-user
    - Filters
    - Actions
- iot resources
  - aws.iot
    - Filters
    - Actions
- kafka resources
  - aws.kafka
    - Filters
    - Actions
- kinesis resources
  - aws.kinesis
    - Filters
    - Actions
- kinesisanalytics resources
  - aws.kinesis-analytics
    - Filters
    - Actions
- kms resources
  - aws.kms
    - Filters
    - Actions
  - aws.kms-key
    - Filters
    - Actions
- lambda resources
  - aws.lambda
    - Filters
    - Actions
  - aws.lambda-layer
    - Filters
    - Actions
- lightsail resources
- logs resources
  - aws.log-group
    - Filters
    - Actions
- machinelearning resources
  - aws.ml-model
    - Filters
    - Actions
- mq resources
  - aws.message-broker
    - Filters
    - Actions
- opsworks resources
  - aws.opswork-stack
    - Filters
    - Actions
- opsworkscm resources
  - aws.opswork-cm
    - Filters
    - Actions
- rds resources
  - aws.rds
    - Filters
    - Actions
  - aws.rds-cluster
    - Filters
    - Actions
  - aws.rds-cluster-param-group
    - Filters
    - Actions
  - aws.rds-cluster-snapshot
    - Filters
    - Actions
  - aws.rds-param-group
    - Filters
    - Actions
  - aws.rds-reserved
    - Filters
    - Actions
  - aws.rds-snapshot
    - Filters
    - Actions
  - aws.rds-subnet-group
    - Filters
    - Actions
  - aws.rds-subscription
    - Filters
    - Actions
- redshift resources
- route53 resources
  - aws.healthcheck
    - Filters
    - Actions
  - aws.hostedzone
    - Filters
    - Actions
  - aws.rrset
    - Filters
    - Actions
- route53domains resources
  - aws.r53domain
    - Filters
    - Actions
- s3 resources
  - aws.s3
    - Filters
    - Actions
- sagemaker resources
- sdb resources
  - aws.simpledb
    - Filters
    - Actions
- secretsmanager resources
  - aws.secrets-manager
    - Filters
    - Actions
- shield resources
  - aws.shield-attack
    - Filters
    - Actions
  - aws.shield-protection
    - Filters
    - Actions
- snowball resources
  - aws.snowball
    - Filters
    - Actions
  - aws.snowball-cluster
    - Filters
    - Actions
- sns resources
  - aws.sns
    - Filters
    - Actions
- sqs resources
  - aws.sqs
    - Filters
    - Actions
- ssm resources
- stepfunctions resources
  - aws.step-machine
    - Filters
    - Actions
- storagegateway resources
  - aws.storage-gateway
    - Filters
    - Actions
- support resources
  - aws.support-case
    - Filters
    - Actions
- waf resources
  - aws.waf
    - Filters
    - Actions
- waf-regional resources
  - aws.waf-regional
    - Filters
    - Actions
- workspaces resources
  - aws.workspaces
    - Filters
    - Actions

Azure

Getting Started
Configuring Azure Policies
Examples
Advanced Usage
Azure Reference
- Azure Common Actions
  - auto-tag-date
  - auto-tag-user
  - delete
  - lock
  - logic-app
  - mark-for-op
  - notify
  - tag
  - tag-trim
  - untag
  - webhook
- Azure Common Filters
- AI + Machine Learning resources
  - azure.cognitiveservice
    - Filters
    - Actions
  - azure.databricks
    - Filters
    - Actions
- Active Directory resources
  - azure.roleassignment
    - Filters
    - Actions
  - azure.roledefinition
    - Filters
    - Actions
- Analytics resources
  - azure.datafactory
    - Filters
    - Actions
- Compute resources
  - azure.aks
    - Filters
    - Actions
  - azure.appserviceplan
    - Filters
    - Actions
  - azure.batch
    - Filters
    - Actions
  - azure.image
    - Filters
    - Actions
  - azure.vm
    - Filters
    - Actions
  - azure.vmss
    - Filters
    - Actions
  - azure.webapp
    - Filters
    - Actions
- Containers resources
- Databases resources
  - azure.cosmosdb
    - Filters
    - Actions
  - azure.cosmosdb-collection
    - Filters
    - Actions
  - azure.cosmosdb-database
    - Filters
    - Actions
  - azure.redis
    - Filters
    - Actions
  - azure.sqldatabase
    - Filters
    - Actions
  - azure.sqlserver
    - Filters
    - Actions
- Events resources
  - azure.eventhub
    - Filters
    - Actions
  - azure.eventsubscription
    - Filters
    - Actions
- Generic resources
  - azure.armresource
    - Filters
    - Actions
  - azure.policyassignments
    - Filters
    - Actions
- Integration resources
  - azure.api-management
    - Filters
    - Actions
- Internet Of Things resources
  - azure.iothub
    - Filters
    - Actions
- Media resources
  - azure.cdnprofile
    - Filters
    - Actions
- Networking resources
  - azure.dnszone
    - Filters
    - Actions
  - azure.loadbalancer
    - Filters
    - Actions
  - azure.networkinterface
    - Filters
    - Actions
  - azure.networksecuritygroup
    - Filters
    - Actions
  - azure.publicip
    - Filters
    - Actions
  - azure.recordset
    - Filters
    - Actions
  - azure.routetable
    - Filters
    - Actions
  - azure.vnet
    - Filters
    - Actions
- Resource Group resources
  - azure.resourcegroup
    - Filters
    - Actions
- Security resources
- Storage resources
  - azure.datalake
    - Filters
    - Actions
  - azure.disk
    - Filters
    - Actions
  - azure.storage
    - Filters
    - Actions
- Subscription resources
- Web resources
  - azure.appserviceplan
    - Filters
    - Actions
  - azure.webapp
    - Filters
    - Actions

GCP

Getting Started (Beta)
GCP Modes
Examples
Policies
- Generic Actions
  - Notify
- Load Balancer
Developer Guide
Adding New GCP Resources
- Create New GCP Resource
- Load New GCP Resource
Testing
GCP Reference

Tools

c7n-org: Multi Account Custodian Execution
cask: easy custodian exec via docker
- Install
- Run
- Build
c7n-mailer: Custodian Mailer
c7n-log-exporter: Cloud watch log exporter automation
c7n-trailcreator: Retroactive Resource Creator Tagging
c7n-policystream: Policy Changes from Git
- Install
- Build
- Usage
- Options
OmniSSM - EC2 Systems Manager Automation
c7n-guardian: Automated multi-account Guard Duty setup
- Accounts Credentials
- Using custodian policies for remediation
c7n-salactus: Distributed Scale out S3 processing

Contributing

Contributing to Cloud Custodian
Developer Guide
Installing for Developers
- Installing Prerequisites
  - Install Python 3.7
    - On Ubuntu
    - On macOS with Homebrew
  - Basic Python Tools
- Installing Custodian
Testing for Developers
Documentation For Developers

Cloud Custodian

»
GCP Reference »
iam resources »
gcp.project-role

Next Previous

gcp.project-role¶

Filters¶

event

value

Actions¶

notify

post-finding

webhook

Next Previous

Built with Sphinx using a theme provided by Read the Docs.