Cloud Custodian

No entries match these filters. Clear filters

1. 0.9.53.0 Oct 1, 2026 · issue 092

   Cloud Custodian 0.9.53 adds 23 new AWS/GCP/K8s resource types, a --vars-file CLI flag, and new Azure ML/NSG actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.9.53.0 https://github.com/cloud-custodian/cloud-custodian.git
   # already have the repo? check out this version:
   $ git checkout 0.9.53.0

   └──▷ TRY IT
   Inject environment-specific variables (e.g. account IDs, tag values) into a policy at run time without editing the YAML file.
   copy

   $ custodian run --vars-file vars.json -s out policy.yml

   • Adds --vars-file parameter to custodian run to inject variables into policy expansion at runtime without modifying policy files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds aws.aiops-investigation-group resource type for managing AWS AIOpsAIOpsA practice that applies machine learning and data analytics to IT operations data—logs, metrics, events—so that cyber tools can automate anomaly detection, correlate alerts, and reduce noise at scale. investigation groups.
   • Adds aws.apigwv2-route resource type with authorization type filtering for API Gateway v2 routes.
   • Adds aws.event-connection resource type for EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure. event connections.
   • Adds aws.iot-certificate, aws.iot-ota-update, and aws.iot-policy resource types, expanding IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. coverage.

   +18 more show less

   • Adds aws.qbusiness-application, aws.qbusiness-data-accessor, aws.qbusiness-data-source, aws.qbusiness-index, and aws.qbusiness-plugin resource types for Amazon Q Business.
   • Adds aws.rds-global-cluster resource type for managing RDS global clusters.
   • Adds aws.s3-table and aws.s3-table-bucket resource types for S3 Tables.
   • Adds aws.s3files-access-point, aws.s3files-file-system, and aws.s3files-mount-target resource types for S3 file system resources.
   • Adds aws.ssm-association, aws.ssm-maintenance-window, and aws.ssm-patch-baseline resource types with tagging support.
   • Adds iot-logging filter to aws.account for account-level IoT logging inspection.
   • Adds deployments filter to aws.bedrock-custom-model for filtering by model deployments.
   • Adds consecutive-aws-backups filter to aws.dsql-cluster.
   • Adds auto-tag-user, copy-related-tag, mark-for-op, remove-tag, and tag actions plus marked-for-op filter to aws.ops-item and aws.ssm-managed-instance.
   • Adds gcp.vertex-ai-metadata-store-artifact resource type.
   • Adds gcp.workspace-user resource type for Google Workspace MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. reporting.
   • Adds audit mode support to gcp.dataproc-clusters.
   • Adds k8s.custom-resource resource type for dynamic CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. discovery.
   • Adds archive action to azure.machine-learning-data-container.
   • Adds cancel action to azure.machine-learning-job.
   • Adds remove-rules action to azure.networksecuritygroup.
   • Extends Azure metric filter to support parent-scoped dimensions.
   • Standardizes dynamic tagging support across AWS, Azure, and GCP, including default-value with no key pattern on Azure and GCP.
   • Adds --vars-file parameter to custodian run to inject variables into policy expansion at runtime without modifying policy files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds aws.aiops-investigation-group resource type for managing AWS AIOpsAIOpsA practice that applies machine learning and data analytics to IT operations data—logs, metrics, events—so that cyber tools can automate anomaly detection, correlate alerts, and reduce noise at scale. investigation groups.
   • Adds aws.apigwv2-route resource type with authorization type filtering for API Gateway v2 routes.
   • Adds aws.event-connection resource type for EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure. event connections.
   • Adds aws.iot-certificate, aws.iot-ota-update, and aws.iot-policy resource types, expanding IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. coverage.

   +9 more show less

   • Adds aws.qbusiness-application, aws.qbusiness-data-accessor, aws.qbusiness-data-source, aws.qbusiness-index, and aws.qbusiness-plugin resource types for Amazon Q Business.
   • Adds aws.rds-global-cluster resource type for managing RDS global clusters.
   • Adds aws.s3-table and aws.s3-table-bucket resource types for S3 Tables.
   • Adds aws.s3files-access-point, aws.s3files-file-system, and aws.s3files-mount-target resource types for S3 file system resources.
   • Adds aws.ssm-association, aws.ssm-maintenance-window, and aws.ssm-patch-baseline resource types with tagging support.
   • Adds iot-logging filter to aws.account for account-level IoT logging inspection.
   • Adds gcp.vertex-ai-metadata-store-artifact resource type.
   • Adds gcp.workspace-user resource type for Google Workspace MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. reporting.
   • Adds k8s.custom-resource resource type for dynamic CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. discovery.

   9 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The rename-tag action is removed from aws.cloudwatch-dashboard.
2. 0.9.52.0 Sep 3, 2026 · issue 064

   Cloud Custodian 0.9.52 adds 40+ new AWS/Azure/GCP resources, filters, and actions across Bedrock, WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server., CloudFront, Vertex AI, and more.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.9.52.0 https://github.com/cloud-custodian/cloud-custodian.git
   # already have the repo? check out this version:
   $ git checkout 0.9.52.0

   └──▷ USE IT
   Delete idle VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. endpoints tagged for a specific service to reduce attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. and cut PrivateLinkPrivateLinkAn AWS networking feature that exposes a service over a private endpoint inside a VPC, so traffic never traverses the public internet, giving cyber tools a way to integrate with cloud services without opening public routes. costs.
   policy.yml copy

   policies:
     - name: delete-unused-aoss-vpc-endpoints
       resource: aws.vpc-endpoint
       filters:
         - type: value
           key: ServiceName
           op: contains
           value: "aoss"
       actions:
         - type: delete

   Flag KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. keys that have not been used recently so they can be reviewed and scheduled for deletion.
   policy.yml copy

   policies:
     - name: flag-dormant-kms-keys
       resource: aws.kms-key
       filters:
         - type: last-usage
           value: 90
           op: greater-than
           value_type: age
       actions:
         - type: mark-for-op
           op: disable
           days: 7

   Enable DNSSECDNSSECA set of DNS extensions, maintained by the IETF, that add cryptographic signatures to DNS records so resolvers can verify responses have not been tampered with in transit. on all GCP managed zones that do not yet have it, enforcing DNS integrity at scale.
   policy.yml copy

   policies:
     - name: enforce-dnssec-on-managed-zones
       resource: gcp.dns-managed-zone
       filters:
         - type: value
           key: dnssecConfig.state
           value: "on"
           op: ne
       actions:
         - type: enable-dnssec

   • Adds delete action to aws.vpc-endpoint resources, enabling policy-driven removal of unwanted VPC endpoints.
   • Adds last-usage filter to aws.kms-key resources for identifying dormant keys.
   • Adds termination-policy filter to aws.emr clusters.
   • Adds compute-optimizer filter to aws.ec2 resources for rightsizing recommendations.
   • Adds mark-for-op support to aws.cfn (CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. stack) resources.

   +52 more show less

   • Adds delete action for aws.waf and aws.waf-regional Classic Web ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource..
   • Adds master filter to aws.security-hub resource.
   • Adds payment-cryptography-replication-regions filter on the aws.account resource.
   • Adds cross-account filter to aws.payment-cryptography resources.
   • Adds update-domain-config action to aws.elasticsearch (OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions.) domains.
   • Adds service-details filter to aws.vpc-endpoint for cross-region endpoint inspection.
   • Adds db-parameter filter and new aws.memorydb-parameter-group resource.
   • Adds has-allow-all detection for list-form Action/Resource entries in aws.iam-policy.
   • Adds members filter to aws.cleanrooms collaboration resource.
   • Adds tagging, mark-for-op, and stop actions to aws.bedrock-model-invocation-job and aws.bedrock-inference-profile resources.
   • Adds metrics filter to aws.bedrock-agent resources.
   • Adds synthetic total-tokens metric to aws.bedrock-inference-profile.
   • Adds new aws.bedrock-evaluation-job resource.
   • Adds new aws.bedrock-mantle-project resource.
   • Adds org-unit whitelisting to the cross-account filter across AWS resources.
   • Adds aws.quicksight account subscription and custom permissions filters.
   • Adds new aws.dsql (Aurora DSQL) resource support.
   • Adds new aws.cloudfront-function and aws.cloudfront-keyvalue-store resources.
   • Adds aws.cleanrooms and aws.cleanrooms-ml resources.
   • Adds new aws.sagemaker-studio app, user-profile, and space resources.
   • Adds new aws.vpc-lattice-rule resource.
   • Adds Services and DefaultServiceQuotas to aws.service-quota resource via quota.py.
   • Adds configurable server-side encryption for S3 policy log output.
   • Adds resource lookup support in tag values for aws.tags actions, enabling dynamic tag propagation.
   • Adds SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure. topic resolution directly by ARN in CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. event mode.
   • Adds azure.cognitiveservice-deployment resource with actions.
   • Adds azure.ai-foundry-agent and azure.ai-foundry-application resources.
   • Adds azure.machine-learning-job resource with an archive action.
   • Adds azure.machine-learning-online-endpoint resource.
   • Adds azure.machine-learning-model-version resource.
   • Adds azure.machine-learning-data-container resource.
   • Adds azure.budget resource.
   • Adds azure.private-dns-zone and azure.private-dns-record-set resources.
   • Adds matched-security-rule annotation to Azure NSG ingress/egress filters.
   • Adds resource lookup support in tag values for Azure tags actions.
   • Replaces SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. basic auth with Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. bearer tokenbearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. for azure.function-app operations.
   • Adds monitor action to gcp.vertex-ai-endpoint resources.
   • Adds gcp-audit mode support to gcp.api-key resources.
   • Adds update action to gcp.dns-policy resources.
   • Adds update action to gcp.bq-dataset resources.
   • Adds enable-dnssec and set-dnssec-key-specs actions to gcp.dns-managed-zone.
   • Adds new gcp.regional-commitment resource.
   • Adds metrics filter to gcp.vertex-ai-endpoint.
   • Adds new gcp.notebook-v2 resource with get and update-metadata actions.
   • Adds new gcp.vertex-ai-custom-job resource.
   • Adds new gcp.vertex-ai-dataset resource.
   • Adds new gcp.vertex-ai-hyper-parameter-tuning-job resource.
   • Adds new gcp.vertex-ai-model resource.
   • Adds new gcp.vertex-ai-evaluation-run resource.
   • Adds compute instance metadata support for gcp.instance resources.
   • Extends gcp.metrics filter to honor missing-value: 0 correctly.
   • Adds regional persistent disk support for GCP disk actions.

   57 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !In aws.c7n-org accounts configuration, the Status field for retiring accounts is renamed to State.
3. 0.9.51.0 May 28, 2026 · release notes

   Cloud Custodian 0.9.51.0 adds AI/ML resource coverage across all three clouds plus dozens of new filters and label actions.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.9.51.0 https://github.com/cloud-custodian/cloud-custodian.git
   # already have the repo? check out this version:
   $ git checkout 0.9.51.0

   └──▷ TRY IT
   Audit Bedrock foundation models to identify any that lack guardrail configurations in your AWS environment.
   copy

   $ custodian run -s output policy-bedrock-fm.yml
   # policy-bedrock-fm.yml:
   policies:
     - name: bedrock-foundation-model-audit
       resource: aws.bedrock-foundation-model

   Find unused RDS parameter groups to reduce configuration sprawl.
   copy

   $ custodian run -s output policy-rds-params.yml
   # policy-rds-params.yml:
   policies:
     - name: unused-rds-param-groups
       resource: aws.rds-param-group
       filters:
         - type: unused

   • Adds aws.bedrock-foundation-model resource for policy enforcement against Bedrock foundation models.
   • Adds aws.bedrock-guardrail resource for managing and querying Bedrock guardrails.
   • Adds metrics filter for aws.bedrock-inference-profile resources.
   • Adds aws.devops-agent-space resource with tag support.
   • Adds WAFv2 support for querying API attributes including redacted fields.

   +21 more show less

   • Adds EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. cluster container insight metrics and addon filters.
   • Adds ExportDescriptionFilter and ImportSummaryFilter for DynamoDB resources.
   • Adds statistic override to the usage-metric filter for service-quota resources.
   • Adds enable connection logs action for Application Load Balancers.
   • Adds unused filter for rds-param-group and rds-cluster-param-group resources.
   • Adds ReservationId support for EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. resource filtering.
   • Adds RDS DB recommendations filter.
   • Adds cross-account support for aws:PrincipalOrgPaths and whitelisted accounts in policy statements.
   • Adds azure.ai-foundry-project and azure.ai-foundry-connection resources with associated actions.
   • Adds Azure Blob Storage as a source for value_from filters.
   • Adds gcp.vertex-ai-publisher and gcp.vertex-ai-publisher-model resources (Vertex AI Model Garden).
   • Adds gcp.firestore-database, gcp.firestore-backup-schedule, gcp.firestore-field, and gcp.firestore-index resources.
   • Adds gcp.ncc-spoke resource for Network Connectivity Center spoke management.
   • Adds gcp.redis-cluster resource.
   • Adds delete action for GCP sqlbackuprun resources.
   • Adds set-labels action for Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity. services and jobs.
   • Adds label actions for GCP secret, armor-policy, dns-managed-zone, interconnect, interconnect-attachment, loadbalancer, loadbalancer-address, snapshot, pubsub, redis, and function resources.
   • Adds delete and patch actions for GCP api-key resources.
   • Adds BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. recommender support for GCP.
   • Adds snapshots filter for GCP disk resources.
   • Adds validate command to c7n-org for validating policy files across org accounts.

   26 details in Everything

4. 0.9.50.0 Mar 18, 2026 · release notes

   Cloud Custodian 0.9.50 adds 12 new AWS resources, 4 Azure Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. resources, 3 GCP Vertex AI resources, and dozens of new filters and actions across all providers.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.9.50.0 https://github.com/cloud-custodian/cloud-custodian.git
   # already have the repo? check out this version:
   $ git checkout 0.9.50.0

   └──▷ TRY IT
   Detect EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. clusters where a Kubernetes version upgrade is available, so you can prioritize remediation before support ends.
   copy

   $ custodian run -s out policy.yml
   # policy.yml:
   policies:
     - name: eks-upgrade-available
       resource: aws.eks
       filters:
         - type: upgrade-available

   Find IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. users with service-specific credentials (e.g., CodeCommit HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. credentials) to audit or rotate them.
   copy

   $ custodian run -s out policy.yml
   # policy.yml:
   policies:
     - name: iam-user-service-specific-creds
       resource: aws.iam-user
       filters:
         - type: service-specific-credentials

   Use the cross-account filter on OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. Ingestion pipelines to catch pipelines accessible from outside your AWS Organization.
   copy

   $ custodian run -s out policy.yml
   # policy.yml:
   policies:
     - name: opensearch-ingestion-cross-account
       resource: aws.opensearch-ingestion
       filters:
         - type: cross-account

   • Adds ability to normalize tag keys in filters across AWS, Azure, and GCP providers.
   • Adds start-of-day option to the metrics filter across AWS, Azure, and GCP.
   • New upgrade-available filter for AWS EKS to detect clusters with a newer Kubernetes version available.
   • New upgrade-available filter for AWS ElasticSearch to detect domains eligible for upgrade.
   • New aws.bedrock-inference-profile resource with delete action for managing Bedrock inference profiles.

   +25 more show less

   • New aws.bedrock-model-invocation-job resource for managing Bedrock model invocation jobs.
   • New aws.directconnect-gateway and aws.directconnect-virtual-interface resources for Direct Connect management.
   • New aws.ec2-instance-ami resource and image-metadata filter on aws.ec2 to query AMI metadata for running instances.
   • New aws.event-api-destination resource for managing EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure. API destinations.
   • New aws.opensearch-reserved resource for managing OpenSearch Reserved Instances.
   • New aws.savings-plan resource for querying and managing AWS Savings Plans.
   • New aws.transfer-connector and aws.transfer-web-app resources for AWS Transfer Family.
   • New aws.vpc-lattice-listener and aws.vpc-lattice-service-network-association resources for VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Lattice management.
   • New cross-account filter on aws.opensearch-ingestion to detect cross-account pipeline access.
   • New VpcEndpointPolicySupported filter (service-details) on aws.vpc-endpoint to check endpoint policy support.
   • New service-specific-credentials filter on aws.iam-user to audit IAM user service-specific credentials.
   • New toggle-recording action on aws.config-recorder to enable or disable AWS Config recording.
   • New network-location, security-group, and subnet filters on aws.transfer-server.
   • Adds whitelist_patterns option to the cross-account filter to skip deleted IAM principals.
   • Adds WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. filter support for AWS Managed Rule Groups.
   • Adds ASG termination action for Auto Scaling Groups.
   • Adds EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. gp3 modify IOPS action.
   • New azure.entraid-authorization-policy, azure.entraid-conditional-access-policy, azure.entraid-named-location, and azure.entraid-security-defaults resources for Azure Entra ID.
   • New storage-metrics filter on azure.storage for metric-based storage account policies.
   • Adds tag actions to azure.subscription resource.
   • New gcp.vertex-ai-batch-prediction-job, gcp.vertex-ai-endpoint, and gcp.vertex-ai-location resources for GCP Vertex AI.
   • Adds set-label action to GCP buckets, BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data., BigTable, and several additional GCP resources.
   • Adds set-iam-policy action for gcp.bucket to manage bucket IAM policies.
   • Enhances GCP iam-policy filter with value filter semantics and remove-bindings: matched option.
   • Promotes aws-accounts script to a proper CLI command in c7n_org.

   30 details in Everything

5. 0.9.49.0 Jan 16, 2026 · release notes

   Cloud Custodian 0.9.49 adds AWS resolver-rule and Azure Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. resources, ALBALBAWS Application Load Balancer, a managed Layer 7 load balancer from Amazon that routes HTTP/HTTPS traffic by host, path, or header, giving tools flexible ingress control without managing their own proxy. listener-rule filter, and HCL error failing for shift-left.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.9.49.0 https://github.com/cloud-custodian/cloud-custodian.git
   # already have the repo? check out this version:
   $ git checkout 0.9.49.0

   └──▷ TRY IT
   Inventory all Route 53 Resolver rules in your account to find shared or overly-permissive DNS forwarding rules.
   copy

   $ custodian run -s out resolver-rules.yml
   # resolver-rules.yml:
   policies:
     - name: resolver-rule-inventory
       resource: aws.resolver-rule

   • Adds new aws.resolver-rule resource for managing Route 53 Resolver rules in policies.
   • Adds listener-rule filter to aws.app-elb for inspecting ALB routing rules.
   • Adds new azure.entraid-group resource for managing Entra ID groups.
   • Adds new azure.entraid-organization resource for managing Entra ID organization settings.
   • Extends the aws.vpc dhcp-options filter with an amazon synthetic value for matching AWS-provided DHCP option sets.

   +3 more show less

   • Adds config-compliance filter to aws.comprehend-flywheel, aws.sagemaker-model-bias-job-definition, and aws.ses-dedicated-ip-pool resources.
   • Adds json-diff filter to aws.app-elb-target-group, aws.artifact-domain, aws.comprehend-flywheel, aws.datasync-agent, aws.glue-database, aws.sagemaker-data-quality-job-definition, aws.sagemaker-model-bias-job-definition, aws.sagemaker-model-explainability-job-definition, aws.sagemaker-model-quality-job-definition, aws.ses-dedicated-ip-pool, and aws.transfer-server resources.
   • Enables c7n-left (shift-left) to fail runs on HCL parse errors, surfacing misconfigured Terraform before policy evaluation.

   8 details in Everything

6. 0.9.48.0 Dec 1, 2025 · release notes

   Cloud Custodian 0.9.48 adds new AWS/Azure/GCP resources, KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. rotation filters, WAFv2 logging actions, and VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Lattice support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.9.48.0 https://github.com/cloud-custodian/cloud-custodian.git
   # already have the repo? check out this version:
   $ git checkout 0.9.48.0

   └──▷ TRY IT
   Detect KMS keys that have not been rotated within the last 365 days to enforce rotation compliance.
   copy

   $ custodian run -s out policy-kms-rotation.yml
   
   # policy-kms-rotation.yml:
   policies:
     - name: kms-keys-stale-rotation
       resource: aws.kms-key
       filters:
         - type: last-rotation
           op: gt
           days: 365

   Enable WAFv2 logging to a Kinesis Firehose delivery stream for all WebACLs missing a logging configuration.
   copy

   $ custodian run -s out policy-wafv2-logging.yml
   
   # policy-wafv2-logging.yml:
   policies:
     - name: wafv2-enable-logging
       resource: aws.wafv2
       filters:
         - type: value
           key: LoggingConfiguration
           value: absent
       actions:
         - type: set-logging
           log_destination: arn:aws:firehose:us-east-1:123456789012:deliverystream/aws-waf-logs-stream

   Find Secrets Manager secrets whose current version attributes or replica status match governance criteria.
   copy

   $ custodian run -s out policy-secrets.yml
   
   # policy-secrets.yml:
   policies:
     - name: secrets-check-replica
       resource: aws.secrets-manager
       filters:
         - type: replica-attribute
           key: Status
           value: Failed
     - name: secrets-check-current-version
       resource: aws.secrets-manager
       filters:
         - type: current-version
           key: VersionStages
           value: AWSCURRENT
           op: contains

   • New aws.iam-access-key resource enables policies targeting IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. access keys directly.
   • New aws.lambda-event-source-mapping resource supports managing Lambda event source mappings.
   • Adds three new AWS VPC Lattice resources: aws.vpc-lattice-service, aws.vpc-lattice-service-network, and aws.vpc-lattice-target-group.
   • New ami-block-public-access filter on aws.account to detect accounts without AMI public-access blocking.
   • New last-rotation filter on aws.kms-key to identify keys by their last rotation date.

   +15 more show less

   • New upgrade-available filter on aws.cache-cluster (ElastiCache) to find clusters eligible for engine upgrades.
   • New upgrade-available and cross-account filters on aws.kafka for MSK cluster governance.
   • New set-logging action on aws.wafv2 to configure WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. logging destinations.
   • New delete action on aws.subnet for automated subnet removal.
   • New delete-listener action on aws.app-elb for Application Load Balancer listener management.
   • New current-version and replica-attribute filters on aws.secrets-manager for version- and replica-level secret inspection.
   • New resolver-query-logging filter on aws.vpc to check VPC DNS query logging configuration.
   • New analytics-association filter on aws.connect-instance for Amazon Connect analytics governance.
   • New azure.entraid-user resource adds base Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. support for user-level policies.
   • New azure.elasticache-reserved resource for managing Azure Cache reserved capacity.
   • New update action on azure.keyvault-key for modifying Key Vault key attributes.
   • New gcp.certmanager-certificate resource for managing GCP Certificate Manager certificates.
   • Adds EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. server-side query filtering to reduce data fetched during resource enumeration.
   • Extends aws.fsx delete-file-system action to support additional FSx file system types.
   • Extends aws.firehose delete action to handle suspended delivery streams.

   20 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The metrics filter is removed from aws.opswork-stack.
   • !The metrics filter is removed from gcp.spanner-backup and gcp.spanner-database-instance.
7. 0.9.47.0 Sep 22, 2025 · release notes

   Cloud Custodian 0.9.47 adds QuickSight, EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure. Pipes, CloudWatch Synthetics, Azure Backup Vault support, and broad org-resource tagging actions.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.9.47.0 https://github.com/cloud-custodian/cloud-custodian.git
   # already have the repo? check out this version:
   $ git checkout 0.9.47.0

   └──▷ TRY IT
   Find S3 Multi-Region Access Points exposed to external accounts and flag them for review.
   copy

   $ custodian run -s out policy-s3-mrap-xaccount.yml
   
   # policy-s3-mrap-xaccount.yml
   policies:
     - name: s3-mrap-cross-account
       resource: aws.s3-access-point-multi
       filters:
         - type: cross-account

   Enforce tagging standards on all AWS Organization accounts by auto-tagging with the acting user.
   copy

   $ custodian run -s out policy-org-account-tag.yml
   
   # policy-org-account-tag.yml
   policies:
     - name: org-account-auto-tag
       resource: aws.org-account
       filters:
         - "tag:Owner": absent
       actions:
         - type: auto-tag-user
           tag: Owner

   • Adds aws.quicksight-dashboard and aws.quicksight-datasource resource types for managing QuickSight assets.
   • Adds aws.eventbridge-pipes resource type for governing EventBridge Pipes.
   • Enables aws.cloudwatch-synthetics as a new manageable resource type.
   • Adds cross-account filter to aws.s3-access-point-multi (S3 Multi-Region Access Points).
   • Adds region-copy action to aws.rds-cluster-snapshot for copying RDS cluster snapshots across regions.

   +6 more show less

   • Adds metrics filter to aws.fsx covering all FSx file system types.
   • Adds tagging actions (tag, remove-tag, rename-tag, auto-tag-user, copy-related-tag, mark-for-op) and marked-for-op filter to aws.org-account, aws.org-policy, and aws.org-unit.
   • Adds azure.backup-vault resource type for Azure Backup Vault governance.
   • Expands azure.machine-learning-workspace with full ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. resource actions (tag, delete, lock, etc.) and filters (cost, diagnostic-settings, metric, policy-compliant, etc.).
   • Updates AWS Lambda runtime support to include Python 3.10–3.13.
   • Adds terraform._ resource type support.

   11 details in Everything

8. 0.9.46.0 Jul 17, 2025 · release notes

   Cloud Custodian 0.9.46 adds 10 new AWS Comprehend job resources, client-vpn-endpoint, VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. endpoint service config, KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. schedule-deletion, and more.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.9.46.0 https://github.com/cloud-custodian/cloud-custodian.git
   # already have the repo? check out this version:
   $ git checkout 0.9.46.0

   └──▷ USE IT
   Write a policy that targets KMS keys for scheduled deletion — using the new schedule-deletion action.
   yaml copy

   # policy-kms-schedule-deletion.yml
   policies:
     - name: kms-schedule-deletion-disabled-keys
       resource: aws.kms-key
       filters:
         - type: value
           key: KeyState
           value: Disabled
       actions:
         - type: schedule-deletion
           pending_window_in_days: 14

   Detect Comprehend PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. detection jobs that are not encrypting output with a compliant KMS key, useful for data-classification governance.
   yaml copy

   # policy-comprehend-pii-kms.yml
   policies:
     - name: comprehend-pii-job-no-kms
       resource: aws.comprehend-pii-entities-detection-job
       filters:
         - type: value
           key: OutputDataConfig.KmsKeyId
           value: absent

   • New aws.client-vpn-endpoint resource enables policies over Client VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. endpoints.
   • New aws.vpc-endpoint-service-configuration resource enables policies over VPC endpoint service configurations.
   • New set-security-token-service-preferences action on aws.account for managing STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets. regional endpoint settings.
   • New schedule-deletion action on aws.kms-key for scheduling KMS key deletion via policy.
   • New pipeline-config filter on aws.opensearch-ingestion for inspecting pipeline configuration.

   +7 more show less

   • New delete action on aws.quicksight-user for removing QuickSight users via policy.
   • Adds 9 new AWS Comprehend job resources: comprehend-document-classification-job, comprehend-dominant-language-detection-job, comprehend-entities-detection-job, comprehend-events-detection-job, comprehend-key-phrases-detection-job, comprehend-pii-entities-detection-job, comprehend-sentiment-detection-job, comprehend-targeted-sentiment-detection-job, and comprehend-topics-detection-job.
   • New kms-key filter on aws.comprehend-document-classifier, aws.comprehend-entity-recognizer, and aws.comprehend-flywheel for encryption compliance checks.
   • New file-services filter on azure.storage for inspecting Azure Storage file service settings.
   • New config-compliance and json-diff filters on aws.iam-oidc-provider; json-diff filter also added to aws.identity-pool and aws.memorydb-subnet-group.
   • Cross-account filter now supports additional condition keys for finer-grained policy matching.
   • New policy-statement filter supports more partial match scenarios.

   12 details in Everything

9. 0.9.45.0 Jun 2, 2025 · release notes

   Cloud Custodian 0.9.45 adds Comprehend, Keyspaces, Lex v2, and RAMRAMWorking memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed. resource support plus new API Gateway v2 actions.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.9.45.0 https://github.com/cloud-custodian/cloud-custodian.git
   # already have the repo? check out this version:
   $ git checkout 0.9.45.0

   └──▷ TRY IT
   Identify Comprehend endpoints not tagged with an owner to enforce tagging compliance.
   copy

   $ custodian run -s out policy.yml
   
   # policy.yml
   policies:
     - name: comprehend-endpoint-missing-owner-tag
       resource: aws.comprehend-endpoint
       filters:
         - "tag:Owner": absent

   Delete stale API Gateway v2 stages in a non-production environment to reduce attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
   copy

   $ custodian run -s out policy.yml
   
   # policy.yml
   policies:
     - name: apigwv2-stage-delete-nonprod
       resource: aws.apigwv2-stage
       filters:
         - "tag:Env": nonprod
       actions:
         - delete

   Find ElastiCache clusters not in your approved VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. to catch misconfigured network placement.
   copy

   $ custodian run -s out policy.yml
   
   # policy.yml
   policies:
     - name: cache-cluster-wrong-vpc
       resource: aws.cache-cluster
       filters:
         - type: vpc
           key: VpcId
           value: vpc-approved123
           op: not-equal

   • Adds four new AWS Comprehend resource types: aws.comprehend-document-classifier, aws.comprehend-endpoint, aws.comprehend-entity-recognizer, and aws.comprehend-flywheel.
   • Adds aws.keyspace and aws.keyspace-table resources for managing Amazon Keyspaces (Cassandra-compatible).
   • Adds aws.lexv2-bot-alias resource with cross-account filter and delete action for Lex v2 bot aliases.
   • Adds aws.resource-share-self and aws.resource-share-other resources for managing AWS RAMAWS RAMAWS Resource Access Manager is an Amazon service that lets an AWS account share resources such as subnets or Transit Gateways with other accounts or AWS Organizations, removing the need to duplicate infrastructure across account boundaries. resource shares.
   • Adds delete and update actions to aws.apigwv2 (API Gateway v2 APIs) and aws.apigwv2-stage resources.

   +6 more show less

   • Adds vpc filter to aws.cache-cluster via ElastiCache server-side query support.
   • Adds topic filter to aws.rds-subscription for filtering RDS event subscriptions by SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure. topic.
   • Adds db-parameter filter to aws.timestream-influxdb resources.
   • Adds return_allowed configuration option to the cross-account filter, returning matching allowed statements.
   • Adds support for extended statistics keys in the metrics filter.
   • Adds cam-policy-used filter support for finding unused CAM policies in Tencent Cloud via boolean flag.

   11 details in Everything

10. 0.9.44.0 Apr 24, 2025 · release notes

    Cloud Custodian 0.9.44.0 adds 20+ new AWS/Azure resources, WAFv2 rule inspection, EFS cross-account detection, and Shield Protection tagging.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.44.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.44.0

    └──▷ TRY IT
    Detect WAFv2 Web ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. missing a rate-based rule, useful for enforcing DDoSDDoSDistributed Denial of Service: an attack that floods a target system with traffic from many sources simultaneously, exhausting its resources so legitimate requests cannot be served. baseline controls.
    copy

    $ custodian run -s out policy-waf.yml
    # policy-waf.yml:
    policies:
      - name: wafv2-missing-rate-limit
        resource: aws.wafv2
        filters:
          - type: web-acl-rules
            match: none
            attrs:
              - type: RateBasedStatement

    Find EFS file systems with cross-account access granted, then remove overly permissive statements.
    copy

    $ custodian run -s out efs-cross-account.yml
    # efs-cross-account.yml:
    policies:
      - name: efs-cross-account-remediate
        resource: aws.efs
        filters:
          - type: cross-account
        actions:
          - type: remove-statements
            statement_ids: matched

    Tag Shield Protection resources with the user who created them, enabling ownership tracking for DDoS-protected resources.
    copy

    $ custodian run -s out shield-autotag.yml
    # shield-autotag.yml:
    policies:
      - name: shield-protection-auto-tag-owner
        resource: aws.shield-protection
        filters:
          - "tag:Owner": absent
        actions:
          - type: auto-tag-user
            tag: Owner

    • Adds aws.rds-db-shard-group resource for managing Aurora Limitless shard groups.
    • Adds aws.codedeploy-config resource and config filter on aws.codedeploy-group for CodeDeploy deployment configuration policies.
    • Adds aws.destination and aws.delivery-destination resources for CloudWatch Logs cross-account log routing.
    • Adds aws.payment-cryptography-key resource with tagging and delete actions.
    • Adds aws.ses-dedicated-ip-pool, aws.ses-configuration-set-v2, and aws.ses-ingress-endpoint resources for SESv2 management.

    +26 more show less

    • Adds aws.timestream-influxdb and aws.timestream-influxdb-cluster resources.
    • Adds aws.fsx-volume resource and volume/vpc filters on aws.fsx.
    • Adds new Athena resources: aws.athena-capacity-reservation, aws.athena-data-catalog, and aws.athena-work-group.
    • Adds aws.cloudhsm-backup, aws.kafka-config, aws.kendra, aws.lexv2-bot, and aws.quicksight-account resources.
    • Adds web-acl-rules filter to aws.wafv2 for inspecting WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. rule configurations.
    • Adds cross-account filter and remove-statements action to aws.efs for EFS policy governance.
    • Adds cross-account filter and remove-policies action to aws.ses-email-identity.
    • Adds topic filter to aws.cfn for filtering stacks by SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure. notification topic.
    • Adds is-log-forwarding filter to aws.directory for checking Directory Service log forwarding status.
    • Adds kms-key filter to aws.dms-endpoint.
    • Adds used-by filter to aws.elastic-ip.
    • Adds delete action to aws.iam-saml-provider for removing SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
    • Adds tagging actions (tag, remove-tag, mark-for-op, auto-tag-user, copy-related-tag) and finding/marked-for-op filters to aws.shield-protection.
    • Adds configuration filter to aws.swf-domain.
    • Adds directory filter to aws.workspaces-directory for filtering by Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments..
    • Adds ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. lifecycle policy support for tagPatternList field in set-lifecycle action.
    • Adds server-side query support to aws.ecr-image for more efficient image policy evaluation.
    • Adds aws.athena-data-catalog tagging support.
    • Removes the 5-security-group maximum limit check in the modify-security-groups action.
    • Adds azure.postgresql-flexibleserver resource.
    • Adds modify-disk-type action to azure.disk for changing disk SKUs.
    • Adds jit-policy-port filter to azure.vm for Just-In-Time access policy inspection.
    • Adds management-policy-rules filter to azure.storage.
    • Adds webapp filter to azure.appserviceplan.
    • Adds new TencentCloud resources: tencentcloud.dns-record, tencentcloud.eip, and tencentcloud.subnet.
    • Adds s3 set-inventory schema support for additional optional fields.

    31 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !aws.log-destination resource has been removed from the schema.
11. 0.9.43.0 Feb 4, 2025 · release notes

    Cloud Custodian 0.9.43 adds 11 new AWS resource types, cross-account EFS/SES filters, Shield tagging, and new Azure/Tencent resources.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.43.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.43.0

    └──▷ TRY IT
    Detect EFS file systems with cross-account access and remove the offending policy statements to enforce least-privilege.
    copy

    $ custodian run -s out policy-efs-cross-account.yml
    
    # policy-efs-cross-account.yml
    policies:
      - name: efs-remove-cross-account-access
        resource: aws.efs
        filters:
          - type: cross-account
        actions:
          - type: remove-statements
            statements:
              - matched

    Tag all AWS Shield protections with the responsible owner and mark untagged ones for follow-up.
    copy

    $ custodian run -s out policy-shield-tag.yml
    
    # policy-shield-tag.yml
    policies:
      - name: shield-auto-tag-creator
        resource: aws.shield-protection
        filters:
          - "tag:Owner": absent
        actions:
          - type: auto-tag-user
            tag: Owner

    • Adds aws.lexv2-bot resource for managing Lex V2 bots.
    • Adds aws.timestream-influxdb resource with network-location filter for Timestream InfluxDB instances.
    • Adds aws.athena-work-group, aws.athena-capacity-reservation, and aws.athena-data-catalog resources for Athena governance.
    • Adds aws.cloudhsm-backup resource for CloudHSM backup management.
    • Adds aws.kafka-config resource for MSK cluster configuration.

    +22 more show less

    • Adds aws.kendra resource for Amazon Kendra index management.
    • Adds aws.quicksight-account resource for QuickSight account settings.
    • Adds aws.ses-configuration-set-v2 and aws.ses-ingress-endpoint resources for SESv2 governance.
    • Adds cross-account filter and remove-statements action to aws.efs for detecting and remediating cross-account EFS access.
    • Adds cross-account filter and remove-policies action to aws.ses-email-identity.
    • Adds full tagging support to aws.shield-protection (tag, remove-tag, auto-tag-user, copy-related-tag, mark-for-op, marked-for-op) plus finding filter.
    • Adds used-by filter to aws.elastic-ip to identify in-use Elastic IPs.
    • Adds template filter to aws.cfn for searching CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. stack templates.
    • Adds is-log-forwarding filter to aws.directory for Directory Service log subscription checks.
    • Adds kms-key filter to aws.dms-endpoint to audit DMS endpoint encryption.
    • Adds configuration filter to aws.swf-domain for SWF domain configuration inspection.
    • Adds has-statement partial-match support via policystatement filter.
    • Adds support for non-default EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure. event buses in aws.event-rule and event targets.
    • Adds azure.afd-endpoint and azure.afd-custom-domain resources for Azure Front Door management.
    • Adds webapp filter to azure.appserviceplan to find plans hosting specific web apps.
    • Adds management-policy-rules filter to azure.storage for lifecycle rule inspection.
    • Adds jit-policy-port filter to azure.vm for Just-In-Time access policy auditing.
    • Adds ability to set minimum TLS version on Azure storage buckets.
    • Adds support for custom namespaces in Azure metrics filter.
    • Adds tencentcloud.eip, tencentcloud.dns-record, and tencentcloud.subnet resources.
    • Adds --workspace option to c7n-left for selecting a Terraform workspace during shift-left policy evaluation.
    • Adds discard_local_ssd parameter support to GCP instance stop action.

    27 details in Everything

12. 0.9.42.0 Nov 14, 2024 · release notes

    Cloud Custodian 0.9.42 adds Global Accelerator, ElastiCache User, Step Functions Activities, and dozens of new filters across AWS and Azure resources.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.42.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.42.0

    └──▷ TRY IT
    Detect DynamoDB tables with cross-account access or overly permissive resource policies in a single policy sweep.
    copy

    $ custodian run --output-dir=out policy-dynamodb-cross-account.yml

    Audit AWS account-level EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instance metadata defaults (e.g., IMDSv2 enforcement) and enforce compliant defaults.
    copy

    $ custodian run --output-dir=out - <<'EOF'
    policies:
      - name: enforce-imds-defaults
        resource: aws.account
        filters:
          - type: ec2-metadata-defaults
            key: HttpTokens
            value: optional
        actions:
          - type: set-ec2-metadata-defaults
            HttpTokens: required
    EOF

    Find Lambda functions with public function URLs that are not restricted to IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. authentication.
    copy

    $ custodian run --output-dir=out - <<'EOF'
    policies:
      - name: lambda-public-url-no-iam
        resource: aws.lambda
        filters:
          - type: url-config
            key: AuthType
            value: NONE
    EOF

    • Adds aws.globalaccelerator resource with attribute filter support for managing AWS Global Accelerator endpoints.
    • Adds aws.elasticache-user resource for managing ElastiCache users.
    • Adds aws.log-destination resource for managing CloudWatch Logs destinations.
    • Adds aws.sfn-activity resource with tagging and encryption support for Step Functions activities.
    • Adds azure.app-service-environment resource for managing Azure App Service Environments.

    +11 more show less

    • Adds ec2-metadata-defaults filter and set-ec2-metadata-defaults action on aws.account to audit and enforce EC2 instance metadata defaults.
    • Adds cross-account and has-statement filters to aws.dynamodb-table for detecting cross-account access and IAM policy statements.
    • Adds cross-account filter to aws.kinesis for detecting Kinesis streams exposed to other accounts.
    • Adds has-statement filter to aws.rest-api for auditing API Gateway resource policies.
    • Adds kms-key filter to aws.event-bus for checking EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure. bus encryption.
    • Adds kms-key filter to aws.step-machine for auditing Step Functions state machine encryption.
    • Adds url-config filter to aws.lambda for inspecting Lambda function URL configurations.
    • Adds ldap, settings, and trust filters to aws.directory for auditing Directory Service LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. settings and trust relationships.
    • Adds delete action to aws.ses-configuration-set for removing SES configuration sets.
    • Adds terraform._ resource support for Terraform shift-left policy evaluation.
    • Adds c7n-org run-script shell passthrough improvement using shlex parsing for more robust argument handling.

    16 details in Everything

13. 0.9.41.0 Sep 18, 2024 · release notes

    Cloud Custodian 0.9.41 adds 5 new AWS resources, Azure snapshots, OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. Ingestion, MemoryDB users/ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource., and a shift-left validate command.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.41.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.41.0

    └──▷ USE IT
    Filter AWS Config recorders by retention period to detect non-compliant retention configurations.
    yaml copy

    # policy.yml
    policies:
      - name: config-recorder-retention-check
        resource: aws.config-recorder
        filters:
          - type: retention
            key: retentionPeriodInDays
            op: lt
            value: 365

    • Adds aws.opensearch-ingestion resource with filters and actions for managing OpenSearch Ingestion pipelines.
    • Adds aws.origin-access-control resource for managing CloudFront origin access controls.
    • Adds aws.memorydb-user, aws.memorydb-acl, and aws.memorydb-snapshot resources (snapshot includes tag support and delete action).
    • Adds retention filter to aws.config-recorder for querying Config recorder retention settings.
    • Adds browser-policy, subnet, user-access-logging, and user-settings filters to aws.workspaces-web.

    +7 more show less

    • Adds detail spec to aws.storage-gateway, unlocking tag management actions (tag, remove-tag, rename-tag, copy-related-tag, auto-tag-user, mark-for-op) and marked-for-op filter.
    • Adds azure.snapshot resource with a delete action.
    • Restores Terraform as a supported provider in core, enabling schema validation for shift-left (terraform._ resource).
    • Adds from_json JMESPath function to the value filter for parsing embedded JSON strings during filtering.
    • Adds validate command to c7n-left (shift-left CLI) for policy validation against IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup..
    • Extends c7n-left traverse filter to support boolean blocks in attributes.
    • De-duplicates matched egress/ingress rules in aws.security-group results.

    12 details in Everything

14. 0.9.39.0 Jul 23, 2024 · release notes

    Cloud Custodian 0.9.39 adds 8 new AWS resource types, EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. SSM inventory filter, S3 object lock filter, and more.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.39.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.39.0

    • New aws.codebuild-credential resource for managing CodeBuild source credentials.
    • New aws.servicediscovery-namespace resource with instance filter for AWS Service Discovery namespaces.
    • New AWS Network Manager resources: aws.networkmanager-core, aws.networkmanager-global, aws.networkmanager-site, aws.networkmanager-device, and aws.networkmanager-link.
    • New aws.memorydb-subnet-group resource, plus subnet, kms-key, security-group, and network-location filters on aws.memorydb.
    • New ssm-inventory filter on aws.ec2 to query EC2 instances by SSM inventory and installed packages.

    +7 more show less

    • New lock-configuration filter on aws.s3 to check S3 object lock settings.
    • New db-parameter filter on aws.rds-param-group and aws.rds-cluster-param-group for inspecting RDS parameter group values.
    • New content and marked-for-op filters plus tagging actions (tag, remove-tag, rename-tag, copy-related-tag, auto-tag-user, mark-for-op) on aws.ssm-document.
    • New App Mesh filters: route, router, and service on aws.appmesh-mesh; gateway-route on aws.appmesh-virtualgateway.
    • Adds values_from support for DynamoDB as a data source in policy filters.
    • New time-range filter on gcp.api-key to find API keys by creation or update time.
    • ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. resources now include configuration information in policy evaluation.

    12 details in Everything

15. 0.9.38.0 Jun 18, 2024 · release notes

    Cloud Custodian 0.9.38 adds aws.memorydb resource and delete action for gcp.bq-dataset, plus EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. snapshot description enhancement.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.38.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.38.0

    └──▷ USE IT
    Define a policy to delete BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. datasets that are older than 30 days in GCP.
    text copy

    policies:
      - name: delete-old-bq-datasets
        resource: gcp.bq-dataset
        filters:
          - type: value
            key: creationTimestamp
            op: ge
            value_type: age
            value: 30
        actions:
          - type: delete

    • Adds aws.memorydb resource support for MemoryDB clusters, enabling policy writing for this AWS service
    • Adds delete action to gcp.bq-dataset resource, allowing datasets to be removed via policies
    • Enhances the snapshot action on aws.ec2.snapshot resources to include the associated instance name in the snapshot description

    3 details in Everything

16. 0.9.37.0 Jun 5, 2024 · release notes

    Cloud Custodian 0.9.37.0 adds six new SageMaker resource types, EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure. scheduler mode, and Timestream filters

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.37.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.37.0

    • aws.timestream-database now supports the kms-key filter for restricting policies to specific KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. keys
    • aws.timestream-table gains the consecutive-aws-backups filter to detect tables lacking continuous backup coverage
    • Policy Lambda execution mode now accepts eventbridge-scheduler via a new configuration option
    • CLI supports session policy injection for IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access.-scoped execution context
    • New resource types: aws.sagemaker-compilation-job, aws.sagemaker-data-quality-job-definition, aws.sagemaker-model-bias-job-definition, aws.sagemaker-model-explainability-job-definition, aws.sagemaker-model-quality-job-definition, and aws.sagemaker-processing-job

    5 details in Everything

17. 0.9.36.0 Apr 29, 2024 · release notes

    Cloud Custodian 0.9.36.0 adds new resource types (SageMaker, Workspaces, Stream Job), filters, and actions for AWS and Azure policy management

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.36.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.36.0

    • Adds aws.workspaces-bundle resource support for managing Amazon Workspaces bundles.
    • Adds aws.appmesh-virtualnode resource support for App Mesh mesh policies.
    • Adds aws.sagemaker-auto-ml-job, aws.sagemaker-cluster, aws.sagemaker-domain, and aws.sagemaker-hyperparameter-tuning-job resource types for SageMaker automation policies.
    • Adds azure.stream-job resource support for Azure Stream Analytics job management.
    • Adds the snapshots filter to aws.ebs resources to evaluate associated EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. snapshots in policies.

    +7 more show less

    • Adds logging-config filter and update-logging-config, delete, update-delete-protection actions to aws.firewall resources.
    • Adds kms-key filter to aws.opensearch-serverless resources for KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves.-enabled resource detection.
    • Adds json-diff filter to multiple AWS resources (app-flow, appstream-stack, bedrock-agent, catalog-product, config-recorder, dms-endpoint, dms-instance, event-rule, graphql-api, s3-access-point, s3-access-point-multi, sagemaker-endpoint-config, sagemaker-notebook, scaling-policy, ses-configuration-set) for comparing resource state changes.
    • Adds compute-instances filter to azure.machine-learning-workspace resources.
    • Adds certificates filter to azure.api-management resources.
    • Adds firewall-bypass, security-alert-policies, and server-configurations filters to azure.postgresql-server resources.
    • Allows variable references to pass type validation in core policy processing.

    12 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !aws.appmesh-virtual-gateway resource type has been removed; use aws.appmesh-virtualgateway instead.
18. 0.9.35.0 Mar 5, 2024 · release notes

    New AWS Bedrock resource types and AppMesh support, plus Azure SQL Server audit filters

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.35.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.35.0

    └──▷ USE IT
    Filter Azure SQL Servers that have auditing policies disabled or misconfigured
    text copy

    c7n run -s output/ azure-sql-audit.yaml --dryrun

    • aws.appmesh-mesh and aws.appmesh-virtual-gateway resources added for AppMesh management
    • New aws.bedrock-agent, aws.bedrock-customization-job, and aws.bedrock-knowledge-base resource types added
    • aws.s3-storage-lens resource added to manage Storage Lens configurations
    • Azure sql-server resource gains auditing-policies, failover-group, and security-alert-policies filters
    • New is-composite-child filter on aws.alarm resources

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !json-diff filter removed from aws.rds-proxy resource
19. 0.9.34.0 Jan 18, 2024 · release notes

    Cloud Custodian 0.9.34.0 adds aws.org-account, aws.org-policy, and aws.s3-directory resources; new filters and actions for cost optimization and tagging.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.34.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.34.0

    └──▷ TRY IT
    Query member accounts in your AWS Organization using the new org-account resource
    copy

    $ c7n-org run -s output/ -c ./config.yml policy.yaml
    # Inside policy.yaml for aws.org-account:
    resources: aws.org-account

    Apply cost optimization filters to identify underutilized EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instances or ASGs
    yaml copy

    # Inside policy.yaml for aws.ec2:
    filters:
      - type: cost-optimization
        enabled: true

    Use the new disassociate action to release an Elastic IP via policy
    yaml copy

    # Inside policy.yaml for aws.elastic-ip:
    policy:
      resources: aws.elastic-ip
      actions:
        - disassociate

    • Adds aws.org-account resource type to query AWS Organization member accounts
    • Adds aws.org-policy resource type to query policies attached to Organizational Units or accounts
    • Adds aws.org-unit resource type to query Organizational Units within an organization
    • Adds aws.s3-directory resource type to manage S3 Express One Zone directories
    • Adds azure.synapse resource type for Azure Synapse Analytics workspaces

    +8 more show less

    • Adds cost-optimization filter to aws.asg, aws.ebs, aws.ec2, aws.ecs-service, and aws.lambda resources
    • Adds json-diff filter to aws.appstream-fleet, aws.kms, aws.ssm-document, and aws.user-pool resources
    • Adds disassociate action to aws.elastic-ip resource
    • Adds detach action to aws.eni resource
    • Adds tagging actions (auto-tag-user, copy-related-tag, remove-tag, rename-tag, tag) and marked-for-op filter to aws.batch-compute, aws.batch-definition, and aws.batch-queue resources
    • Adds update action to aws.batch-queue resource
    • Adds in operator support to the network-location filter for VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. resources
    • Adds python3.12 runtime support for lambda policies, defaulting to python3.11

    13 details in Everything

20. 0.9.33.0 Nov 29, 2023 · release notes

    Cloud Custodian 0.9.33.0 adds support for AWS Bedrock, OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. Serverless, ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. network filters, Azure Event Grid, and new OpenStack resources.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.33.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.33.0

    • Adds aws.bedrock-custom-model resource type for managing custom models in Amazon Bedrock
    • Adds aws.ec2-capacity-reservation resource type for EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. capacity reservations
    • Adds aws.opensearch-serverless resource type for OpenSearch Serverless collections
    • Adds aws.workspaces-web resource type for WorkSpaces Web sessions and endpoints
    • Adds network-location and security-group filters to aws.ecs-service resources

    +6 more show less

    • Adds network-location and security-group filters to aws.ecs-task resources
    • Adds delete action to aws.iam-oidc-provider resource type
    • Adds pending-maintenance filter to aws.rds-cluster resource type
    • Adds aws.app-configuration, azure.datalake-analytics, azure.kusto, and other Azure resources
    • Adds effective-firewall filter to gcp.gke-cluster resources
    • Adds openstack.image, openstack.secret, and openstack.security-group resource types

    11 details in Everything

21. 0.9.32.0 Oct 3, 2023 · release notes

    Cloud Custodian v0.9.32.0 adds new resources (Inspector2-finding), filters, actions, and schema types across AWS, Azure, and GCP.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.32.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.32.0

    • Adds aws.inspector2-finding resource support for scanning AWS Inspector2 findings
    • Adds delete-environment and update-environment actions to aws.airflow resource
    • Adds kms-key filter to aws.glue-catalog resource
    • Adds delete-empty action to aws.vpc resource
    • Adds rotation-policy filter to azure.keyvault-key resource

    +5 more show less

    • Adds iam-policy and org-policy filters to gcp.organization resource
    • Adds server-config filter to gcp.gke-cluster and gcp.gke-nodepool resources
    • Adds set-high-availability action to gcp.sql-instance resource
    • Supports float value_type in core policy filters
    • Allows escaped hyphens via ordinal hex in offhours core filter

    10 details in Everything

22. 0.9.31.0 Sep 6, 2023 · release notes

    Cloud Custodian 0.9.31.0 adds support for AWS Access Analyzer, Azure App Insights/Bastion, GCP Instance Group Manager, new S3 bucket-replication filter, and c7n-left --var-file support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.31.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.31.0

    └──▷ TRY IT
    Pass local Terraform variable files to c7n-left during policy evaluation.
    copy

    $ c7n-left evaluate --var-file vars.tfvars policy.yml

    • Adds data:aws.access-analyzer-finding resource type to detect active IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. findings in AWS.
    • Adds bucket-replication filter to S3 policy actions for configuring bucket replication rules.
    • Adds --var-file CLI argument to c7n-left to pass Terraform variable files directly.
    • Adds prefix: data. namespace to c7n-left data resource types.
    • Adds native OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. output support for logging and blob/object storage destinations.

    5 details in Everything

23. 0.9.30.0 Aug 15, 2023 · release notes

    Cloud Custodian 0.9.30.0 adds ~27 new AWS/GCP/Azure resource types and multiple new actions/filters for existing resources.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.30.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.30.0

    • aws.advisor-check resource type added for Amazon CloudCheck Advisor findings
    • aws.apigwv2-stage resource type added for API Gateway v2 stages
    • aws.appdiscovery-agent resource type added for Application Discovery Service agents
    • aws.appstream-fleet resource type added for AppStream 2.0 fleets
    • aws.appstream-stack resource type added for AppStream 2.0 stacks

    +30 more show less

    • aws.athena-named-query resource type added for Athena named queries
    • aws.budget resource type added for AWS Budgets
    • aws.cloudwatch-dashboard resource type added for CloudWatch Dashboards
    • aws.datasync-agent resource type added for DataSync agents
    • aws.datasync-task resource type added for DataSync tasks
    • aws.devicefarm-project resource type added for Device Farm projects
    • aws.dms-replication-task resource type added for DMS replication tasks
    • aws.flow-log resource type added for VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Flow Logs
    • aws.guardduty-finding resource type added for GuardDuty findings
    • aws.lex-bot resource type added for Lex bots
    • aws.quicksight-group resource type added for QuickSight groups
    • aws.quicksight-user resource type added for QuickSight users
    • aws.securityhub-finding resource type added for Security Hub findings
    • aws.ssm-patch-group resource type added for SSM patch groups
    • aws.ssm-session-manager resource type added for SSM Session Manager resources
    • aws.xray-group resource type added for X-Ray groups
    • aws.xray-rule resource type added for X-Ray rule groups
    • azure.front-door-policy resource type added for Azure Front Door policies
    • gcp.cloud-run-revision resource type added for Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity. revisions
    • ami.cancel-launch-permission action added to manage AMI launch permissions
    • rds.pending-maintenance filter added to RDS instances for pending maintenance events
    • rds-proxy.delete action added for removing RDS Proxy instances
    • rds-snapshot.instance filter added to associate snapshots with RDS instances
    • transit-attachment.set-flow-log action added for Transit GatewayTransit GatewayAn AWS-managed network hub that connects VPCs and on-premises networks through a single gateway, replacing complex peering meshes and giving cyber tools a central point to route or inspect cross-network traffic. attachments
    • transit-gateway.set-flow-log action added for Transit Gateways
    • transit-gateway.flow-logs filter added for Transit Gateway flow logs
    • user-pool.wafv2-enabled filter added for Cognito User Pools
    • vpc.modify action added for modifying VPC attributes
    • vpc.metrics filter added for VPC network usage metrics
    • azure.advisor-recommendation filter added to 50+ Azure resource types

    35 details in Everything

24. 0.9.29.0 Jul 20, 2023 · release notes

    Cloud Custodian 0.9.29.0 adds new AWS/GCP/Azure resources, actions, and filters plus OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. provider updates

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.29.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.29.0

    • aws.connect-campaign resource available for querying AWS Connect campaign data
    • gcp.armor-policy, gcp.dataproc-clusters, gcp.patch-deployment, and gcp.redis resources added for GCP cloud coverage
    • New ebs-storage filter on aws.ecs to inspect EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. storage configuration
    • New intelligent-tiering filter and set-intelligent-tiering action on aws.s3 for managing S3 intelligent tiering settings
    • New waf filter on azure.cdnprofile and azure.front-door resources to check WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. status

    +2 more show less

    • New mark-for-op, set-labels actions and marked-for-op filter on gcp.gke-cluster and gcp.image for label operations
    • Breaking change: OCI provider syntax for actions has been simplified, requiring configuration updates

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !OCI provider action syntax has changed; existing policies using the old syntax will fail and require migration to the simplified format described in #8740.
25. 0.9.28.0 Jun 28, 2023 · release notes

    Cloud Custodian 0.9.28.0 adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. provider support and new resource types for AWS, Azure, and GCP

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.28.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.28.0

    • Adds oci provider with resources: bucket, compartment, cross_connect, group, instance, subnet, user, vcn, and zone.
    • Adds gcp.notebook resource type for managing Google Cloud Notebooks.
    • Adds aws.ses-email-identity resource type.
    • Adds aws.ses-receipt-rule-set resource type.
    • Adds gcp.datafusion-instance resource type.

    +6 more show less

    • Adds gcp.app-engine-service and gcp.app-engine-service-version resource types.
    • Adds azure.monitor-log-profile resource type.
    • Adds gcp.bigtable-instance, gcp.bigtable-instance-cluster, gcp.bigtable-instance-table, and gcp.bigtable-instance-cluster-backup resource types.
    • Adds _run_command timeout parameter to the Azure session CLI for controlling execution duration.
    • Adds config-compliance filter to aws.iam-certificate, aws.iam-saml-provider, and aws.prefix-list resources.
    • Adds metrics filter to aws.vpc-endpoint and aws.transit-attachment resources.

    11 details in Everything

26. 0.9.27.0 May 25, 2023 · release notes

    New resource types across AWS, Azure, and GCP plus custom JMESPath functions in c7n core.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.27.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.27.0

    • Adds aws.fis-experiment resource type for Fault Injection Simulator experiments
    • Adds aws.pinpoint-app resource type for Amazon Pinpoint applications
    • Adds aws.ses-configuration-set resource type for SES Configuration Sets
    • Adds aws.eks associate-encryption-config action to enable KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. encryption for EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. clusters
    • Adds aws.lambda has-specific-managed-policy filter to check attached policies

    +17 more show less

    • Adds aws.fsx consecutive-aws-backups filter for FSx resources
    • Adds aws.rds consecutive-aws-backups filter for RDS instances
    • Adds aws.rds-cluster consecutive-aws-backups filter for RDS clusters
    • Adds aws.subnet ip-address-usage filter to analyze subnet IP utilization
    • Adds azure.cdn-custom-domain resource type for Azure CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. custom domains
    • Adds azure.cdn-endpoint resource type for Azure CDN endpoints
    • Adds azure.mariadb resource type for Azure Database for MariaDB
    • Adds azure.open-shift resource type for Azure OpenShift
    • Adds azure.servicebus-namespace resource type for Service Bus namespaces
    • Adds azure.servicebus-namespace-authrules resource type for Service Bus authorization rules
    • Adds azure.spring-app and azure.spring-service-instance resource types
    • Adds gcp.artifact-repository resource type for Artifact Registry repositories
    • Adds gcp.compute-project resource type for GCP compute projects
    • Adds gcp.region pseudo-resource type for region-level queries
    • Adds recommend filter to multiple GCP resources (Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity., Disk, Function, GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. Cluster, Image, Instance, Project, Service Account, SQL Instance)
    • Enables adding custom functions to JMESPath queries via core extension points
    • Allows passing function parameters from the CLI entry point to policy functions

    22 details in Everything

27. 0.9.26.0 Apr 12, 2023 · release notes

    Cloud Custodian 0.9.26.0 adds policy statement filter to vpc-endpoint resources.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.26.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.26.0

    └──▷ USE IT
    Example configuration using the new policy-statement filter in a Custodian policy.
    yaml copy

    resources:
      - aws.vpc-endpoint
    filters:
      - type: policy-statement
        StatementId: "AllowPublicAccess"

28. 0.9.25.0 Apr 11, 2023 · release notes

    Cloud Custodian 0.9.25.0 adds GCP Secret/Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity. resources, c7n-left policy testing, and new filters/actions across AWS/Azure/GCP.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.25.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.25.0

    • Adds gcp.secret resource type to scan GCP Secrets Manager secrets
    • Adds gcp.cloud-run-service and gcp.cloud-run-job resource types for Cloud Run management
    • Adds c7n-left docker image for isolated policy execution environments
    • Adds force option to aws.ecs-task-definition delete action for permanent removal
    • Adds safety-rule filter to aws.recovery-control-panel resource

    +9 more show less

    • Adds list-item core filter for iterating over list-valued attributes in policies
    • Adds jmespath as a value_path option in c7n.filters.value to supply JMESPath expressions
    • Adds topic filter to aws.sns-subscription resource
    • Adds flow-logs filter to azure.networksecuritygroup resource
    • Adds diagnostic-settings filter to azure.subscription resource
    • Adds access-approval filter to gcp.project resource
    • Adds essential-contacts filter to gcp.organization resource
    • Adds iam-policy filter to gcp.service-account resource
    • Adds used filter to tencentcloud.security-group resource

    14 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !aws.kinesis-video no longer supports the mark, unmark, untag actions or tag-count filter
29. 0.9.24.0 Mar 16, 2023 · release notes

    Cloud Custodian 0.9.24.0 adds new AWS resources, filters, actions, and c7n-mailer replay integrations.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.24.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.24.0

    • enable-auditlog action for aws.elasticsearch to forward audit logs to CloudWatch
    • network-location filter for aws.efs-mount-target and aws.eks resources
    • lambda-edge filter for aws.lambda resources
    • c7n-mailer replay now supports Slack notifications and SQS event source emulation

    4 details in Everything

30. 0.9.23.0 Feb 16, 2023 · release notes

    Adds EMR Serverless App resource support with tag/mark actions; GCP missing filter for logs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.23.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.23.0

    • aws.emr-serverless-app resource type added with delete, tag, and mark actions (PR #8197)
    • Policy vars are now supported in conditions (policy.load / core), enabling dynamic policy logic (PR #8014)
    • AWS CloudWatch Logs filter now supports passing a role ARN to the put-subscription-filter call via a new attribute (PR #8246)
    • GCP log-project-metric resource adds a metric alert filter for monitoring log-based metrics (PR #8155)
    • aws.timestream-table and aws.timestream-database resource types added (PR #8159)

    +3 more show less

    • AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. User resource gains the set-policy action to update managed policies (PR #8125)
    • AWS Secrets Manager resource adds a set-encryption action (PR #8168)
    • GCP filters now enable the missing filter capability (PR #8234)

    8 details in Everything

31. 0.9.22.0 Jan 18, 2023 · release notes

    Cloud Custodian 0.9.22.0 adds many new AWS Config Connector resources, c7n-org org-level vars, and Azure Defender Alerts support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.22.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.22.0

    • c7n-org supports org level vars in config file (#8033)
    • Adds azure.defender-alert resource type
    • Adds awscc.accessanalyzer_analyzer, awscc.acmpca_certificateauthority, awscc.amplify_app, awscc.apigateway_stage, awscc.backup_backupvault, and dozens more AWS Config Connector resources (full list in release notes)
    • Adds readiness-check resource for AWS (#8112)

    4 details in Everything

32. 0.9.21.0 Dec 15, 2022 · release notes

    Cloud Custodian 0.9.21.0 adds aws.transfer resources, c7n-org not-accounts option, and new filters/actions for AWS/Azure/Tencent resources.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.21.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.21.0

    └──▷ TRY IT
    Scan newly added AWS Transfer resources for misconfigurations.
    copy

    $ custodian run -s output/ policy.yaml
    # inside policy.yaml:
    resources: aws.transfer-server

    Run policies on all accounts except specific ones using c7n-org.
    copy

    $ c7n-org run --profile default -s out/ --not-accounts account-to-skip account-to-skip2 -u policy.yml

    • aws.transfer-server and aws.transfer-user resources added
    • configuration-parameter filter for azure.postgresql-server
    • auditing filter for azure.sql-server
    • blob-services filter for azure.storage
    • authentication filter for azure.webapp

    +6 more show less

    • logging filter for aws.wafv2
    • has-statement filter for aws.efs and aws.secrets-manager
    • set-rule-state action for aws.event-rule
    • consecutive-backups filter for aws.dynamodb-table, aws.efs, aws.redshift
    • auto-tag-user, copy-related-tag, mark-for-op, remove-tag, tag actions for aws.glue-connection
    • set-role action for aws.iam-profile

    11 details in Everything

33. 0.9.20.0 Oct 26, 2022 · release notes

    Cloud Custodian 0.9.20.0 adds RDS Proxy and API GWv2 resources, c7n-left JSON output, and Kubernetes admission mode.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.20.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.20.0

    └──▷ USE IT
    Run policy checks on Terraform infrastructure using the new c7n-left shift-left capabilities with JSON output including resource names.
    shell copy

    c7n-left --config terraform_plan.json --policy terraform_policy.yml --output-format json

    Deploy Cloud Custodian Kubernetes admission controller to enforce policies on new pod submissions.
    shell copy

    helm install c7n-kates cloud-custodian/c7n-kates --set mode=k8s-admission

    • aws.apigwv2 resource is now available for managing API Gateway v2 resources
    • aws.graphql-api resource added for GraphQL API management
    • aws.rds-proxy resource support for RDS Proxy instances
    • c7n_kube mode/k8s-admission adds admission controller mode for Kubernetes policy enforcement
    • Add role and cluster-role resources to c7n_kube for Kubernetes RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. management

    +6 more show less

    • tools/c7n-left updates JSON output to include resource names and JMESPath query results
    • tools/c7n-left exits with code 1 when resources match policies in shift-left checks
    • Add login-profile filter to aws.iam-user for filtering users by login status
    • Add put-subscription-filter action to aws.log-group for CloudWatch log configuration
    • Update TLS endpoint config action for aws.elasticsearch
    • c7n-org now supports variables in run-script arguments

    11 details in Everything

34. 0.9.19.0 Oct 5, 2022 · release notes

    New AWS resources (catalog-product, datalake-location, awscc providers), TencentCloud support, and CCL directory loader

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.19.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.19.0

    • Adds aws.catalog-product resource to Cloud Custodian policy schemas for filtering AWS Service Catalog products.
    • Adds aws.datalake-location resource with new deregister action and cross-account filter capabilities.
    • Introduces tencentcloud as a supported cloud provider with cvm resource support.
    • Adds awscc.* resources covering AWS Config Cloud Control schema types (e.g., accessanalyzer_analyzer, apigateway_*).
    • Adds set-xray-tracing action to the aws.lambda policy engine.

    +1 more show less

    • Adds metrics filter for Amazon ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. resources.

    6 details in Everything

35. 0.9.18.0 Aug 11, 2022 · release notes

    Adds aws.connect-instance resource, json-diff and has-statement filters, GCP set-labels action, and new env var for GCP projects.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.18.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.18.0

    └──▷ USE IT
    Set the GCP project without modifying policy files
    shell copy

    GCP_PROJECT=my-project c7n-schema -r gcp.sql-instance

    • GCP_PROJECT environment variable is now supported to configure the GCP project ID
    • aws.connect-instance resource type is added with instance-attribute filter
    • gcp.sql-instance gains set-labels action and marked-for-op filter
    • json-diff filter added to aws.batch-compute, aws.batch-queue, aws.kafka, aws.sagemaker-model, aws.step-machine, and aws.workspaces
    • has-statement filter added to aws.sns and aws.sqs resources

    +3 more show less

    • waf-enabled filter and set-waf action added to aws.rest-stage for API Gateway, CloudFront, and ELB
    • consecutive-backups and subnet filters added to aws.fsx
    • connection-aliases filter added to aws.workspaces-directory

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Using the s3 output for cross-account buckets now requires the GetBucketLocation permission on the target bucket
36. 0.9.17.0 Jun 21, 2022 · release notes

    New FIS template and WAFv2 support across multiple AWS resources in Cloud Custodian

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.17.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.17.0

    • Adds aws.fis-template resource type to manage AWS Fault Injection Simulator templates
    • Adds aws.wafv2 resource type for managing Web Access Control Lists
    • Adds config-compliance filter to aws.account
    • Adds set-wafv2 action and wafv2-enabled filter to aws.app-elb, aws.distribution, and aws.rest-stage
    • Adds enable-https action and domain-options filter to aws.cloudsearch

    +4 more show less

    • Adds set-policy action to aws.iam-group
    • Adds engine filter to aws.rds
    • Adds dead-letter filter to aws.sqs
    • Adds deregister action to aws.workspaces-directory

    9 details in Everything

37. 0.9.16.0 May 10, 2022 · release notes

    Cloud Custodian 0.9.16 adds support for AWS Traffic Mirror resources, Azure Defender, and new filters/actions for RDS, ElastiCache, and Glue.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.16.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.16.0

    • Adds aws.mirror-session resource type for managing AWS Traffic Mirror sessions
    • Adds aws.mirror-target resource type for managing AWS Traffic Mirror targets
    • Adds cross-cluster filter for aws.elasticsearch resources
    • Adds toggle-metrics action for aws.glue-job resources
    • Adds consecutive-snapshots filter for aws.rds and aws.rds-cluster resources

    5 details in Everything

38. 0.9.15.0 Feb 24, 2022 · release notes

    Cloud Custodian 0.9.15.0 adds AWS Cloud Control Provider (awscc), new resources/actions, and c7n_mailer service-quota formatting

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.15.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.15.0

    └──▷ USE IT
    Configure a policy to use the new modify-ecr-policy action on ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. repositories.
    config copy

    resources:
      - aws.ecr
    actions:
      - type: modify-ecr-policy
        policy: <new-policy-document>

    • Adds awscc experimental cloud control provider supporting hundreds of new resource types like awscc.apigateway_domainname, awscc.backup_backupplan, and awscc.cloudformation_stackset
    • Adds modify-ecr-policy action for the aws.ecr resource to programmatically modify ECR repository policy statements
    • Adds config-compliance filter for aws.artifact-domain and json-diff filter for aws.codedeploy-app, aws.codedeploy-group, aws.kinesis, and aws.transit-gateway
    • Adds subnet filter for aws.ecs-container-instance resource to filter by subnet ID
    • Adds ownership filter for aws.s3 resources to check bucket ownership controls

    +6 more show less

    • Adds offhour and onhour filters for aws.sagemaker-notebook resources
    • Adds modify action for aws.subnet resources to modify subnet attributes
    • Adds delete action for gcp.bq-table resources
    • Adds apigw-domain-name resource for API Gateway custom domains
    • Adds ecr-image child resource type for ECR repositories
    • Updates c7n_mailer to add formatting support for service-quota reports

    11 details in Everything

39. 0.9.14.0 Nov 16, 2021 · release notes

    Adds aws.airflow, aws.s3-access-point, azure.advisor-recommendation resources and json-diff filter to multiple AWS resource types.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.14.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.14.0

    • Adds aws.airflow resource type for Apache AirflowApache AirflowAn open-source workflow orchestration platform maintained by the Apache Software Foundation that lets developers schedule, monitor, and chain tasks as directed acyclic graphs, making it useful for automating data pipelines. environment management
    • Adds aws.prefix-list resource type for VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. prefix list discovery
    • Adds aws.s3-access-point and aws.s3-access-point-multi resource types for S3 Access Point management
    • Adds azure.advisor-recommendation resource type for Azure Advisor insights
    • Adds json-diff filter to aws.backup-plan, aws.backup-vault, aws.ecr, aws.ecs, and aws.efs resources

    +1 more show less

    • Adds subscription-filter filter to aws.log-group resources

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !AWS Lambda policy updates may fail if not upgraded before Dec 6, 2021 due to AWS behavior change in lambda provisioning
40. 0.9.13.0 Aug 10, 2021 · release notes

    Adds aws.ssm-data-sync resource, gcp.sql-instance start action, and c7n-policystream policy glob support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.13.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.13.0

    • Adds aws.service-quota, aws.service-quota-request, and aws.ec2-spot-fleet-request resources for new quota and spot fleet management policies
    • Adds event-selectors filter to aws.cloudtrail resource to narrow down S3 event processing
    • Adds start action to gcp.sql-instance resource to programmatically start stopped SQL instances
    • Adds resize action to aws.ecs-service and corresponding offhour/onhour filters for automated scaling
    • Adds tagging actions (auto-tag-user, copy-related-tag, tag, remove-tag, mark-for-op) and marked-for-op filter to aws.iam-policy resource

    +4 more show less

    • Allows encryption filter in aws.s3 to match by id, alias, or arn for bucket key options
    • Adds run-script support in tools/c7n-org with automatic AWS_PROFILE/REGION management
    • Supports specifying policy glob on CLI in tools/c7n_policystream via new argument
    • Introduces deprecation framework for policy YAML in core

    9 details in Everything

41. 0.9.12.0 Jun 28, 2021 · release notes

    Cloud Custodian 0.9.12.0 adds support for AWS Network Firewall, EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. Node Groups, Azure App Gateway/Container Registry, and GCP Service Account Keys.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.12.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.12.0

    • Adds aws.network-firewall resource type for policy management
    • Adds aws.eks-nodegroup resource type with delete action
    • Adds azure.application-gateway resource type support
    • Adds azure.container-registry resource type (replacing azure.containerregistry)
    • Adds gcp.service-account-key resource type with enable, disable, and delete actions

    +9 more show less

    • Adds json-diff filter to aws.ecs-service, aws.ecs-task-definition, and aws.eks resources
    • Adds kms-key filter to aws.kafka resources for data-volume encryption checks
    • Adds data-masking-policy and transparent-data-encryption filters to azure.sql-database resources
    • Adds azure-ad-administrators and vulnerability-assessment filters to azure.sql-server resources
    • Adds vm-extensions filter to azure.vm resources
    • Adds metrics and scc-findings filters to GCP resources including gcp.bucket, gcp.bq-table, and others
    • Adds update action to aws.asg resources for setting max lifetime
    • Adds auto-tag-user, copy-related-tag, mark-for-op, remove-tag, and tag actions to aws.alarm resources
    • Adds marked-for-op filter to aws.alarm resources

    14 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !azure.containerregistry resource type has been removed; use azure.container-registry instead
42. 0.9.11.0 Mar 22, 2021 · release notes

    Adds OpenStack provider support, trim-versions action for Lambda, set-permissions for RDS snapshots, and new filters/actions across AWS resources.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.11.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.11.0

    • Adds the openstack provider (alpha) to Cloud Custodian, enabling policy enforcement for OpenStack resources.
    • Adds universal_taggable = True config flag to enable universal tag augmentation via ARN list.
    • Adds config-poll-rule mode that outputs post-evaluation results in chunked format.
    • Adds appflow resource type with tag filters/actions and delete capability for AWS AppFlow.
    • Adds arn resource resolver to help resolve cross-account or cross-region ARNs within policies.

    +10 more show less

    • Adds scaling-policy filter and resource support for AWS Auto Scaling Groups (aws.asg).
    • Adds kms-key filter to CloudWatch log groups (aws.log-group).
    • Adds subnet filter for ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. tasks (aws.ecs-task) and ECS services (aws.ecs-service).
    • Adds trim-versions action for AWS Lambda functions to garbage collect old versions.
    • Adds kms-key filter for Amazon MQ message brokers (aws.message-broker).
    • Adds delete action and force options/filters for Event Bridge rules (aws.event-rule).
    • Adds kms-alias filter for RDS clusters (aws.rds-cluster), kms-key filter for Workspaces, and volume filter for EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. snapshots.
    • Adds set-permissions action for RDS snapshot resources (aws.rds-snapshot) and RDS cluster snapshots (aws.rds-cluster-snapshot).
    • Adds delete and modify actions for GCP firewall rules (gcp.firewall), plus cost/metric/offhour/onhour/policy-compliant/resource-lock filters for Azure storage containers.
    • Removes azure.keyvault-storage resource type due to SDK incompatibility.

    15 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !azure.keyvault-storage resource type is removed and will no longer be recognized by policies.
43. 0.9.10.0 Jan 11, 2021 · release notes

    Cloud Custodian 0.9.10.0 adds aws.event-bus and aws.rest-client-certificate resources with new filters/actions for AWS Config, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access., and GCP PubSub.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.10.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.10.0

    • schema changes adds the aws.event-bus resource type for querying AWS EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure. event buses
    • schema changes adds the aws.rest-client-certificate resource type for managing REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. client certificates
    • schema changes adds the cross-account filter to aws.config-recorder resources
    • schema changes adds the delete-inline-policies action to aws.iam-group resources
    • schema changes adds the ssh-key filter to aws.iam-user resources

    +3 more show less

    • schema changes adds the delete-ssh-keys action to aws.iam-user resources
    • schema changes adds the client-certificate filter to aws.rest-stage resources
    • schema changes adds the json-diff filter to aws.secrets-manager resources

    8 details in Everything

44. 0.9.9.0 Dec 14, 2020 · release notes

    Cloud Custodian 0.9.9.0 adds new filters and actions for AWS resources plus arbitrary email headers support in c7n-mailer.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.9.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.9.0

    └──▷ USE IT
    Configure c7n-mailer to inject custom headers into sent emails.
    config copy

    mailer:
      transport:
        type: smtp
        host: smtp.example.com
        port: 587
      email_headers:
        X-Custom-Header: 'custodian-automation'
        X-Sender-ID: 'policy-runner'

    • Adds check-macie filter to aws.account resource type to detect missing Macie2 filtering.
    • Adds modify-attributes action to aws.app-elb resource type.
    • Adds set-permissions action to aws.ebs-snapshot resource type.
    • Adds remove-statements action and cross-account filter to aws.elasticsearch resource type.
    • Adds delete action to aws.iam-certificate resource type.

    +1 more show less

    • Adds arbitrary email header support in c7n-mailer configuration.

    6 details in Everything

45. 0.9.8.0 Nov 17, 2020 · release notes

    Cloud Custodian 0.9.8 adds new AWS/Azure/GCP resources and actions including AWS Batch Queue support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.8.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.8.0

    • Adds aws.batch-queue resource type for managing AWS Batch queues
    • Adds aws.iam-oidc-provider and aws.iam-saml-provider resource types for IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.
    • Adds azure.vm resize action via the resize key in policy actions
    • Adds gcp.instance create-machine-image action via the create-machine-image key in policy actions
    • Adds gcp.project delete, mark-for-op, propagate-labels, and set-labels actions

    5 details in Everything

46. 0.9.7.0 Oct 15, 2020 · release notes

    Cloud Custodian 0.9.7.0 adds support for AWS CodeArtifact, EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. Dedicated Hosts, CloudWatch Contributor Insights, and GCP DNS/GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. delete actions

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.7.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.7.0

    └──▷ USE IT
    Automate deletion of GKE clusters that no longer have an owner tag.
    config copy

    - policy:
      name: delete-orphan-gke
      resource: gcp.gke-cluster
      filters:
        - "tag:Environment": absent
      actions:
        - type: delete

    • Adds aws.codeartifact-repository resource and aws.codeartifact-domain resource to scan AWS CodeArtifact assets
    • Adds aws.ec2-host resource for managing EC2 Dedicated Hosts
    • Adds aws.insight-rule resource for CloudWatch Contributor Insight rules
    • Adds access-analyzer filter to aws.account resource
    • Adds kms-key filter to aws.elasticsearch resource

    +8 more show less

    • Adds metrics filter to aws.nat-gateway resource
    • Adds vpc-endpoint filter to aws.vpc and aws.subnet resources
    • Adds delete action to aws.hostedzone, aws.iam-group, gcp.dns-managed-zone, and gcp.gke-cluster resources
    • Adds auto-tag-user, copy-related-tag, mark-for-op, remove-tag, and tag actions to aws.redshift-subnet-group resource
    • Adds tagging support for aws.redshift-subnet-group, aws.directory, and aws.cloudhsm-cluster resources
    • Adds delete action with cross-account support to aws.service-catalog-portfolio resource
    • Adds exclude argument metavar updates to the metrics CLI help
    • Enables value_from filter enhancement using sets for performance improvement on large lists

    13 details in Everything

47. 0.9.6.0 Sep 4, 2020 · release notes

    Cloud Custodian 0.9.6.0 adds config_rule support for the c7n-org policylambda tool.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.6.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.6.0

48. 0.9.5.0 Aug 25, 2020 · release notes

    Cloud Custodian 0.9.5 adds metadata key, value_from condition filter, and ASG image data filtering

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.5.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.5.0

    └──▷ HOW TO FIND IT
    Attach metadata tags like owner or cost-center to your policy output for better tracking and auditing in Cloud Custodian reports.
    📍c7n run -s output/ policy.yaml
    Use a variable or lookup value in a policy condition instead of hardcoding values, enabling dynamic filter logic.
    📍c7n run -s output/ policy_with_value_from.yaml
    Simplify time-based filters by using plain integers for days/hours in your policy configuration, reducing verbosity.
    📍c7n run -s output/ policy_with_int_days.yaml
    • Adds metadata key to policy definitions for attaching custom metadata fields
    • Enables value_from in policy conditions to pull filter values from external sources or variables
    • Supports integer numbers directly as days and hours in time-based filters (e.g., days: 30 instead of datetime.timedelta(days=30))

    3 details in Everything

49. 0.9.4.0 Jul 7, 2020 · release notes

    Adds EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. set-metadata-access action, Azure function app policy filters for client certs and HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate.-only, GCP get-permissions query, and configurable Splunk sourcetype in c7n_mailer.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.4.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.4.0

    └──▷ USE IT
    Configure c7n_mailer to use a custom Splunk sourcetype.
    config copy

    # In c7n-mailer config.yaml:
    splunk:
      sourcetype: 'custom_custodian_logs'

    Query GCP resource permissions using the new get-permissions feature.
    copy

    $ c7n-gcp get-permissions --project my-project --type compute/instance

    • Add ec2:set-metadata-access action to modify instance metadata options
    • Add access analyzer finding filter capability
    • Add account basic filter to check Security Hub enablement
    • Add ELB and ELBv2 attributes filters for load balancer inspection
    • Add EMR subnet and security group filters

    +7 more show less

    • Add Shield filter/action for CloudFront streaming distribution
    • Add KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. key alias auto-fetching capability
    • Add Azure function app policy filters for client certificates and HTTPS-only enforcement
    • Add GCP blob and log native outputs for audit trails
    • Add get-permissions query in GCP provider
    • Add JSON schema mapping types in core validation logic
    • Make Splunk sourcetype configurable in c7n_mailer

    12 details in Everything

50. 0.9.3.0 Jun 9, 2020 · release notes

    Cloud Custodian 0.9.3 adds GCP asset inventory, Glue catalog and streaming distribution actions, SSM delete action, and ASG tag propagation skip

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.3.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.3.0

    • aws-glue-catalog now supports the remove-statements action.
    • aws-streaming-distribution resources support the set-attributes action and the config filter.
    • aws-ssm-parameter resources support the delete action.
    • aws-asg propagate tags actions (tag-propagation, update-tags) now skip the API call if the Auto Scaling Group has no instances.
    • gcp-asset-inventory source is available to list GCP assets using Cloud Asset Inventory.

    +1 more show less

    • gcp-functions policies now use the standard policy loader for initialization.

    6 details in Everything

51. 0.9.2.0 May 21, 2020 · release notes

    Cloud Custodian 0.9.2.0 adds EMR filtering, Redshift actions, Glue Catalog filters, and schema CLI improvements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.2.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.2.0

    └──▷ TRY IT
    Generate schema with outlines for better readability using the new CLI flag.
    copy

    $ c7n-schema --outline > schema.json

    • Adds account-emr:public-access filter and action for AWS to block or allow public access in EMR clusters
    • Adds cloudformation resource types via the add cfn types feature
    • Adds redshift:set-attributes action for AWS Redshift clusters
    • Adds config-poll-rule mode for AWS Config evaluation
    • Adds codecommit-tags filter and delete action for AWS CodeCommit repositories

    +9 more show less

    • Adds cwe-event-rule-tagging support for EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure. event rules
    • Adds dynamodb-continuous-backups filter and action for DynamoDB tables
    • Adds ec2-snapshot-create-tags mapping to EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. snapshot creation actions
    • Adds public IP inclusion to Security Hub findings via securityhub-post-finding enhancement
    • Adds s3-event-based-policy-creationdate support for S3 event configurations
    • Adds vpc-unused-key-pair filter and delete action for AWS VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware.
    • Adds boolean filter support for glue-catalog resources with schema cleanup
    • Adds --outline option to the c7n-schema CLI command
    • Enables c7n-mailer to replay events via a new entrypoint and supports SQS VPC endpoints

    14 details in Everything

52. 0.9.1.0 Apr 28, 2020 · release notes

    Cloud Custodian 0.9.1 adds dry-run alias, lazy loading, new AWS resources (Backup Vault, QLDB), and Azure Function remote builds. Breaking: Python 2.7 dropped; metrics/logs CLI removed.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.1.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.9.1.0

    • Adds --dry-run as an alias for the existing -dryrun flag in the c7n run command
    • Enables lazy loading by default, reducing CLI and serverless cold start latency
    • Adds support for new AWS resources: backup-vault, qldb, glue-catalog, dms-endpoint, directconnect, emr security-configuration
    • Adds set-inventory action for S3 with support for additional optional fields (format)
    • Adds modify-policy action for SQS resources

    +4 more show less

    • Adds delete-log-sinks and detach-disks actions for GCP instances
    • Adds Azure Functions support for remote builds
    • Drops Python 2.7 compatibility
    • Removes the metrics and logs CLI commands

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The c7n metrics CLI command has been removed
    • !The c7n logs CLI command has been removed
53. 0.8.46.0 Jan 27, 2020 · release notes

    Cloud Custodian 0.8.46.0 adds ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. immutability/scanning actions, multi-policy/ resource CLI args, Azure Search support, and GCP IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policy actions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.46.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.46.0

    • Adds set-immutable and set-scanning actions for the aws.ecr resource
    • Adds --policies and --resource arguments to c7n run to accept multiple values
    • Adds set-iam-policy action for GCP resource manager resources
    • Adds disk snapshot user formatting of name in GCP provider
    • Adds delete option for GCP pubsub subscriptions, topics, and snapshots

    +4 more show less

    • Adds set-monitoring action for EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instances
    • Adds add azure resource graph as a query provider for Azure
    • Adds gcp - label/tagging actions/filters support
    • Adds value filter add a version value type in core structure parsing

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !SSM Ops Center dedupe size is restricted per breaking API change
    • !STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets. regional endpoints are off by default
54. 0.8.45.0 Sep 23, 2019 · release notes

    Cloud Custodian 0.8.45 introduces new Azure resource support (ACI, Cosmos, KeyVault), AWS security hub event mode, and configurable logging sinks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.45.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.45.0

    • aws.securityhub now supports event mode for detecting Security Hub findings via CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. events
    • azure.aci adds container instance resource type with associated actions and filters
    • azure.cosmosdb introduces Cosmos DB resource types (accounts, databases, containers) with throughput state support
    • azure.keyvault.certificate adds KeyVault certificate resource with integration actions
    • logging supports configurable account, region log sinks and stream names via policy config

    +1 more show less

    • c7n-mailer action supports proxy configuration via proxy parameter

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Boolean filter blocks (or, and, not) are now validated recursively, which may cause validation errors for invalid policies that previously passed
55. 0.8.44.0 Jun 18, 2019 · release notes

    New webhook action, EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. resource support, Glue job/endpoint resources, and SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. delivery for Azure mailer

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.44.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.44.0

    • Adds the webhook action to trigger external HTTP callbacks from policy execution.
    • Adds support for AWS Glue Job resources (glue_job) and the new glue-dev-endpoint resource type with tagging capabilities.
    • Introduces SMTP transport support for Azure mailer via the c7n-mailer configuration, enabling email delivery to on-prem or custom SMTP servers.
    • Adds value_type: date option to value filters to enable date-typed data extraction and comparison.
    • Enables regex-based value extraction in value filters using the new regex sub-key.

    +1 more show less

    • Adds BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. tables resource (bigquery_table) for GCP, allowing policies to target specific table-level configurations.

    6 details in Everything

56. 0.8.43.0 Apr 13, 2019 · release notes

    Cloud Custodian 0.8.43.0 adds Azure resource types, GCP Spanner/Network Router, and report JSON output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.43.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.43.0

    • Adds packaging fixes for Azure function dep in the azure module
    • Adds new BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. job and project resources in the gcp module #3747
    • Adds IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. global role resource support in the gcp module #3749
    • Adds Pub/Sub snapshot and subscriber resource support in the gcp module #3735
    • Adds DataFlow jobs resource support in the gcp module #3748

    +18 more show less

    • Adds Zone and policy resources support in the gcp module #3748
    • Adds Spanner resource support in the gcp module #3766
    • Adds Network Router resource support in the gcp module #3791
    • Adds Load-Balancer associated resource support in the gcp module #3775 #3780 #3788
    • Adds support for custom resources definitions in the k8s module #3717
    • Adds generic label and delete actions in the k8s module #3707
    • Adds report subcommand compatibility via id on metadata #3697
    • Adds IAM role support for tags actions/filters in the aws module #3542
    • Adds EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. support updating configuration #3708 #3769
    • Adds VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. related filters for subnets, nat, igw in the aws module #3715
    • Adds RDS modify cluster action in the aws module #3711
    • Adds EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. unused filter in the aws module #3651
    • Adds Lambda policies allow role by name support in the aws module #3661
    • Adds S3 has statements interpolate bucket info when checking statements #3655
    • Adds invoke-lambda action configurable timeouts #3632
    • Adds KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. key filter for EFS, Redshift, SQS in the aws module #3772
    • Adds IAM role delete action in the aws module #3741
    • Report supports JSON output format #3692

    23 details in Everything

57. 0.8.42.0 Mar 4, 2019 · release notes

    Cloud Custodian 0.8.42.0 adds LightSail support, GCP notify action, and new IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access./EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware./Lambda permission filters.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.42.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.42.0

    • Adds light_sail resource type support for DB instances, load balancers, and instances
    • Adds iam-permission-checker filter for IAM roles
    • Adds ec2-permission-checker and lambda-permission-checker filters
    • Adds ami-deregister action option to remove associated snapshots via remove_snapshots key

    4 details in Everything

58. 0.8.41.0 Feb 18, 2019 · release notes

    Cloud Custodian 0.8.41 adds Managed Kafka resource, AWS GovCloud partition awareness, and c7n_mailer Slack/CC support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.41.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.41.0

    • Adds ManagedKafka resource type for managing Apache Kafka clusters on AWS.
    • Enables proper ARN handling in AWS GovCloud and China partitions (aws region logic updated).
    • Adds copy-related-tag action to copy tags from related resources.
    • Adds support for Windows client upload of serverless policies in Azure tooling.

    4 details in Everything

59. 0.8.40.0 Jan 31, 2019 · release notes

    Cloud Custodian 0.8.40 adds Transit GatewayTransit GatewayAn AWS-managed network hub that connects VPCs and on-premises networks through a single gateway, replacing complex peering meshes and giving cyber tools a central point to route or inspect cross-network traffic. support, new AWS SSMAWS SSMAWS Systems Manager, an Amazon service that lets operators manage EC2 instances and on-premises servers without opening inbound ports, replacing SSH with API-driven session and command execution. send-command action, and Azure Container Registry resource.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.40.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.40.0

    • Adds transit-gateway resource type for AWS
    • Adds ssm:send-command action for EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. management
    • Adds periodic serverless policy support in GCP

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Lambda policies now default to python 3.7 runtime instead of previous defaults
60. 0.8.33.0 Jan 1, 2019 · release notes

    Cloud Custodian 0.8.33.0 adds DLM, FSx backup, Lambda layer resource, periodic GCP serverless policies and MSI auth

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.33.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.33.0

    • Adds dlm policy resource for AWS Data Lifecycle Manager
    • Adds aws.fsx resource with update, tag, and backup actions
    • Adds aws.lambda-layer resource with cross-account filter and remove-statements action
    • Adds aws.vpce cross-account filter
    • Adds aws.iam.role set-policy action for adding or removing policies

    +13 more show less

    • Adds aws.sns KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. filter and set encryption action
    • Adds aws.rds modify-db action
    • Adds aws.firehose S3 destination encryption setting on delivery streams
    • Adds aws.route53 filter and action to set DNS query logging
    • Adds aws.log-group set-encryption action
    • Adds aws.ecr lifecycle policy filter and set action
    • Adds aws.account S3 public access blocks filter and action
    • Adds aws.cloudhsm v2 cluster resource with tag augment and actions
    • Adds periodic serverless policy support for GCP
    • Adds gcp.serviceaccount and gcp.projectrole resources
    • Adds gcp.bigquery.dataset resource
    • Adds gcp.instance value filter on tag/label, onhours/offhours filters and start action
    • Adds MSI authentication support for Azure

    18 details in Everything

61. 0.8.31.0 Sep 12, 2018 · release notes

    Cloud Custodian 0.8.31.0 adds ssm-parameter resource, s3 blob output mode, and policystream for policy delta streaming

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.31.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.31.0

    • Adds ssm-parameter resource type for managing AWS SSMAWS SSMAWS Systems Manager, an Amazon service that lets operators manage EC2 instances and on-premises servers without opening inbound ports, replacing SSH with API-driven session and command execution. parameters via policies.
    • Adds support for max-resources-percent to limit resource consumption by percentage of total account inventory.
    • Introduces global variable interpolation across policies for shared configuration.
    • Adds new policystream tool to convert a git repo's policy commit history into a delta stream.

    4 details in Everything

62. 0.8.30.0 Aug 12, 2018 · release notes

    First Azure and GCP provider support with core value filter enhancements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.30.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.30.0

    • Adds azure.appserviceplan, azure.armresource, azure.cosmosdb, azure.keyvault, azure.loadbalancer, azure.networkinterface, azure.networksecuritygroup, azure.publicip, azure.resourcegroup, azure.roleassignment, azure.roledefinition, azure.sqlserver, azure.storage, azure.vm, azure.vnet, and azure.webapp resources
    • Adds basic GCP provider support with a handful of resources
    • Adds c7n schema multiple cloud provider support via the c7n schema command
    • Adds set difference operator to value filters
    • Adds unix time stamp date comparisons to value filters

    +37 more show less

    • Adds unique size filter option to value filters
    • Adds json diff filter for resource revision comparison
    • Extends mark-for-op action with hours/minutes duration support
    • Adds sqs set retention period action
    • Adds ecs container instance resource
    • Adds lambda set concurrency action and filter
    • Adds dynamodb set-stream action
    • Adds config rule resource
    • Adds route53 domain tagging support
    • Adds ami copy with encryption support
    • Adds cfn tag actions
    • Adds cfn set-protection action
    • Adds cwe rule target resource and filters & actions
    • Adds vpc peering cross account filter
    • Adds ec2 instance attribute filter
    • Adds iam policy delete action
    • Adds elb use resource/universal tag api
    • Adds sqs use resource/universal tag api
    • Adds vpc/subnet/eni set-flow-log action
    • Adds cloud watch log group tag actions/filters
    • Adds s3 bucket encryption filter and action
    • Adds dms endpoint resource and delete action
    • Adds dynamodb dax resource with filters & actions
    • Adds aws secrets manager resource and filters/actions
    • Adds sns cross account iam filter and modify policy action
    • Adds cloud watch logs cross account filter on destination
    • Adds redshift snapshot cross account filter and revoke access action
    • Adds eip/network-address release action
    • Adds account increase-limit support for min units of increase
    • Outputs cloud watch metrics in utc
    • Adds c7n-org support for external id via the -e flag or config
    • Extends c7n-org to run against gcp and azure providers
    • Allows c7n-org run-script to execute quoted scripts
    • Improves c7n-guardian for enabling and managing guard duty across aws accounts
    • Adds datadog support to c7n-mailer
    • Adds slack support to c7n-mailer
    • Adds omnissm tool for managing hybrid mode rollout of ssm across cloud instances

    42 details in Everything

63. 0.8.28.0 Feb 14, 2018 · release notes

    Cloud Custodian adds SageMaker resource support, GuardDuty integration via c7n_guardian, and multi-cloud provider registry

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.28.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.28.0

    • sagemaker resources with actions and filters available for policy definitions
    • c7n_guardian tool adds Amazon GuardDuty support for centralized security monitoring
    • Multi-cloud provider registry enables running policies against non-AWS cloud providers
    • ecs service, task, and task-definition resource types added with metrics and task-def filter
    • apigw rest-resource, rest-stage, and rest-account resources with corresponding actions

    5 details in Everything

64. 0.8.27.0 Oct 19, 2017 · release notes

    Cloud Custodian 0.8.27.0 adds AWS Shield support, auto-tag-user for all taggable resources, and c7n_org tooling improvements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.27.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.27.0

    • Adds aws-shield resource type and associated filters/actions to detect and manage DDoSDDoSDistributed Denial of Service: an attack that floods a target system with traffic from many sources simultaneously, exhausting its resources so legitimate requests cannot be served. protection.
    • Extends auto-tag-user action to ALL taggable resources, not just the previously supported set.
    • Enables {account_id} interpolation in policy role ARNs (e.g., role: arn:aws:iam::{account_id}:role/CustodianRole) for multi-account execution.
    • Adds value filter intersection support (operator: 'and') to combine multiple value filters in a single condition.
    • Adds s3-encrypt-extant-keys regression fix ensuring AES256 encryption works correctly when KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. is insufficient.

    5 details in Everything

65. 0.8.26.0 Sep 12, 2017 · release notes

    Cloud Custodian 0.8.26.0 adds actions for ALBALBAWS Application Load Balancer, a managed Layer 7 load balancer from Amazon that routes HTTP/HTTPS traffic by host, path, or header, giving tools flexible ingress control without managing their own proxy. logging, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. user keys, ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. statements, and c7n_mailer DLQ config.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.26.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.26.0

    └──▷ USE IT
    Enable S3 logging for ALBs that don't currently have it enabled
    config copy

    actions:
      - type: set-s3-logging
        bucket: my-logs-bucket
        prefix: alb-logs/

    Add a dead letter queue to c7n_mailer to catch failed email deliveries
    config copy

    sqs_url: "https://sqs.us-east-1.amazonaws.com/123456/mymailer"
    dead_letter_queue: "arn:aws:sqs:us-east-1:123456:mymailer-dlq"

    Remove an IAM access key for a specific user using the new action
    config copy

    actions:
      - type: remove-key
        keys_to_remove: "action-required"

    • Adds set-s3-logging action for ALB resources to enable server-side logging to an S3 bucket
    • Adds increase-limit region field support in the resources/account module for AWS service quota requests
    • Adds remove-statement action for ECR repositories to delete policy statements
    • Adds delete action for IAM users and remove key action with date bug fix for unused access keys
    • Adds c7n_mailer.dead_letter_queue config option for handling failed email processing messages

    +1 more show less

    • Adds support for querying third-party owned AMIs and snapshots in EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. resources

    6 details in Everything

66. 0.8.25.0 Aug 12, 2017 · release notes

    Adds c7n_org multi-account execution, S3 deny-augments, RDS parameter group support, and several new filters/actions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.25.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.25.0

    • c7n_org tool provides multi-account policy execution and reporting
    • s3 deny augment tracks denied API calls per bucket in resource data
    • has-statement filter for S3 bucket policies to identify buckets without any statements
    • New RDSClusterParameterGroup resource type with tag filters and actions
    • matched option allows conjunctive listener filtering for app-elb listeners

    +4 more show less

    • ebs-modify action enables modifying EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. volumes while they are online
    • account-cloudtrail action adds support for specifying the S3 bucket region
    • health events filter now supports filtering by region
    • account raise-limit action includes sub-service type and region in output

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The builtin variable name format is renamed to fmt
67. 0.8.24.0 May 15, 2017 · release notes

    Cloud Custodian 0.8.24 adds R53 domain resource, EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. snapshot creation action, and c7n_logexporter tool

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.24.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.24.0

    • Adds r53 domain resource for Route 53 hosted zone management.
    • New action to create EBS snapshots from EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. volumes.
    • Adds tools/c7n_logexporter CloudWatch log group exporter utility.
    • Adds S3 encryption filter to check bucket encryption settings.
    • Implements resize up action for Auto Scaling groups.

    5 details in Everything

68. 0.8.23.1 Mar 1, 2017 · release notes

    Cloud Custodian 0.8.23.1 adds multi-target contact_tags, nacl filters, and IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. credential report support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.23.1 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.23.1

    • contact_tags now accepts multiple notification targets (emails)
    • New column_spec integer support for CSV value lookups
    • Added is-log-target filter for S3 resources
    • Support for checking the current region in check-cloudtrail filters
    • Added cidr filter support for NACLs

    +11 more show less

    • New environment variables to specify Salactus options
    • Added subnet filter for NACL resources
    • Added SES region configuration capability
    • New filter to identify accounts missing password policies
    • Support for the IAM credential report on the account level
    • New default.html mail template option
    • Added cloudwatch-alarm-delete action
    • Added not filter capability
    • Added encrypt-keys support for re-keying when key-id is specified
    • New filters for flow logs (vpc, subnet, eni)
    • Added count ValueType filter

    16 details in Everything

69. 0.8.23.0 Feb 11, 2017 · release notes

    Cloud Custodian 0.8.23.0 adds health-event resource support, --debug to version subcommand, and CLI tab completion

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.23.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.23.0

    └──▷ TRY IT
    Debug environment details without running a full policy execution.
    copy

    $ c7n-cli version --debug

    Apply multiple policy files in a single CLI invocation.
    copy

    $ c7n-cli run -p policies/compliance.yml -p policies/cost-optimization.yml

    • Adds health-event resource with filters and augment support for AWS Health API events
    • Adds filter:metrics attribute percentage calculation for resources supporting metrics queries
    • Adds --debug option to the version subcommand to print system information
    • Enables tab completion via argcomplete on the command line
    • Allows multiple policy files to be specified directly on the command line

    5 details in Everything

70. 0.8.20.0 Nov 2, 2016 · release notes

    Cloud Custodian 0.8.20.0 adds ELB support, new resource types, CSV report custom fields, and various tag/filters/actions

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.20.0 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.20.0

    └──▷ TRY IT
    Generate a CSV report with custom columns including resource type and region.
    copy

    $ c7n-cli run policy.yml --output-dir ./reports --format csv --custom-fields 'type,region'

    • app elb support for CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call.-based resources
    • New ec2 state-transition-age filter for instance lifecycle events
    • Custom fields in CLI CSV reports via new output configuration
    • rds snapshot tag operations (tag/untag) now supported
    • New security-group delete action and used/unused filters

    +12 more show less

    • iam has-users and inline policy value filters for identity management
    • s3 enable-versioning action and new tag-related actions for S3 buckets
    • Network-attached resource filters for security-group and subnet
    • New resource types: kinesis-analytics, firehose, rds-subscription, vpn-connection, vpn-gateway
    • elasticache resources with new filters and actions
    • Redshift tag filters and actions for cluster management
    • Value filters can now retrieve data from URLs and S3 in multiple formats
    • Policies themselves can now be tagged via CloudFormation
    • cidr-match and cidr-size comparisons added to value filters
    • Auto Scaling Group capacity-delta filter and resize actions
    • ELB with-instance filter for load balancer targeting
    • ami launch-permission removal action for AMI management

    17 details in Everything

71. 0.8.19 Aug 30, 2016 · release notes

    Cloud Custodian 0.8.19 adds AWS Config rule execution, EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. tag actions/filters, and S3 bucket deletion

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.19 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.19

    └──▷ HOW TO FIND IT
    Execute a custodian policy as a custom AWS Config rule directly from your configuration.
    📍custodian run -s output/ my-config-rule-policy.yml --run-as-aws-config
    • Adds support for executing custodian policies as custom AWS Config rules with integrated provisioning.
    • Extends generic EC2 resource support to include tag actions and filters.
    • Adds s3.delete_bucket action to delete an S3 bucket and its contents.

    3 details in Everything

72. 0.8.18 Aug 15, 2016 · release notes

    Cloud Custodian 0.8.18 adds account resource, Aurora support, KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. filters, and on-hours scheduling

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.18 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.18

    • Adds account as a manageable resource type with filters for root MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., service limits, CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions., and Config status
    • Adds aurora resource support with corresponding filter and action schemas
    • Adds OnlyPorts and Ports value filters for security group permission checks
    • Adds kms_alias filter for EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. and RDS resources to verify customer master key status
    • Adds KMS key rotation status filter capability

    +4 more show less

    • Adds log_group resource support with retention setting and deletion actions
    • Adds rds_tag_trim action for cleaning up Amazon RDS resource tags
    • Adds instance resizing capability via policy actions
    • Adds value_type constraint to the expiration filter configuration

    9 details in Everything

73. 0.8.17 Jul 25, 2016 · release notes

    Adds region-specific policies with max-resources limit, new SG/ENI/IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. filters/actions, and value_type filter conversions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.17 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.17

    • Policies can now be region specific (for global resources support) and support a max-resources attribute as a safety measure
    • Adds security group permission filtering (ingress, egress) and actions (remove-permissions)
    • Adds network interface filters (subnet, security group) and actions (remove-security-group)
    • Adds iam user filters (mfa-device, access-key, managed-policy) and actions (remove-access-keys)
    • value_type parameter on value filter allows conversion of parameters, and supports age, expiration, size, integer, etc.

    +1 more show less

    • Adds ebs snapshot formatter for reports

    6 details in Everything

74. 0.8.16 Jun 27, 2016 · release notes

    Cloud Custodian 0.8.16 adds metric filters, cross-account IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. checks, custom Lambda actions, EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. snapshot copy, and RDS auto-patch.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.16 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.16

    • ec2copy-encrypted-snapshot action to copy encrypted EBS snapshots across regions
    • rds-auto-patch action to enable minor version maintenance on RDS instances
    • Custom lambda actions via the ability to extend Custodian with user-defined Lambda functions as actions
    • Cross-account access filters for any resource supporting an IAM access policy
    • cloudwatch-metric-filters for all supported resources to identify unused infrastructure

    5 details in Everything

75. 0.8.15 Jun 17, 2016 · release notes

    Cloud Custodian 0.8.15 adds support for Lambda, API Gateway, RDS snapshots, and log group filters/actions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.15 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.15

    • Adds lambda, api-gateway, kinesis-log-group, firehose and rds-snapshot resource types to policy definitions
    • Adds is-invalid filter for autoscaling:autoscaling-group to detect structurally invalid configurations
    • Adds last-write-filter for cloudwatch-log-group to identify groups based on their last write timestamp
    • Adds the delete action for cloudwatch-log-group resources
    • Adds the metrics-retrieval script at tools/policymetrics.py

    5 details in Everything

76. v0.8.13 Jun 6, 2016 · release notes

    Adds version CLI subcommand and ELB SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination.-policy annotation in Cloud Custodian v0.8.13

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.13 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout v0.8.13

    • ELB ssl-policy check now annotates resources with the specific protocol and settings that triggered a match.

    1 detail in Everything

77. 0.8.11 May 22, 2016 · release notes

    Cloud Custodian 0.8.11 adds marked-for-op to RDS/ELB, policy tags, config vars, S3 multipart support, and schema enforcement.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.11 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.11

    • Adds marked-for-op support for RDS resources
    • Adds marked-for-op support for ELB resources
    • Adds support for tagging policies with tags field for classification and grouping
    • Adds vars section to config files to allow YAML references to repeated configuration blocks
    • Adds large file S3 copy support via multipart upload in policy actions

    +4 more show less

    • Enforces policy name conventions using JSON Schema validation on load
    • Improves CloudWatch Events integration with better support for multiple manually configured CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. events within a single policy
    • Adds tools/vocabulary.py utility to auto-generate YAML documentation of valid policy language elements
    • Adds statement filter support for S3 resources

    9 details in Everything

78. 0.8.6 May 8, 2016 · release notes

    Adds PyPy support for performance, RDS snapshot/backup actions, ASG VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. filters, and large batch notifications in Cloud Custodian 0.8.6

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.6 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.6

    • Add support for running on PyPy to achieve ~30% performance improvement on S3 full scans
    • Add RDS actions for taking manual snapshots and configuring automatic backup retention
    • Add VPC filter capability for Auto Scaling Group (ASG) policies
    • Enable batch notifications in groups of 500 when handling large resource sets

    4 details in Everything

79. 0.8.5 May 4, 2016 · release notes

    Cloud Custodian 0.8.5 adds EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. snapshot creation, ELB SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. policy actions, and S3 global grant deletion

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.5 https://github.com/cloud-custodian/cloud-custodian.git
    # already have the repo? check out this version:
    $ git checkout 0.8.5

    └──▷ TRY IT
    Automate EC2 snapshot creation with custom tags and retention logic
    copy

    $ c7n-cli run -e prod -s out policy.yml
    policy.yml:
    type: ec2
    name: ec2-snapshot
    collection:
      mode:
        type: cloudonevent
        period: 300
    filters:
      - State.Name: running
    actions:
      - type: snapshot
        SnapshotClass: <arn-or-id>
        Description: "Autosnapshot {{ instance.id }}"

    Enforce specific SSL policies on ELBs that match a whitelist filter
    copy

    $ c7n-cli run -e prod -s out policy.yml
    policy.yml:
    type: elb
    name: enforce-ssl-policy
    mode:
      type: cloudonevent
      period: 300
    filters:
      - ssl-whitelist:
          - arn:aws:iam::123456789012:server-certificate/prod-cert.pem
    actions:
      - type: set-ssl-policy
        policy-name: ELBSecurityPolicy-2016-08

    Remove public or global grants from S3 bucket ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. to tighten access control
    copy

    $ c7n-cli run -e prod -s out policy.yml
    policy.yml:
    type: s3
    name: remove-global-grants
    mode:
      type: cloudonevent
      period: 300
    filters:
      - Type: AWSGlobalAcc
    type: bucket-acl-attachment-actions
    actions:
      - type: delete-global-grants

    • Snapshot class to create EC2 snapshots via the ec2:CreateSnapshot action
    • set-ssl-policy action for ELBs to create/attach SSL listener policies, usable with the ssl-whitelist filter
    • delete-global-grants action for S3 buckets to remove global grants from bucket ACLs

    3 details in Everything