c7n.filters package

Submodules

c7n.filters.config module

class c7n.filters.config.ConfigCompliance(data, manager=None)

Bases: c7n.filters.core.Filter

Filter resources by their compliance with one or more AWS config rules.

An example of using the filter to find all ec2 instances that have been registered as non compliant in the last 30 days against two custom AWS Config rules.

Example

policies:
  - name: non-compliant-ec2
    resource: ec2
    filters:
     - type: config-compliance
       eval_filters:
        - type: value
          key: ResultRecordedTime
          value_type: age
          value: 30
          op: less-than
       rules:
        - custodian-ec2-encryption-required
        - custodian-ec2-tags-required

Also note, custodian has direct support for deploying policies as config rules see https://bit.ly/2mblVpq

annotation_key = 'c7n:config-compliance'

get_resource_map(filters, resource_model, resources)

permissions = ('config:DescribeComplianceByConfigRule',)

process(resources, event=None)

Bulk process resources and return filtered set.

classmethod register_resources(registry, resource_class)

model resource subscriber on resource registration.

Watch for new resource types being registered if they support aws config, automatically, register the config-compliance filter.

schema = {'additionalProperties': False, 'properties': {'eval_filters': {'items': {'oneOf': [{'$ref': '#/definitions/filters/valuekv'}, {'$ref': '#/definitions/filters/value'}]}, 'type': 'array'}, 'op': {'enum': ['or', 'and']}, 'rules': {'items': {'type': 'string'}, 'type': 'array'}, 'states': {'items': {'enum': ['COMPLIANT', 'NON_COMPLIANT', 'NOT_APPLICABLE', 'INSUFFICIENT_DATA']}, 'type': 'array'}, 'type': {'enum': ['config-compliance']}}, 'required': ('rules',), 'type': 'object'}

schema_alias = True

c7n.filters.core module

Resource Filtering Logic

class c7n.filters.core.AgeFilter(data, manager=None)

Bases: c7n.filters.core.Filter

Automatically filter resources older than a given date.

date_attribute = None

get_resource_date(i)

schema = None

threshold_date = None

validate()

validate filter config, return validation error or self

class c7n.filters.core.And(data, registry, manager)

Bases: c7n.filters.core.BooleanGroupFilter

process(resources, events=None)

Bulk process resources and return filtered set.

type = 'and'

class c7n.filters.core.AnnotationSweeper(id_key, resources)

Bases: object

Support clearing annotations set within a block filter.

See https://github.com/cloud-custodian/cloud-custodian/issues/2116

sweep(resources)

class c7n.filters.core.BooleanGroupFilter(data, registry, manager)

Bases: c7n.filters.core.Filter

validate()

validate filter config, return validation error or self

class c7n.filters.core.EventFilter(data, manager=None)

Bases: c7n.filters.core.ValueFilter

Filter against a cloudwatch event associated to a resource type.

process(resources, event=None)

Bulk process resources and return filtered set.

schema = {'additionalProperties': False, 'properties': {'default': {'type': 'object'}, 'key': {'type': 'string'}, 'op': {'$ref': '#/definitions/filters_common/comparison_operators'}, 'type': {'enum': ['event']}, 'value': {'$ref': '#/definitions/filters_common/value'}, 'value_from': {'$ref': '#/definitions/filters_common/value_from'}, 'value_type': {'$ref': '#/definitions/filters_common/value_types'}}, 'required': ['type'], 'type': 'object'}

type = 'event'

validate()

validate filter config, return validation error or self

class c7n.filters.core.Filter(data, manager=None)

Bases: object

executor_factory

alias of concurrent.futures.thread.ThreadPoolExecutor

get_block_operator()

Determine the immediate parent boolean operator for a filter

get_permissions()

log = <Logger custodian.filters (DEBUG)>

merge_annotation(r, annotation_key, values)

metrics = ()

permissions = ()

process(resources, event=None)

Bulk process resources and return filtered set.

schema = {'type': 'object'}

schema_alias = None

validate()

validate filter config, return validation error or self

class c7n.filters.core.FilterRegistry(*args, **kw)

Bases: c7n.registry.PluginRegistry

factory(data, manager=None)

Factory func for filters.

data - policy config for filters manager - resource type manager (ec2, s3, etc)

parse(data, manager)

exception c7n.filters.core.FilterValidationError

Bases: Exception

class c7n.filters.core.Not(data, registry, manager)

Bases: c7n.filters.core.BooleanGroupFilter

process(resources, event=None)

Bulk process resources and return filtered set.

process_set(resources, event)

type = 'not'

class c7n.filters.core.Or(data, registry, manager)

Bases: c7n.filters.core.BooleanGroupFilter

process(resources, event=None)

Bulk process resources and return filtered set.

process_set(resources, event)

type = 'or'

class c7n.filters.core.ValueFilter(data, manager=None)

Bases: c7n.filters.core.Filter

Generic value filter using jmespath

annotate = True

expr = None

get_resource_value(k, i)

match(i)

op = None

process(resources, event=None)

Bulk process resources and return filtered set.

process_value_type(sentinel, value, resource)

required_keys = {'key', 'value'}

schema = {'additionalProperties': False, 'properties': {'default': {'type': 'object'}, 'key': {'type': 'string'}, 'op': {'$ref': '#/definitions/filters_common/comparison_operators'}, 'type': {'enum': ['value']}, 'value': {'$ref': '#/definitions/filters_common/value'}, 'value_from': {'$ref': '#/definitions/filters_common/value_from'}, 'value_type': {'$ref': '#/definitions/filters_common/value_types'}}, 'required': ['type'], 'type': 'object'}

type = 'value'

v = None

validate()

validate filter config, return validation error or self

vtype = None

c7n.filters.core.difference(x, y)

c7n.filters.core.glob_match(value, pattern)

c7n.filters.core.intersect(x, y)

c7n.filters.core.intersect_list(a, b)

c7n.filters.core.operator_in(x, y)

c7n.filters.core.operator_ni(x, y)

c7n.filters.core.regex_case_sensitive_match(value, regex)

c7n.filters.core.regex_match(value, regex)

c7n.filters.health module

class c7n.filters.health.HealthEventFilter(data, manager=None)

Bases: c7n.filters.core.Filter

Check if there are health events related to the resources

Health events are stored as annotation on a resource.

get_filter_parameters()

permissions = ('health:DescribeEvents', 'health:DescribeAffectedEntities', 'health:DescribeEventDetails')

process(resources, event=None)

Bulk process resources and return filtered set.

process_event(client, health_events)

classmethod register_resources(registry, resource_class)

meta model subscriber on resource registration.

We watch for PHD event that provides affected entities and register the health-event filter to the resources.

schema = {'additionalProperties': False, 'properties': {'category': {'items': {'enum': ['issue', 'accountNotification', 'scheduledChange']}, 'type': 'array'}, 'statuses': {'items': {'enum': ['open', 'upcoming', 'closed'], 'type': 'string'}, 'type': 'array'}, 'type': {'enum': ['health-event']}, 'types': {'items': {'type': 'string'}, 'type': 'array'}}, 'required': ['type'], 'type': 'object'}

c7n.filters.iamaccess module

IAM Resource Policy Checker

When securing resources with iam policies, we want to parse and evaluate the resource’s policy for any cross account or public access grants that are not intended.

In general, iam policies can be complex, and where possible using iam simulate is preferrable, but requires passing the caller’s arn, which is not feasible when we’re evaluating who the valid set of callers are.

References

• IAM Policy Evaluation https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html

• IAM Policy Reference https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html

class c7n.filters.iamaccess.CrossAccountAccessFilter(data, manager=None)

Bases: c7n.filters.core.Filter

Check a resource’s embedded iam policy for cross account access.

annotation_key = 'CrossAccountViolations'

checker_factory

alias of PolicyChecker

get_accounts()

get_orgids()

get_resource_policy(r)

get_vpces()

get_vpcs()

policy_attribute = 'Policy'

process(resources, event=None)

Bulk process resources and return filtered set.

schema = {'additionalProperties': False, 'properties': {'actions': {'items': {'type': 'string'}, 'type': 'array'}, 'everyone_only': {'type': 'boolean'}, 'type': {'enum': ['cross-account']}, 'whitelist': {'items': {'type': 'string'}, 'type': 'array'}, 'whitelist_conditions': {'items': {'type': 'string'}, 'type': 'array'}, 'whitelist_from': {'ref': '#/definitions/filters_common/value_from'}, 'whitelist_orgids': {'items': {'type': 'string'}, 'type': 'array'}, 'whitelist_orgids_from': {'ref': '#/definitions/filters_common/value_from'}, 'whitelist_vpc': {'items': {'type': 'string'}, 'type': 'array'}, 'whitelist_vpc_from': {'ref': '#/definitions/filters_common/value_from'}, 'whitelist_vpce': {'items': {'type': 'string'}, 'type': 'array'}, 'whitelist_vpce_from': {'ref': '#/definitions/filters_common/value_from'}}, 'required': ['type'], 'type': 'object'}

class c7n.filters.iamaccess.PolicyChecker(checker_config)

Bases: object

checker_config:

• check_actions: only check one of the specified actions

• everyone_only: only check for wildcard permission grants

• allowed_accounts: permission grants to these accounts are okay

• whitelist_conditions: a list of conditions that are considered

  sufficient enough to whitelist the statement.

allowed_accounts

allowed_orgid

allowed_vpc

allowed_vpce

check(policy_text)

check_actions

everyone_only

handle_action(s)

handle_aws_principalorgid(s, c)

handle_aws_sourcearn(s, c)

handle_aws_sourceip(s, c)

handle_aws_sourceowner(s, c)

handle_aws_sourcevpc(s, c)

handle_aws_sourcevpce(s, c)

handle_condition(s, c)

handle_conditions(s)

handle_effect(s)

handle_kms_calleraccount(s, c)

handle_principal(s)

handle_statement(s)

normalize_conditions(s)

whitelist_conditions

c7n.filters.kms module

class c7n.filters.kms.KmsRelatedFilter(data, manager=None)

Bases: c7n.filters.related.RelatedResourceFilter

Filter a resource by its associcated kms key and optionally the aliasname of the kms key by using ‘c7n:AliasName’

Example

policies:
    - name:
      resource: dms-instance
      filters:
        - type: kms-key
          key: c7n:AliasName
          value: alias/aws/dms

AnnotationKey = 'matched-kms-key'

RelatedResource = 'c7n.resources.kms.Key'

process(resources, event=None)

Bulk process resources and return filtered set.

schema = {'additionalProperties': False, 'properties': {'default': {'type': 'object'}, 'key': {'type': 'string'}, 'match-resource': {'type': 'boolean'}, 'op': {'$ref': '#/definitions/filters_common/comparison_operators'}, 'operator': {'enum': ['and', 'or']}, 'type': {'enum': ['kms-key']}, 'value': {'$ref': '#/definitions/filters_common/value'}, 'value_from': {'$ref': '#/definitions/filters_common/value_from'}, 'value_type': {'$ref': '#/definitions/filters_common/value_types'}}, 'required': ['type'], 'type': 'object'}

c7n.filters.locked module

Filters for api integration with tools/c7n_sphere11

class c7n.filters.locked.Locked(data, manager=None)

Bases: c7n.filters.core.Filter

Has the resource been locked using sphere11

get_api_credentials()

get_lock_status(resource)

get_parent_id(resource, account_id)

permissions = ('sts:AssumeRole',)

process(resources, event=None)

Bulk process resources and return filtered set.

schema = {'additionalProperties': False, 'properties': {'endpoint': {'type': 'string'}, 'region': {'type': 'string'}, 'role': {'type': 'string'}, 'type': {'enum': ['locked']}}, 'required': ('endpoint',), 'type': 'object'}

class c7n.filters.locked.SignatureAuth(credentials, region, service)

Bases: botocore.vendored.requests.auth.AuthBase

AWS V4 Request Signer for Requests.

c7n.filters.metrics module

CloudWatch Metrics suppport for resources

class c7n.filters.metrics.MetricsFilter(data, manager=None)

Bases: c7n.filters.core.Filter

Supports cloud watch metrics filters on resources.

All resources that have cloud watch metrics are supported.

Docs on cloud watch metrics

• GetMetricStatistics https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricStatistics.html

• Supported Metrics https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/aws-services-cloudwatch-metrics.html

- name: ec2-underutilized
  resource: ec2
  filters:
    - type: metrics
      name: CPUUtilization
      days: 4
      period: 86400
      value: 30
      op: less-than

Note periods when a resource is not sending metrics are not part of calculated statistics as in the case of a stopped ec2 instance, nor for resources to new to have existed the entire period. ie. being stopped for an ec2 instance wouldn’t lower the average cpu utilization.

Note the default statistic for metrics is Average.

DEFAULT_NAMESPACE = {'cloudfront': 'AWS/CloudFront', 'cloudsearch': 'AWS/CloudSearch', 'dynamodb': 'AWS/DynamoDB', 'ec2': 'AWS/EC2', 'ecs': 'AWS/ECS', 'efs': 'AWS/EFS', 'elasticache': 'AWS/ElastiCache', 'elb': 'AWS/ELB', 'elbv2': 'AWS/ApplicationELB', 'emr': 'AWS/ElasticMapReduce', 'es': 'AWS/ES', 'events': 'AWS/Events', 'firehose': 'AWS/Firehose', 'kinesis': 'AWS/Kinesis', 'lambda': 'AWS/Lambda', 'logs': 'AWS/Logs', 'rds': 'AWS/RDS', 'redshift': 'AWS/Redshift', 'route53': 'AWS/Route53', 's3': 'AWS/S3', 'sns': 'AWS/SNS', 'sqs': 'AWS/SQS', 'workspaces': 'AWS/WorkSpaces'}

MAX_QUERY_POINTS = 50850

MAX_RESULT_POINTS = 1440

get_dimensions(resource)

permissions = ('cloudwatch:GetMetricStatistics',)

process(resources, event=None)

Bulk process resources and return filtered set.

process_resource_set(resource_set)

schema = {'additionalProperties': False, 'properties': {'attr-multiplier': {'type': 'number'}, 'days': {'type': 'number'}, 'dimensions': {'items': {'type': 'string'}, 'type': 'array'}, 'name': {'type': 'string'}, 'namespace': {'type': 'string'}, 'op': {'enum': ['eq', 'equal', 'ne', 'not-equal', 'gt', 'greater-than', 'ge', 'gte', 'le', 'lte', 'lt', 'less-than', 'glob', 'regex', 'regex-case', 'in', 'ni', 'not-in', 'contains', 'difference', 'intersect'], 'type': 'string'}, 'percent-attr': {'type': 'string'}, 'period': {'type': 'number'}, 'statistics': {'enum': ['Average', 'Sum', 'Maximum', 'Minimum', 'SampleCount'], 'type': 'string'}, 'type': {'enum': ['metrics']}, 'value': {'type': 'number'}}, 'required': ('value', 'name'), 'type': 'object'}

schema_alias = True

class c7n.filters.metrics.ShieldMetrics(data, manager=None)

Bases: c7n.filters.metrics.MetricsFilter

Specialized metrics filter for shield

attack_vectors = ('ACKFlood', 'ChargenReflection', 'DNSReflection', 'GenericUDPReflection', 'MSSQLReflection', 'NetBIOSReflection', 'NTPReflection', 'PortMapper', 'RequestFlood', 'RIPReflection', 'SNMPReflection', 'SYNFlood', 'SSDPReflection', 'UDPTraffic', 'UDPFragment')

get_dimensions(resource)

metrics = ('DDoSAttackBitsPerSecond', 'DDoSAttackRequestsPerSecond', 'DDoSDetected')

namespace = 'AWS/DDoSProtection'

process(resources, event=None)

Bulk process resources and return filtered set.

schema = {'additionalProperties': False, 'properties': {'attr-multiplier': {'type': 'number'}, 'days': {'type': 'number'}, 'dimensions': {'items': {'type': 'string'}, 'type': 'array'}, 'name': {'type': 'string'}, 'namespace': {'type': 'string'}, 'op': {'enum': ['eq', 'equal', 'ne', 'not-equal', 'gt', 'greater-than', 'ge', 'gte', 'le', 'lte', 'lt', 'less-than', 'glob', 'regex', 'regex-case', 'in', 'ni', 'not-in', 'contains', 'difference', 'intersect'], 'type': 'string'}, 'percent-attr': {'type': 'string'}, 'period': {'type': 'number'}, 'statistics': {'enum': ['Average', 'Sum', 'Maximum', 'Minimum', 'SampleCount'], 'type': 'string'}, 'type': {'enum': ['shield-metrics']}, 'value': {'type': 'number'}}, 'required': ['type'], 'type': 'object'}

validate()

validate filter config, return validation error or self

c7n.filters.missing module

class c7n.filters.missing.Missing(data, manager)

Bases: c7n.filters.core.Filter

Assert the absence of a particular resource.

Intended for use at a logical account/subscription/project level

This works as an effectively an embedded policy thats evaluated.

get_permissions()

process(resources, event=None)

Bulk process resources and return filtered set.

schema = {'additionalProperties': False, 'properties': {'policy': {'type': 'object'}, 'type': {'enum': ['missing']}}, 'required': ['policy', 'type'], 'type': 'object'}

validate()

validate filter config, return validation error or self

c7n.filters.multiattr module

class c7n.filters.multiattr.MultiAttrFilter(data, manager=None)

Bases: c7n.filters.core.Filter

get_attr_filters()

Return an iterator resource attribute filters configured.

get_target(resource)

Return the resource, or related resource that should be attribute matched.

multi_attrs = {}

process(resources, event=None)

Bulk process resources and return filtered set.

validate()

validate filter config, return validation error or self

c7n.filters.offhours module

Resource Scheduling Offhours

Custodian provides for time based filters, that allow for taking periodic action on a resource, with resource schedule customization based on tag values. A common use is offhours scheduling for asgs and instances.

Features

• Flexible offhours scheduling with opt-in, opt-out selection, and timezone support.

• Resume during offhours support.

• Can be combined with other filters to get a particular set ( resources with tag, vpc, etc).

• Can be combined with arbitrary actions

• Can omit a set of dates such as public holidays.

Policy Configuration

We provide an onhour and offhour time filter, each should be used in a different policy, they support the same configuration options:

• weekends: default true, whether to leave resources off for the weekend

• weekend-only: default false, whether to turn the resource off only on the weekend

• default_tz: which timezone to utilize when evaluating time (REQUIRED)

• tag: which resource tag name to use for per-resource configuration (schedule and timezone overrides and opt-in/opt-out); default is maid_offhours.

• opt-out: Determines the behavior for resources which do not have a tag matching the one specified for tag. Values can be either false (the default) where the policy operates on an opt-in basis and resources must have the tag in order to be acted on by the policy, or true where the policy operates on an opt-out basis, and resources without the tag are acted on by the policy.

• onhour: the default time to start/run resources, specified as 0-23

• offhour: the default time to stop/suspend resources, specified as 0-23

• skip-days: a list of dates to skip. Dates must use format YYYY-MM-DD

• skip-days-from: a list of dates to skip stored at a url. expr, format, and url must be passed as parameters. Same syntax as value_from. Can not specify both skip-days-from and skip-days.

This example policy overrides most of the defaults for an offhour policy:

policies:
  - name: offhours-stop
    resource: ec2
    filters:
      - type: offhour
        weekends: false
        default_tz: pt
        tag: downtime
        opt-out: true
        onhour: 8
        offhour: 20

Tag Based Configuration

Resources can use a special tag to override the default configuration on a per-resource basis. Note that the name of the tag is configurable via the tag option in the policy; the examples below use the default tag name, maid_offhours.

The value of the tag must be one of the following:

• (empty) or on - An empty tag value or a value of “on” implies night and weekend offhours using the default time zone configured in the policy (tz=est if unspecified) and the default onhour and offhour values configured in the policy.

• off - If offhours is configured to run in opt-out mode, this tag can be specified to disable offhours on a given instance. If offhours is configured to run in opt-in mode, this tag will have no effect (the resource will still be opted out).

• a semicolon-separated string composed of one or more of the following components, which override the defaults specified in the policy:

  • tz=<timezone> to evaluate with a resource-specific timezone, where <timezone> is either one of the supported timezone aliases defined in c7n.filters.offhours.Time.TZ_ALIASES (such as pt) or the name of a geographic timezone identifier in [IANA’s tzinfo database](https://www.iana.org/time-zones), such as Americas/Los_Angeles. (Note all timezone aliases are referenced to a locality to ensure taking into account local daylight savings time, if applicable.)

  • off=(time spec) and/or on=(time spec) matching time specifications supported by c7n.filters.offhours.ScheduleParser as described in the next section.

ScheduleParser Time Specifications

Each time specification follows the format (days,hours). Multiple time specifications can be combined in square-bracketed lists, i.e. [(days,hours),(days,hours),(days,hours)].

Examples:

# up mon-fri from 7am-7pm; eastern time
off=(M-F,19);on=(M-F,7)
# up mon-fri from 6am-9pm; up sun from 10am-6pm; pacific time
off=[(M-F,21),(U,18)];on=[(M-F,6),(U,10)];tz=pt

Possible values:

field	values
days	M, T, W, H, F, S, U
hours	0, 1, 2, …, 22, 23

Days can be specified in a range (ex. M-F).

Policy examples

Turn ec2 instances on and off

policies:
  - name: offhours-stop
    resource: ec2
    filters:
       - type: offhour
    actions:
      - stop

  - name: offhours-start
    resource: ec2
    filters:
      - type: onhour
    actions:
      - start

Here’s doing the same with auto scale groups

policies:
  - name: asg-offhours-stop
    resource: asg
    filters:
       - offhour
    actions:
       - suspend
  - name: asg-onhours-start
    resource: asg
    filters:
       - onhour
    actions:
       - resume

Additional policy examples and resource-type-specific information can be seen in the EC2 Offhours and ASG Offhours use cases.

Resume During Offhours

These policies are evaluated hourly; during each run (once an hour), cloud-custodian will act on only the resources tagged for that exact hour. In other words, if a resource has an offhours policy of stopping/suspending at 23:00 Eastern daily and starting/resuming at 06:00 Eastern daily, and you run cloud-custodian once an hour via Lambda, that resource will only be stopped once a day sometime between 23:00 and 23:59, and will only be started once a day sometime between 06:00 and 06:59. If the current hour does not exactly match the hour specified in the policy, nothing will be done at all.

As a result of this, if custodian stops an instance or suspends an ASG and you need to start/resume it, you can safely do so manually and custodian won’t touch it again until the next day.

ElasticBeanstalk, EFS and Other Services with Tag Value Restrictions

A number of AWS services have restrictions on the characters that can be used in tag values, such as ElasticBeanstalk and EFS. In particular, these services do not allow parenthesis, square brackets, commas, or semicolons, or empty tag values. This proves to be problematic with the tag-based schedule configuration described above. The best current workaround is to define a separate policy with a unique tag name for each unique schedule that you want to use, and then tag resources with that tag name and a value of on. Note that this can only be used in opt-in mode, not opt-out.

Public Holidays

In order to properly implement support for public holidays, make sure to include either skip-days or skip-days-from with your policy. This list should contain all of the public holidays you wish to address and must use YYYY-MM-DD syntax for its dates. If the date the policy is being run on matches any one of those dates, the policy will not return any resources. These dates include year as many holidays vary from year to year so year is required to prevent errors. A sample policy that would not start stopped instances on a public holiday might look like:

policies:
    - name: onhour-morning-start-skip-holidays
      resource: ec2
      filters:
        - type: onhour
          tag: custodian_downtime
          default_tz: et
          onhour: 6
          skip-days: ['2017-12-25']
      actions:
        - start

class c7n.filters.offhours.OffHour(data, manager=None)

Bases: c7n.filters.offhours.Time

DEFAULT_HR = 19

get_default_schedule()

schema = {'additionalProperties': False, 'properties': {'default_tz': {'type': 'string'}, 'offhour': {'maximum': 23, 'minimum': 0, 'type': 'integer'}, 'opt-out': {'type': 'boolean'}, 'skip-days': {'items': {'pattern': '^[0-9]{4}-[0-9]{2}-[0-9]{2}', 'type': 'string'}, 'type': 'array'}, 'skip-days-from': {'additionalProperties': 'False', 'properties': {'expr': {'oneOf': [{'type': 'integer'}, {'type': 'string'}]}, 'format': {'enum': ['csv', 'json', 'txt', 'csv2dict']}, 'url': {'type': 'string'}}, 'required': ['url'], 'type': 'object'}, 'tag': {'type': 'string'}, 'type': {'enum': ['offhour']}, 'weekends': {'type': 'boolean'}, 'weekends-only': {'type': 'boolean'}}, 'required': ['offhour', 'default_tz', 'type'], 'type': 'object'}

time_type = 'off'

class c7n.filters.offhours.OnHour(data, manager=None)

Bases: c7n.filters.offhours.Time

DEFAULT_HR = 7

get_default_schedule()

schema = {'additionalProperties': False, 'properties': {'default_tz': {'type': 'string'}, 'onhour': {'maximum': 23, 'minimum': 0, 'type': 'integer'}, 'opt-out': {'type': 'boolean'}, 'skip-days': {'items': {'pattern': '^[0-9]{4}-[0-9]{2}-[0-9]{2}', 'type': 'string'}, 'type': 'array'}, 'skip-days-from': {'additionalProperties': 'False', 'properties': {'expr': {'oneOf': [{'type': 'integer'}, {'type': 'string'}]}, 'format': {'enum': ['csv', 'json', 'txt', 'csv2dict']}, 'url': {'type': 'string'}}, 'required': ['url'], 'type': 'object'}, 'tag': {'type': 'string'}, 'type': {'enum': ['onhour']}, 'weekends': {'type': 'boolean'}, 'weekends-only': {'type': 'boolean'}}, 'required': ['onhour', 'default_tz', 'type'], 'type': 'object'}

time_type = 'on'

class c7n.filters.offhours.ScheduleParser(default_schedule)

Bases: object

Parses tag values for custom on/off hours schedules.

At the minimum the on and off values are required. Each of these must be seperated by a ; in the format described below.

Schedule format:

# up mon-fri from 7am-7pm; eastern time
off=(M-F,19);on=(M-F,7)
# up mon-fri from 6am-9pm; up sun from 10am-6pm; pacific time
off=[(M-F,21),(U,18)];on=[(M-F,6),(U,10)];tz=pt

Possible values:

field	values
days	M, T, W, H, F, S, U
hours	0, 1, 2, …, 22, 23

Days can be specified in a range (ex. M-F).

If the timezone is not supplied, it is assumed ET (eastern time), but this default can be configurable.

Parser output:

The schedule parser will return a dict or None (if the schedule is invalid):

# off=[(M-F,21),(U,18)];on=[(M-F,6),(U,10)];tz=pt
{
  off: [
    { days: "M-F", hour: 21 },
    { days: "U", hour: 18 }
  ],
  on: [
    { days: "M-F", hour: 6 },
    { days: "U", hour: 10 }
  ],
  tz: "pt"
}

DAY_MAP = {'f': 4, 'h': 3, 'm': 0, 's': 5, 't': 1, 'u': 6, 'w': 2}

VALID_HOURS = (0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23)

expand_day_range(days)

static has_resource_schedule(tag_value, time_type)

keys_are_valid(tag_value)

test that provided tag keys are valid

parse(tag_value)

parse_resource_schedule(lexeme)

static raw_data(tag_value)

convert the tag to a dictionary, taking values as is

This method name and purpose are opaque… and not true.

class c7n.filters.offhours.Time(data, manager=None)

Bases: c7n.filters.core.Filter

DEFAULT_TAG = 'maid_offhours'

DEFAULT_TZ = 'et'

TZ_ALIASES = {'aet': 'Australia/Sydney', 'africa/dar_es_salaam': 'Africa/Dar_es_Salaam', 'america/argentina/comodrivadavia': 'America/Argentina/ComodRivadavia', 'america/knox_in': 'America/Knox_IN', 'america/port-au-prince': 'America/Port-au-Prince', 'america/port_of_spain': 'America/Port_of_Spain', 'antarctica/dumontdurville': 'Antarctica/DumontDUrville', 'antarctica/mcmurdo': 'Antarctica/McMurdo', 'ast': 'America/Phoenix', 'at': 'America/Phoenix', 'australia/act': 'Australia/ACT', 'australia/lhi': 'Australia/LHI', 'australia/nsw': 'Australia/NSW', 'brazil/denoronha': 'Brazil/DeNoronha', 'brt': 'America/Sao_Paulo', 'bst': 'Europe/London', 'cdt': 'America/Chicago', 'cet': 'Europe/Berlin', 'chile/easterisland': 'Chile/EasterIsland', 'cst': 'America/Chicago', 'cst6cdt': 'CST6CDT', 'ct': 'America/Chicago', 'edt': 'America/New_York', 'eet': 'EET', 'est': 'America/New_York', 'est5edt': 'EST5EDT', 'et': 'America/New_York', 'etc/gmt': 'Etc/GMT', 'etc/gmt+0': 'Etc/GMT+0', 'etc/gmt+1': 'Etc/GMT+1', 'etc/gmt+10': 'Etc/GMT+10', 'etc/gmt+11': 'Etc/GMT+11', 'etc/gmt+12': 'Etc/GMT+12', 'etc/gmt+2': 'Etc/GMT+2', 'etc/gmt+3': 'Etc/GMT+3', 'etc/gmt+4': 'Etc/GMT+4', 'etc/gmt+5': 'Etc/GMT+5', 'etc/gmt+6': 'Etc/GMT+6', 'etc/gmt+7': 'Etc/GMT+7', 'etc/gmt+8': 'Etc/GMT+8', 'etc/gmt+9': 'Etc/GMT+9', 'etc/gmt-0': 'Etc/GMT-0', 'etc/gmt-1': 'Etc/GMT-1', 'etc/gmt-10': 'Etc/GMT-10', 'etc/gmt-11': 'Etc/GMT-11', 'etc/gmt-12': 'Etc/GMT-12', 'etc/gmt-13': 'Etc/GMT-13', 'etc/gmt-14': 'Etc/GMT-14', 'etc/gmt-2': 'Etc/GMT-2', 'etc/gmt-3': 'Etc/GMT-3', 'etc/gmt-4': 'Etc/GMT-4', 'etc/gmt-5': 'Etc/GMT-5', 'etc/gmt-6': 'Etc/GMT-6', 'etc/gmt-7': 'Etc/GMT-7', 'etc/gmt-8': 'Etc/GMT-8', 'etc/gmt-9': 'Etc/GMT-9', 'etc/gmt0': 'Etc/GMT0', 'etc/uct': 'Etc/UCT', 'etc/utc': 'Etc/UTC', 'europe/isle_of_man': 'Europe/Isle_of_Man', 'gb': 'GB', 'gb-eire': 'GB-Eire', 'gmt': 'Etc/GMT', 'gmt+0': 'GMT+0', 'gmt-0': 'GMT-0', 'gmt0': 'GMT0', 'gt': 'Etc/GMT', 'hst': 'HST', 'ist': 'Europe/Dublin', 'it': 'Asia/Kolkata', 'jst': 'Asia/Tokyo', 'kst': 'Asia/Seoul', 'mdt': 'America/Denver', 'met': 'MET', 'mexico/bajanorte': 'Mexico/BajaNorte', 'mexico/bajasur': 'Mexico/BajaSur', 'mst': 'America/Denver', 'mst7mdt': 'MST7MDT', 'mt': 'America/Denver', 'nz': 'NZ', 'nz-chat': 'NZ-CHAT', 'nzst': 'Pacific/Auckland', 'pdt': 'America/Los_Angeles', 'prc': 'PRC', 'pst': 'America/Los_Angeles', 'pst8pdt': 'PST8PDT', 'pt': 'America/Los_Angeles', 'roc': 'ROC', 'rok': 'ROK', 'sgt': 'Asia/Singapore', 'uct': 'UCT', 'us/alaska': 'US/Alaska', 'us/aleutian': 'US/Aleutian', 'us/arizona': 'US/Arizona', 'us/central': 'US/Central', 'us/east-indiana': 'US/East-Indiana', 'us/eastern': 'US/Eastern', 'us/hawaii': 'US/Hawaii', 'us/indiana-starke': 'US/Indiana-Starke', 'us/michigan': 'US/Michigan', 'us/mountain': 'US/Mountain', 'us/pacific': 'US/Pacific', 'us/pacific-new': 'US/Pacific-New', 'us/samoa': 'US/Samoa', 'utc': 'Etc/UTC', 'w-su': 'W-SU', 'wet': 'WET'}

get_default_schedule()

get_tag_value(i)

Get the resource’s tag value specifying its schedule.

classmethod get_tz(tz)

match(now, schedule)

non_title_case_zones = {'africa/dar_es_salaam': 'Africa/Dar_es_Salaam', 'america/argentina/comodrivadavia': 'America/Argentina/ComodRivadavia', 'america/knox_in': 'America/Knox_IN', 'america/port-au-prince': 'America/Port-au-Prince', 'america/port_of_spain': 'America/Port_of_Spain', 'antarctica/dumontdurville': 'Antarctica/DumontDUrville', 'antarctica/mcmurdo': 'Antarctica/McMurdo', 'australia/act': 'Australia/ACT', 'australia/lhi': 'Australia/LHI', 'australia/nsw': 'Australia/NSW', 'brazil/denoronha': 'Brazil/DeNoronha', 'chile/easterisland': 'Chile/EasterIsland', 'cst6cdt': 'CST6CDT', 'eet': 'EET', 'est5edt': 'EST5EDT', 'etc/gmt': 'Etc/GMT', 'etc/gmt+0': 'Etc/GMT+0', 'etc/gmt+1': 'Etc/GMT+1', 'etc/gmt+10': 'Etc/GMT+10', 'etc/gmt+11': 'Etc/GMT+11', 'etc/gmt+12': 'Etc/GMT+12', 'etc/gmt+2': 'Etc/GMT+2', 'etc/gmt+3': 'Etc/GMT+3', 'etc/gmt+4': 'Etc/GMT+4', 'etc/gmt+5': 'Etc/GMT+5', 'etc/gmt+6': 'Etc/GMT+6', 'etc/gmt+7': 'Etc/GMT+7', 'etc/gmt+8': 'Etc/GMT+8', 'etc/gmt+9': 'Etc/GMT+9', 'etc/gmt-0': 'Etc/GMT-0', 'etc/gmt-1': 'Etc/GMT-1', 'etc/gmt-10': 'Etc/GMT-10', 'etc/gmt-11': 'Etc/GMT-11', 'etc/gmt-12': 'Etc/GMT-12', 'etc/gmt-13': 'Etc/GMT-13', 'etc/gmt-14': 'Etc/GMT-14', 'etc/gmt-2': 'Etc/GMT-2', 'etc/gmt-3': 'Etc/GMT-3', 'etc/gmt-4': 'Etc/GMT-4', 'etc/gmt-5': 'Etc/GMT-5', 'etc/gmt-6': 'Etc/GMT-6', 'etc/gmt-7': 'Etc/GMT-7', 'etc/gmt-8': 'Etc/GMT-8', 'etc/gmt-9': 'Etc/GMT-9', 'etc/gmt0': 'Etc/GMT0', 'etc/uct': 'Etc/UCT', 'etc/utc': 'Etc/UTC', 'europe/isle_of_man': 'Europe/Isle_of_Man', 'gb': 'GB', 'gb-eire': 'GB-Eire', 'gmt+0': 'GMT+0', 'gmt-0': 'GMT-0', 'gmt0': 'GMT0', 'hst': 'HST', 'met': 'MET', 'mexico/bajanorte': 'Mexico/BajaNorte', 'mexico/bajasur': 'Mexico/BajaSur', 'mst7mdt': 'MST7MDT', 'nz': 'NZ', 'nz-chat': 'NZ-CHAT', 'prc': 'PRC', 'pst8pdt': 'PST8PDT', 'roc': 'ROC', 'rok': 'ROK', 'uct': 'UCT', 'us/alaska': 'US/Alaska', 'us/aleutian': 'US/Aleutian', 'us/arizona': 'US/Arizona', 'us/central': 'US/Central', 'us/east-indiana': 'US/East-Indiana', 'us/eastern': 'US/Eastern', 'us/hawaii': 'US/Hawaii', 'us/indiana-starke': 'US/Indiana-Starke', 'us/michigan': 'US/Michigan', 'us/mountain': 'US/Mountain', 'us/pacific': 'US/Pacific', 'us/pacific-new': 'US/Pacific-New', 'us/samoa': 'US/Samoa', 'w-su': 'W-SU', 'wet': 'WET'}

process(resources, event=None)

Bulk process resources and return filtered set.

process_resource_schedule(i, value, time_type)

Does the resource tag schedule and policy match the current time.

schema = {'properties': {'default_tz': {'type': 'string'}, 'opt-out': {'type': 'boolean'}, 'skip-days': {'items': {'pattern': '^[0-9]{4}-[0-9]{2}-[0-9]{2}', 'type': 'string'}, 'type': 'array'}, 'skip-days-from': {'additionalProperties': 'False', 'properties': {'expr': {'oneOf': [{'type': 'integer'}, {'type': 'string'}]}, 'format': {'enum': ['csv', 'json', 'txt', 'csv2dict']}, 'url': {'type': 'string'}}, 'required': ['url'], 'type': 'object'}, 'tag': {'type': 'string'}, 'weekends': {'type': 'boolean'}, 'weekends-only': {'type': 'boolean'}}, 'type': 'object'}

time_type = None

validate()

validate filter config, return validation error or self

z_names = ['Zulu', 'W-SU', 'UCT', 'Turkey', 'Singapore', 'ROK', 'ROC', 'Portugal', 'Poland', 'PRC', 'Navajo', 'NZ-CHAT', 'NZ', 'Mexico/BajaNorte', 'Mexico/BajaSur', 'Mexico/General', 'Libya', 'Kwajalein', 'Japan', 'Jamaica', 'Israel', 'Iran', 'Iceland', 'Hongkong', 'Greenwich', 'GB-Eire', 'Eire', 'Egypt', 'Cuba', 'Chile/Continental', 'Chile/EasterIsland', 'Canada/Atlantic', 'Canada/Central', 'Canada/Eastern', 'Canada/Mountain', 'Canada/Newfoundland', 'Canada/Pacific', 'Canada/Saskatchewan', 'Canada/Yukon', 'Brazil/Acre', 'Brazil/DeNoronha', 'Brazil/East', 'Brazil/West', 'US/Alaska', 'US/Aleutian', 'US/Arizona', 'US/Central', 'US/East-Indiana', 'US/Eastern', 'US/Hawaii', 'US/Indiana-Starke', 'US/Michigan', 'US/Pacific', 'US/Samoa', 'Arctic/Longyearbyen', 'Factory', 'Etc/GMT+1', 'Etc/GMT+10', 'Etc/GMT+11', 'Etc/GMT+12', 'Etc/GMT+2', 'Etc/GMT+3', 'Etc/GMT+4', 'Etc/GMT+5', 'Etc/GMT+6', 'Etc/GMT+7', 'Etc/GMT+8', 'Etc/GMT+9', 'Etc/GMT-1', 'Etc/GMT-10', 'Etc/GMT-11', 'Etc/GMT-12', 'Etc/GMT-13', 'Etc/GMT-14', 'Etc/GMT-2', 'Etc/GMT-3', 'Etc/GMT-4', 'Etc/GMT-5', 'Etc/GMT-6', 'Etc/GMT-7', 'Etc/GMT-8', 'Etc/GMT-9', 'PST8PDT', 'MST7MDT', 'CST6CDT', 'EST5EDT', 'HST', 'MST', 'EST', 'America/Anguilla', 'America/Araguaina', 'America/Argentina/Buenos_Aires', 'America/Argentina/Catamarca', 'America/Argentina/Cordoba', 'America/Argentina/Jujuy', 'America/Argentina/La_Rioja', 'America/Argentina/Mendoza', 'America/Argentina/Rio_Gallegos', 'America/Argentina/Salta', 'America/Argentina/San_Juan', 'America/Argentina/San_Luis', 'America/Argentina/Tucuman', 'America/Argentina/Ushuaia', 'America/Aruba', 'America/Asuncion', 'America/Atikokan', 'America/Bahia', 'America/Bahia_Banderas', 'America/Barbados', 'America/Belem', 'America/Belize', 'America/Blanc-Sablon', 'America/Boa_Vista', 'America/Bogota', 'America/Boise', 'America/Cambridge_Bay', 'America/Campo_Grande', 'America/Cancun', 'America/Caracas', 'America/Cayenne', 'America/Cayman', 'America/Chihuahua', 'America/Costa_Rica', 'America/Creston', 'America/Cuiaba', 'America/Danmarkshavn', 'America/Dawson', 'America/Dawson_Creek', 'America/Eirunepe', 'America/El_Salvador', 'America/Fort_Nelson', 'America/Fortaleza', 'America/Glace_Bay', 'America/Godthab', 'America/Goose_Bay', 'America/Grand_Turk', 'America/Guatemala', 'America/Guayaquil', 'America/Guyana', 'America/Hermosillo', 'America/Indiana/Marengo', 'America/Indiana/Petersburg', 'America/Indiana/Tell_City', 'America/Indiana/Vevay', 'America/Indiana/Vincennes', 'America/Indiana/Winamac', 'America/Inuvik', 'America/Iqaluit', 'America/Juneau', 'America/Kentucky/Louisville', 'America/Kentucky/Monticello', 'America/La_Paz', 'America/Lima', 'America/Maceio', 'America/Managua', 'America/Martinique', 'America/Matamoros', 'America/Menominee', 'America/Merida', 'America/Metlakatla', 'America/Miquelon', 'America/Moncton', 'America/Monterrey', 'America/Montevideo', 'America/Nassau', 'America/Nipigon', 'America/Nome', 'America/North_Dakota/Beulah', 'America/North_Dakota/Center', 'America/North_Dakota/New_Salem', 'America/Ojinaga', 'America/Pangnirtung', 'America/Paramaribo', 'America/Port-au-Prince', 'America/Porto_Velho', 'America/Puerto_Rico', 'America/Punta_Arenas', 'America/Rainy_River', 'America/Rankin_Inlet', 'America/Recife', 'America/Resolute', 'America/Santarem', 'America/Santo_Domingo', 'America/Scoresbysund', 'America/Sitka', 'America/Swift_Current', 'America/Tegucigalpa', 'America/Thule', 'America/Thunder_Bay', 'America/Yakutat', 'America/Yellowknife', 'EET', 'MET', 'CET', 'WET', 'Europe/Amsterdam', 'Europe/Andorra', 'Europe/Astrakhan', 'Europe/Athens', 'Europe/Belgrade', 'Europe/Berlin', 'Europe/Bratislava', 'Europe/Brussels', 'Europe/Bucharest', 'Europe/Budapest', 'Europe/Busingen', 'Europe/Chisinau', 'Europe/Copenhagen', 'Europe/Gibraltar', 'Europe/Helsinki', 'Europe/Kaliningrad', 'Europe/Kiev', 'Europe/Kirov', 'Europe/Luxembourg', 'Europe/Madrid', 'Europe/Malta', 'Europe/Minsk', 'Europe/Monaco', 'Europe/Nicosia', 'Europe/Paris', 'Europe/Riga', 'Europe/Rome', 'Europe/Samara', 'Europe/Saratov', 'Europe/Simferopol', 'Europe/Sofia', 'Europe/Stockholm', 'Europe/Tallinn', 'Europe/Tirane', 'Europe/Ulyanovsk', 'Europe/Uzhgorod', 'Europe/Vienna', 'Europe/Vilnius', 'Europe/Volgograd', 'Europe/Zaporozhye', 'Pacific/Apia', 'Pacific/Bougainville', 'Pacific/Chuuk', 'Pacific/Efate', 'Pacific/Enderbury', 'Pacific/Fakaofo', 'Pacific/Fiji', 'Pacific/Funafuti', 'Pacific/Galapagos', 'Pacific/Gambier', 'Pacific/Guadalcanal', 'Pacific/Guam', 'Pacific/Kiritimati', 'Pacific/Kosrae', 'Pacific/Majuro', 'Pacific/Marquesas', 'Pacific/Nauru', 'Pacific/Niue', 'Pacific/Norfolk', 'Pacific/Noumea', 'Pacific/Palau', 'Pacific/Pitcairn', 'Pacific/Pohnpei', 'Pacific/Port_Moresby', 'Pacific/Rarotonga', 'Pacific/Tahiti', 'Pacific/Tarawa', 'Pacific/Tongatapu', 'Pacific/Wake', 'Pacific/Wallis', 'Australia/ACT', 'Australia/Adelaide', 'Australia/Brisbane', 'Australia/Broken_Hill', 'Australia/Currie', 'Australia/Darwin', 'Australia/Eucla', 'Australia/Hobart', 'Australia/LHI', 'Australia/Lindeman', 'Australia/Melbourne', 'Australia/Perth', 'Asia/Aden', 'Asia/Almaty', 'Asia/Amman', 'Asia/Anadyr', 'Asia/Aqtau', 'Asia/Aqtobe', 'Asia/Ashgabat', 'Asia/Atyrau', 'Asia/Baghdad', 'Asia/Bahrain', 'Asia/Baku', 'Asia/Bangkok', 'Asia/Barnaul', 'Asia/Beirut', 'Asia/Bishkek', 'Asia/Brunei', 'Asia/Calcutta', 'Asia/Chita', 'Asia/Choibalsan', 'Asia/Colombo', 'Asia/Dacca', 'Asia/Damascus', 'Asia/Dili', 'Asia/Dubai', 'Asia/Dushanbe', 'Asia/Famagusta', 'Asia/Gaza', 'Asia/Hanoi', 'Asia/Hebron', 'Asia/Ho_Chi_Minh', 'Asia/Hovd', 'Asia/Irkutsk', 'Asia/Jakarta', 'Asia/Jayapura', 'Asia/Kabul', 'Asia/Kamchatka', 'Asia/Karachi', 'Asia/Kashgar', 'Asia/Kathmandu', 'Asia/Khandyga', 'Asia/Krasnoyarsk', 'Asia/Kuala_Lumpur', 'Asia/Kuching', 'Asia/Macao', 'Asia/Magadan', 'Asia/Makassar', 'Asia/Manila', 'Asia/Novokuznetsk', 'Asia/Novosibirsk', 'Asia/Omsk', 'Asia/Oral', 'Asia/Pontianak', 'Asia/Pyongyang', 'Asia/Qostanay', 'Asia/Qyzylorda', 'Asia/Rangoon', 'Asia/Sakhalin', 'Asia/Samarkand', 'Asia/Srednekolymsk', 'Asia/Tashkent', 'Asia/Tbilisi', 'Asia/Thimbu', 'Asia/Tomsk', 'Asia/Ulaanbaatar', 'Asia/Ust-Nera', 'Asia/Vladivostok', 'Asia/Yakutsk', 'Asia/Yekaterinburg', 'Asia/Yerevan', 'Antarctica/Casey', 'Antarctica/Davis', 'Antarctica/DumontDUrville', 'Antarctica/Macquarie', 'Antarctica/Mawson', 'Antarctica/Palmer', 'Antarctica/Rothera', 'Antarctica/Syowa', 'Antarctica/Troll', 'Antarctica/Vostok', 'Indian/Antananarivo', 'Indian/Chagos', 'Indian/Christmas', 'Indian/Cocos', 'Indian/Kerguelen', 'Indian/Mahe', 'Indian/Maldives', 'Indian/Mauritius', 'Indian/Reunion', 'Atlantic/Azores', 'Atlantic/Bermuda', 'Atlantic/Canary', 'Atlantic/Cape_Verde', 'Atlantic/Faeroe', 'Atlantic/Madeira', 'Atlantic/South_Georgia', 'Atlantic/St_Helena', 'Atlantic/Stanley', 'Africa/Accra', 'Africa/Algiers', 'Africa/Bangui', 'Africa/Bissau', 'Africa/Blantyre', 'Africa/Casablanca', 'Africa/Ceuta', 'Africa/El_Aaiun', 'Africa/Johannesburg', 'Africa/Juba', 'Africa/Khartoum', 'Africa/Monrovia', 'Africa/Ndjamena', 'Africa/Sao_Tome', 'Africa/Tunis', 'Africa/Windhoek', 'Universal', 'UTC', 'GMT0', 'GMT-0', 'GMT+0', 'GB', 'GMT', 'US/Mountain', 'US/Pacific-New', 'Etc/GMT', 'Etc/GMT+0', 'Etc/GMT-0', 'Etc/GMT0', 'Etc/Greenwich', 'Etc/UCT', 'Etc/UTC', 'Etc/Universal', 'Etc/Zulu', 'America/Adak', 'America/Anchorage', 'America/Antigua', 'America/Argentina/ComodRivadavia', 'America/Atka', 'America/Buenos_Aires', 'America/Catamarca', 'America/Chicago', 'America/Coral_Harbour', 'America/Cordoba', 'America/Curacao', 'America/Denver', 'America/Detroit', 'America/Dominica', 'America/Edmonton', 'America/Ensenada', 'America/Fort_Wayne', 'America/Grenada', 'America/Guadeloupe', 'America/Halifax', 'America/Havana', 'America/Indiana/Indianapolis', 'America/Indiana/Knox', 'America/Indianapolis', 'America/Jamaica', 'America/Jujuy', 'America/Knox_IN', 'America/Kralendijk', 'America/Los_Angeles', 'America/Louisville', 'America/Lower_Princes', 'America/Manaus', 'America/Marigot', 'America/Mazatlan', 'America/Mendoza', 'America/Mexico_City', 'America/Montreal', 'America/Montserrat', 'America/New_York', 'America/Noronha', 'America/Panama', 'America/Phoenix', 'America/Port_of_Spain', 'America/Porto_Acre', 'America/Regina', 'America/Rio_Branco', 'America/Rosario', 'America/Santa_Isabel', 'America/Santiago', 'America/Sao_Paulo', 'America/Shiprock', 'America/St_Barthelemy', 'America/St_Johns', 'America/St_Kitts', 'America/St_Lucia', 'America/St_Thomas', 'America/St_Vincent', 'America/Tijuana', 'America/Toronto', 'America/Tortola', 'America/Vancouver', 'America/Virgin', 'America/Whitehorse', 'America/Winnipeg', 'Europe/Belfast', 'Europe/Dublin', 'Europe/Guernsey', 'Europe/Isle_of_Man', 'Europe/Istanbul', 'Europe/Jersey', 'Europe/Lisbon', 'Europe/Ljubljana', 'Europe/London', 'Europe/Mariehamn', 'Europe/Moscow', 'Europe/Oslo', 'Europe/Podgorica', 'Europe/Prague', 'Europe/San_Marino', 'Europe/Sarajevo', 'Europe/Skopje', 'Europe/Tiraspol', 'Europe/Vaduz', 'Europe/Vatican', 'Europe/Warsaw', 'Europe/Zagreb', 'Europe/Zurich', 'Pacific/Auckland', 'Pacific/Chatham', 'Pacific/Easter', 'Pacific/Honolulu', 'Pacific/Johnston', 'Pacific/Kwajalein', 'Pacific/Midway', 'Pacific/Pago_Pago', 'Pacific/Ponape', 'Pacific/Saipan', 'Pacific/Samoa', 'Pacific/Truk', 'Pacific/Yap', 'Australia/Canberra', 'Australia/Lord_Howe', 'Australia/NSW', 'Australia/North', 'Australia/Queensland', 'Australia/South', 'Australia/Sydney', 'Australia/Tasmania', 'Australia/Victoria', 'Australia/West', 'Australia/Yancowinna', 'Asia/Ashkhabad', 'Asia/Chongqing', 'Asia/Chungking', 'Asia/Dhaka', 'Asia/Harbin', 'Asia/Hong_Kong', 'Asia/Istanbul', 'Asia/Jerusalem', 'Asia/Katmandu', 'Asia/Kolkata', 'Asia/Kuwait', 'Asia/Macau', 'Asia/Muscat', 'Asia/Nicosia', 'Asia/Phnom_Penh', 'Asia/Qatar', 'Asia/Riyadh', 'Asia/Saigon', 'Asia/Seoul', 'Asia/Shanghai', 'Asia/Singapore', 'Asia/Taipei', 'Asia/Tehran', 'Asia/Tel_Aviv', 'Asia/Thimphu', 'Asia/Tokyo', 'Asia/Ujung_Pandang', 'Asia/Ulan_Bator', 'Asia/Urumqi', 'Asia/Vientiane', 'Asia/Yangon', 'Antarctica/McMurdo', 'Antarctica/South_Pole', 'Indian/Comoro', 'Indian/Mayotte', 'Atlantic/Faroe', 'Atlantic/Jan_Mayen', 'Atlantic/Reykjavik', 'Africa/Abidjan', 'Africa/Addis_Ababa', 'Africa/Asmara', 'Africa/Asmera', 'Africa/Bamako', 'Africa/Banjul', 'Africa/Brazzaville', 'Africa/Bujumbura', 'Africa/Cairo', 'Africa/Conakry', 'Africa/Dakar', 'Africa/Dar_es_Salaam', 'Africa/Djibouti', 'Africa/Douala', 'Africa/Freetown', 'Africa/Gaborone', 'Africa/Harare', 'Africa/Kampala', 'Africa/Kigali', 'Africa/Kinshasa', 'Africa/Lagos', 'Africa/Libreville', 'Africa/Lome', 'Africa/Luanda', 'Africa/Lubumbashi', 'Africa/Lusaka', 'Africa/Malabo', 'Africa/Maputo', 'Africa/Maseru', 'Africa/Mbabane', 'Africa/Mogadishu', 'Africa/Nairobi', 'Africa/Niamey', 'Africa/Nouakchott', 'Africa/Ouagadougou', 'Africa/Porto-Novo', 'Africa/Timbuktu', 'Africa/Tripoli']

c7n.filters.offhours.brackets_removed(u)

c7n.filters.offhours.parens_removed(u)

c7n.filters.related module

class c7n.filters.related.RelatedResourceFilter(data, manager=None)

Bases: c7n.filters.core.ValueFilter

AnnotationKey = None

FetchThreshold = 10

RelatedIdsExpression = None

RelatedResource = None

get_permissions()

get_related(resources)

get_related_ids(resources)

get_resource_manager()

process(resources, event=None)

Bulk process resources and return filtered set.

process_resource(resource, related)

validate()

validate filter config, return validation error or self

c7n.filters.revisions module

Custodian support for diffing and patching across multiple versions of a resource.

class c7n.filters.revisions.Diff(data, manager=None)

Bases: c7n.filters.core.Filter

Compute the diff from the current resource to a previous version.

A resource matches the filter if a diff exists between the current resource and the selected revision.

Utilizes config as a resource revision database.

Revisions can be selected by date, against the previous version, and against a locked version (requires use of is-locked filter).

diff(source, target)

get_revisions(config, resource)

get_selector_params(resource)

mode = None

parser = None

permissions = ('config:GetResourceConfigHistory',)

process(resources, event=None)

Bulk process resources and return filtered set.

resource_shape = None

schema = {'additionalProperties': False, 'properties': {'selector': {'enum': ['previous', 'date', 'locked']}, 'selector_value': {'type': 'string'}, 'type': {'enum': ['diff']}}, 'required': ['type'], 'type': 'object'}

select_revision(revisions)

selector_value = None

transform_revision(revision)

make config revision look like describe output.

validate()

validate filter config, return validation error or self

class c7n.filters.revisions.JsonDiff(data, manager=None)

Bases: c7n.filters.revisions.Diff

diff(source, target)

classmethod register_resources(registry, resource_class)

meta model subscriber on resource registration.

We watch for new resource types being registered and if they support aws config, automatically register the jsondiff filter.

sanitize_revision(rev)

schema = {'additionalProperties': False, 'properties': {'selector': {'enum': ['previous', 'date', 'locked']}, 'selector_value': {'type': 'string'}, 'type': {'enum': ['json-diff']}}, 'required': ['type'], 'type': 'object'}

c7n.filters.securityhub module

class c7n.filters.securityhub.SecurityHubFindingFilter(data, manager=None)

Bases: c7n.filters.core.Filter

Check if there are Security Hub Findings related to the resources

annotation_key = 'c7n:finding-filter'

permissions = ('securityhub:GetFindings',)

process(resources, event=None)

Bulk process resources and return filtered set.

query_shape = 'AwsSecurityFindingFilters'

classmethod register_resources(registry, resource_class)

meta model subscriber on resource registration.

SecurityHub Findings Filter

schema = {'additionalProperties': False, 'properties': {'query': {'type': 'object'}, 'region': {'type': 'string'}, 'type': {'enum': ['finding']}}, 'required': ['type'], 'type': 'object'}

schema_alias = True

validate()

validate filter config, return validation error or self

c7n.filters.vpc module

class c7n.filters.vpc.DefaultVpcBase(data, manager=None)

Bases: c7n.filters.core.Filter

Filter to resources in a default vpc.

default_vpc = None

match(vpc_id)

permissions = ('ec2:DescribeVpcs',)

vpcs = None

class c7n.filters.vpc.MatchResourceValidator

Bases: object

validate()

class c7n.filters.vpc.NetworkLocation(data, manager=None)

Bases: c7n.filters.core.Filter

On a network attached resource, determine intersection of security-group attributes, subnet attributes, and resource attributes.

The use case is a bit specialized, for most use cases using subnet and security-group filters suffice. but say for example you wanted to verify that an ec2 instance was only using subnets and security groups with a given tag value, and that tag was not present on the resource.

Example

policies:
  - name: ec2-mismatched-sg-remove
    resource: ec2
    filters:
      - type: network-location
        compare: ["resource","security-group"]
        key: "tag:TEAM_NAME"
        ignore:
          - "tag:TEAM_NAME": Enterprise
    actions:
      - type: modify-security-groups
        remove: network-location
        isolation-group: sg-xxxxxxxx

filter_ignored(resources)

permissions = ('ec2:DescribeSecurityGroups', 'ec2:DescribeSubnets')

process(resources, event=None)

Bulk process resources and return filtered set.

process_resource(r, resource_sgs, resource_subnets, key)

schema = {'additionalProperties': False, 'properties': {'compare': {'default': ['resource', 'subnet', 'security-group'], 'description': 'Which elements of network location should be considered when matching.', 'items': {'enum': ['resource', 'subnet', 'security-group']}, 'type': 'array'}, 'ignore': {'items': {'type': 'object'}, 'type': 'array'}, 'key': {'description': 'The attribute expression that should be matched on', 'type': 'string'}, 'match': {'default': 'non-equal', 'enum': ['equal', 'not-equal'], 'type': 'string'}, 'max-cardinality': {'default': 1, 'title': '', 'type': 'integer'}, 'missing-ok': {'default': False, 'description': 'How to handle missing keys on elements, by default this causesresources to be considered not-equal', 'type': 'boolean'}, 'type': {'enum': ['network-location']}}, 'required': ['key', 'type'], 'type': 'object'}

schema_alias = True

validate()

validate filter config, return validation error or self

class c7n.filters.vpc.SecurityGroupFilter(data, manager=None)

Bases: c7n.filters.vpc.MatchResourceValidator, c7n.filters.related.RelatedResourceFilter

Filter a resource by its associated security groups.

AnnotationKey = 'matched-security-groups'

RelatedResource = 'c7n.resources.vpc.SecurityGroup'

schema = {'additionalProperties': False, 'properties': {'default': {'type': 'object'}, 'key': {'type': 'string'}, 'match-resource': {'type': 'boolean'}, 'op': {'$ref': '#/definitions/filters_common/comparison_operators'}, 'operator': {'enum': ['and', 'or']}, 'type': {'enum': ['security-group']}, 'value': {'$ref': '#/definitions/filters_common/value'}, 'value_from': {'$ref': '#/definitions/filters_common/value_from'}, 'value_type': {'$ref': '#/definitions/filters_common/value_types'}}, 'required': ['type'], 'type': 'object'}

schema_alias = True

class c7n.filters.vpc.SubnetFilter(data, manager=None)

Bases: c7n.filters.vpc.MatchResourceValidator, c7n.filters.related.RelatedResourceFilter

Filter a resource by its associated subnets.

AnnotationKey = 'matched-subnets'

RelatedResource = 'c7n.resources.vpc.Subnet'

schema = {'additionalProperties': False, 'properties': {'default': {'type': 'object'}, 'key': {'type': 'string'}, 'match-resource': {'type': 'boolean'}, 'op': {'$ref': '#/definitions/filters_common/comparison_operators'}, 'operator': {'enum': ['and', 'or']}, 'type': {'enum': ['subnet']}, 'value': {'$ref': '#/definitions/filters_common/value'}, 'value_from': {'$ref': '#/definitions/filters_common/value_from'}, 'value_type': {'$ref': '#/definitions/filters_common/value_types'}}, 'required': ['type'], 'type': 'object'}

schema_alias = True

class c7n.filters.vpc.VpcFilter(data, manager=None)

Bases: c7n.filters.vpc.MatchResourceValidator, c7n.filters.related.RelatedResourceFilter

Filter a resource by its associated vpc.

AnnotationKey = 'matched-vpcs'

RelatedResource = 'c7n.resources.vpc.Vpc'

schema = {'additionalProperties': False, 'properties': {'default': {'type': 'object'}, 'key': {'type': 'string'}, 'match-resource': {'type': 'boolean'}, 'op': {'$ref': '#/definitions/filters_common/comparison_operators'}, 'operator': {'enum': ['and', 'or']}, 'type': {'enum': ['vpc']}, 'value': {'$ref': '#/definitions/filters_common/value'}, 'value_from': {'$ref': '#/definitions/filters_common/value_from'}, 'value_type': {'$ref': '#/definitions/filters_common/value_types'}}, 'required': ['type'], 'type': 'object'}

schema_alias = True

Module contents