https://cybertoolchain.io/tools/cloud-custodian New releases and features in Cloud Custodian, tracked by The Cyber Toolchain. en Thu, 01 Oct 2026 22:58:55 GMT https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.53.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.53.0 Thu, 01 Oct 2026 22:58:55 GMT Cloud Custodian 0.9.53 adds 23 new AWS/GCP/K8s resource types, a `--vars-file` CLI flag, and new Azure ML/NSG actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--vars-file` parameter to `custodian run` to inject variables into policy expansion at runtime without modifying policy files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `aws.aiops-investigation-group` resource type for managing AWS AIOps investigation groups. • Adds `aws.apigwv2-route` resource type with authorization type filtering for API Gateway v2 routes. • Adds `aws.event-connection` resource type for EventBridge event connections. • Adds `aws.iot-certificate`, `aws.iot-ota-update`, and `aws.iot-policy` resource types, expanding IoT coverage. • Adds `aws.qbusiness-application`, `aws.qbusiness-data-accessor`, `aws.qbusiness-data-source`, `aws.qbusiness-index`, and `aws.qbusiness-plugin` resource types for Amazon Q Business. • Adds `aws.rds-global-cluster` resource type for managing RDS global clusters. • Adds `aws.s3-table` and `aws.s3-table-bucket` resource types for S3 Tables. • Adds `aws.s3files-access-point`, `aws.s3files-file-system`, and `aws.s3files-mount-target` resource types for S3 file system resources. • Adds `aws.ssm-association`, `aws.ssm-maintenance-window`, and `aws.ssm-patch-baseline` resource types with tagging support. • Adds `iot-logging` filter to `aws.account` for account-level IoT logging inspection. • Adds `deployments` filter to `aws.bedrock-custom-model` for filtering by model deployments. • Adds `consecutive-aws-backups` filter to `aws.dsql-cluster`. • Adds `auto-tag-user`, `copy-related-tag`, `mark-for-op`, `remove-tag`, and `tag` actions plus `marked-for-op` filter to `aws.ops-item` and `aws.ssm-managed-instance`. • Adds `gcp.vertex-ai-metadata-store-artifact` resource type. • Adds `gcp.workspace-user` resource type for Google Workspace MFA reporting. • Adds audit mode support to `gcp.dataproc-clusters`. • Adds `k8s.custom-resource` resource type for dynamic CRD discovery. • Adds `archive` action to `azure.machine-learning-data-container`. • Adds `cancel` action to `azure.machine-learning-job`. • Adds `remove-rules` action to `azure.networksecuritygroup`. • Extends Azure metric filter to support parent-scoped dimensions. • Standardizes dynamic tagging support across AWS, Azure, and GCP, including `default-value` with no `key` pattern on Azure and GCP. Breaking changes: • The `rename-tag` action is removed from `aws.cloudwatch-dashboard`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.52.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.52.0 Thu, 03 Sep 2026 19:16:59 GMT Cloud Custodian 0.9.52 adds 40+ new AWS/Azure/GCP resources, filters, and actions across Bedrock, WAF, CloudFront, Vertex AI, and more. • Adds `delete` action to `aws.vpc-endpoint` resources, enabling policy-driven removal of unwanted VPC endpoints. • Adds `last-usage` filter to `aws.kms-key` resources for identifying dormant keys. • Adds `termination-policy` filter to `aws.emr` clusters. • Adds `compute-optimizer` filter to `aws.ec2` resources for rightsizing recommendations. • Adds `mark-for-op` support to `aws.cfn` (CloudFormation stack) resources. • Adds `delete` action for `aws.waf` and `aws.waf-regional` Classic Web ACLs. • Adds `master` filter to `aws.security-hub` resource. • Adds `payment-cryptography-replication-regions` filter on the `aws.account` resource. • Adds cross-account filter to `aws.payment-cryptography` resources. • Adds `update-domain-config` action to `aws.elasticsearch` (OpenSearch) domains. • Adds `service-details` filter to `aws.vpc-endpoint` for cross-region endpoint inspection. • Adds `db-parameter` filter and new `aws.memorydb-parameter-group` resource. • Adds `has-allow-all` detection for list-form `Action`/`Resource` entries in `aws.iam-policy`. • Adds `members` filter to `aws.cleanrooms` collaboration resource. • Adds `tagging`, `mark-for-op`, and `stop` actions to `aws.bedrock-model-invocation-job` and `aws.bedrock-inference-profile` resources. • Adds metrics filter to `aws.bedrock-agent` resources. • Adds synthetic total-tokens metric to `aws.bedrock-inference-profile`. • Adds new `aws.bedrock-evaluation-job` resource. • Adds new `aws.bedrock-mantle-project` resource. • Adds org-unit whitelisting to the cross-account filter across AWS resources. • Adds `aws.quicksight` account subscription and custom permissions filters. • Adds new `aws.dsql` (Aurora DSQL) resource support. • Adds new `aws.cloudfront-function` and `aws.cloudfront-keyvalue-store` resources. • Adds `aws.cleanrooms` and `aws.cleanrooms-ml` resources. • Adds new `aws.sagemaker-studio` app, user-profile, and space resources. • Adds new `aws.vpc-lattice-rule` resource. • Adds `Services` and `DefaultServiceQuotas` to `aws.service-quota` resource via `quota.py`. • Adds configurable server-side encryption for S3 policy log output. • Adds resource lookup support in tag values for `aws.tags` actions, enabling dynamic tag propagation. • Adds SNS topic resolution directly by ARN in CloudTrail event mode. • Adds `azure.cognitiveservice-deployment` resource with actions. • Adds `azure.ai-foundry-agent` and `azure.ai-foundry-application` resources. • Adds `azure.machine-learning-job` resource with an `archive` action. • Adds `azure.machine-learning-online-endpoint` resource. • Adds `azure.machine-learning-model-version` resource. • Adds `azure.machine-learning-data-container` resource. • Adds `azure.budget` resource. • Adds `azure.private-dns-zone` and `azure.private-dns-record-set` resources. • Adds matched-security-rule annotation to Azure NSG ingress/egress filters. • Adds resource lookup support in tag values for Azure `tags` actions. • Replaces SCM basic auth with Entra ID bearer token for `azure.function-app` operations. • Adds `monitor` action to `gcp.vertex-ai-endpoint` resources. • Adds `gcp-audit` mode support to `gcp.api-key` resources. • Adds `update` action to `gcp.dns-policy` resources. • Adds `update` action to `gcp.bq-dataset` resources. • Adds `enable-dnssec` and `set-dnssec-key-specs` actions to `gcp.dns-managed-zone`. • Adds new `gcp.regional-commitment` resource. • Adds metrics filter to `gcp.vertex-ai-endpoint`. • Adds new `gcp.notebook-v2` resource with `get` and `update-metadata` actions. • Adds new `gcp.vertex-ai-custom-job` resource. • Adds new `gcp.vertex-ai-dataset` resource. • Adds new `gcp.vertex-ai-hyper-parameter-tuning-job` resource. • Adds new `gcp.vertex-ai-model` resource. • Adds new `gcp.vertex-ai-evaluation-run` resource. • Adds compute instance metadata support for `gcp.instance` resources. • Extends `gcp.metrics` filter to honor `missing-value: 0` correctly. • Adds regional persistent disk support for GCP disk actions. Breaking changes: • In `aws.c7n-org` accounts configuration, the `Status` field for retiring accounts is renamed to `State`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.51.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.51.0 Thu, 28 May 2026 19:52:40 GMT Cloud Custodian 0.9.51.0 adds AI/ML resource coverage across all three clouds plus dozens of new filters and label actions. • Adds `aws.bedrock-foundation-model` resource for policy enforcement against Bedrock foundation models. • Adds `aws.bedrock-guardrail` resource for managing and querying Bedrock guardrails. • Adds metrics filter for `aws.bedrock-inference-profile` resources. • Adds `aws.devops-agent-space` resource with tag support. • Adds WAFv2 support for querying API attributes including redacted fields. • Adds EKS cluster container insight metrics and addon filters. • Adds `ExportDescriptionFilter` and `ImportSummaryFilter` for DynamoDB resources. • Adds `statistic` override to the `usage-metric` filter for `service-quota` resources. • Adds `enable connection logs` action for Application Load Balancers. • Adds `unused` filter for `rds-param-group` and `rds-cluster-param-group` resources. • Adds ReservationId support for EC2 resource filtering. • Adds RDS DB recommendations filter. • Adds cross-account support for `aws:PrincipalOrgPaths` and whitelisted accounts in policy statements. • Adds `azure.ai-foundry-project` and `azure.ai-foundry-connection` resources with associated actions. • Adds Azure Blob Storage as a source for `value_from` filters. • Adds `gcp.vertex-ai-publisher` and `gcp.vertex-ai-publisher-model` resources (Vertex AI Model Garden). • Adds `gcp.firestore-database`, `gcp.firestore-backup-schedule`, `gcp.firestore-field`, and `gcp.firestore-index` resources. • Adds `gcp.ncc-spoke` resource for Network Connectivity Center spoke management. • Adds `gcp.redis-cluster` resource. • Adds `delete` action for GCP `sqlbackuprun` resources. • Adds `set-labels` action for Cloud Run services and jobs. • Adds label actions for GCP `secret`, `armor-policy`, `dns-managed-zone`, `interconnect`, `interconnect-attachment`, `loadbalancer`, `loadbalancer-address`, `snapshot`, `pubsub`, `redis`, and `function` resources. • Adds `delete` and `patch` actions for GCP `api-key` resources. • Adds BigQuery recommender support for GCP. • Adds `snapshots` filter for GCP `disk` resources. • Adds `validate` command to `c7n-org` for validating policy files across org accounts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.50.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.50.0 Wed, 18 Mar 2026 17:16:59 GMT Cloud Custodian 0.9.50 adds 12 new AWS resources, 4 Azure Entra ID resources, 3 GCP Vertex AI resources, and dozens of new filters and actions across all providers. • Adds ability to normalize tag keys in filters across AWS, Azure, and GCP providers. • Adds `start-of-day` option to the metrics filter across AWS, Azure, and GCP. • New `upgrade-available` filter for AWS EKS to detect clusters with a newer Kubernetes version available. • New `upgrade-available` filter for AWS ElasticSearch to detect domains eligible for upgrade. • New `aws.bedrock-inference-profile` resource with delete action for managing Bedrock inference profiles. • New `aws.bedrock-model-invocation-job` resource for managing Bedrock model invocation jobs. • New `aws.directconnect-gateway` and `aws.directconnect-virtual-interface` resources for Direct Connect management. • New `aws.ec2-instance-ami` resource and `image-metadata` filter on `aws.ec2` to query AMI metadata for running instances. • New `aws.event-api-destination` resource for managing EventBridge API destinations. • New `aws.opensearch-reserved` resource for managing OpenSearch Reserved Instances. • New `aws.savings-plan` resource for querying and managing AWS Savings Plans. • New `aws.transfer-connector` and `aws.transfer-web-app` resources for AWS Transfer Family. • New `aws.vpc-lattice-listener` and `aws.vpc-lattice-service-network-association` resources for VPC Lattice management. • New `cross-account` filter on `aws.opensearch-ingestion` to detect cross-account pipeline access. • New `VpcEndpointPolicySupported` filter (`service-details`) on `aws.vpc-endpoint` to check endpoint policy support. • New `service-specific-credentials` filter on `aws.iam-user` to audit IAM user service-specific credentials. • New `toggle-recording` action on `aws.config-recorder` to enable or disable AWS Config recording. • New `network-location`, `security-group`, and `subnet` filters on `aws.transfer-server`. • Adds `whitelist_patterns` option to the cross-account filter to skip deleted IAM principals. • Adds WAF filter support for AWS Managed Rule Groups. • Adds ASG termination action for Auto Scaling Groups. • Adds EBS gp3 modify IOPS action. • New `azure.entraid-authorization-policy`, `azure.entraid-conditional-access-policy`, `azure.entraid-named-location`, and `azure.entraid-security-defaults` resources for Azure Entra ID. • New `storage-metrics` filter on `azure.storage` for metric-based storage account policies. • Adds tag actions to `azure.subscription` resource. • New `gcp.vertex-ai-batch-prediction-job`, `gcp.vertex-ai-endpoint`, and `gcp.vertex-ai-location` resources for GCP Vertex AI. • Adds `set-label` action to GCP buckets, BigQuery, BigTable, and several additional GCP resources. • Adds `set-iam-policy` action for `gcp.bucket` to manage bucket IAM policies. • Enhances GCP `iam-policy` filter with value filter semantics and `remove-bindings: matched` option. • Promotes `aws-accounts` script to a proper CLI command in `c7n_org`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.49.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.49.0 Fri, 16 Jan 2026 21:21:11 GMT Cloud Custodian 0.9.49 adds AWS resolver-rule and Azure Entra ID resources, ALB listener-rule filter, and HCL error failing for shift-left. • Adds new `aws.resolver-rule` resource for managing Route 53 Resolver rules in policies. • Adds `listener-rule` filter to `aws.app-elb` for inspecting ALB routing rules. • Adds new `azure.entraid-group` resource for managing Entra ID groups. • Adds new `azure.entraid-organization` resource for managing Entra ID organization settings. • Extends the `aws.vpc` `dhcp-options` filter with an `amazon` synthetic value for matching AWS-provided DHCP option sets. • Adds `config-compliance` filter to `aws.comprehend-flywheel`, `aws.sagemaker-model-bias-job-definition`, and `aws.ses-dedicated-ip-pool` resources. • Adds `json-diff` filter to `aws.app-elb-target-group`, `aws.artifact-domain`, `aws.comprehend-flywheel`, `aws.datasync-agent`, `aws.glue-database`, `aws.sagemaker-data-quality-job-definition`, `aws.sagemaker-model-bias-job-definition`, `aws.sagemaker-model-explainability-job-definition`, `aws.sagemaker-model-quality-job-definition`, `aws.ses-dedicated-ip-pool`, and `aws.transfer-server` resources. • Enables `c7n-left` (shift-left) to fail runs on HCL parse errors, surfacing misconfigured Terraform before policy evaluation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.48.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.48.0 Mon, 01 Dec 2025 19:04:50 GMT Cloud Custodian 0.9.48 adds new AWS/Azure/GCP resources, KMS rotation filters, WAFv2 logging actions, and VPC Lattice support. • New `aws.iam-access-key` resource enables policies targeting IAM access keys directly. • New `aws.lambda-event-source-mapping` resource supports managing Lambda event source mappings. • Adds three new AWS VPC Lattice resources: `aws.vpc-lattice-service`, `aws.vpc-lattice-service-network`, and `aws.vpc-lattice-target-group`. • New `ami-block-public-access` filter on `aws.account` to detect accounts without AMI public-access blocking. • New `last-rotation` filter on `aws.kms-key` to identify keys by their last rotation date. • New `upgrade-available` filter on `aws.cache-cluster` (ElastiCache) to find clusters eligible for engine upgrades. • New `upgrade-available` and `cross-account` filters on `aws.kafka` for MSK cluster governance. • New `set-logging` action on `aws.wafv2` to configure WAF logging destinations. • New `delete` action on `aws.subnet` for automated subnet removal. • New `delete-listener` action on `aws.app-elb` for Application Load Balancer listener management. • New `current-version` and `replica-attribute` filters on `aws.secrets-manager` for version- and replica-level secret inspection. • New `resolver-query-logging` filter on `aws.vpc` to check VPC DNS query logging configuration. • New `analytics-association` filter on `aws.connect-instance` for Amazon Connect analytics governance. • New `azure.entraid-user` resource adds base Entra ID support for user-level policies. • New `azure.elasticache-reserved` resource for managing Azure Cache reserved capacity. • New `update` action on `azure.keyvault-key` for modifying Key Vault key attributes. • New `gcp.certmanager-certificate` resource for managing GCP Certificate Manager certificates. • Adds EBS server-side query filtering to reduce data fetched during resource enumeration. • Extends `aws.fsx` `delete-file-system` action to support additional FSx file system types. • Extends `aws.firehose` delete action to handle suspended delivery streams. Breaking changes: • The `metrics` filter is removed from `aws.opswork-stack`. • The `metrics` filter is removed from `gcp.spanner-backup` and `gcp.spanner-database-instance`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.47.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.47.0 Mon, 22 Sep 2025 18:14:42 GMT Cloud Custodian 0.9.47 adds QuickSight, EventBridge Pipes, CloudWatch Synthetics, Azure Backup Vault support, and broad org-resource tagging actions. • Adds `aws.quicksight-dashboard` and `aws.quicksight-datasource` resource types for managing QuickSight assets. • Adds `aws.eventbridge-pipes` resource type for governing EventBridge Pipes. • Enables `aws.cloudwatch-synthetics` as a new manageable resource type. • Adds `cross-account` filter to `aws.s3-access-point-multi` (S3 Multi-Region Access Points). • Adds `region-copy` action to `aws.rds-cluster-snapshot` for copying RDS cluster snapshots across regions. • Adds `metrics` filter to `aws.fsx` covering all FSx file system types. • Adds tagging actions (`tag`, `remove-tag`, `rename-tag`, `auto-tag-user`, `copy-related-tag`, `mark-for-op`) and `marked-for-op` filter to `aws.org-account`, `aws.org-policy`, and `aws.org-unit`. • Adds `azure.backup-vault` resource type for Azure Backup Vault governance. • Expands `azure.machine-learning-workspace` with full ARM resource actions (`tag`, `delete`, `lock`, etc.) and filters (`cost`, `diagnostic-settings`, `metric`, `policy-compliant`, etc.). • Updates AWS Lambda runtime support to include Python 3.10–3.13. • Adds `terraform._` resource type support. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.46.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.46.0 Thu, 17 Jul 2025 18:42:30 GMT Cloud Custodian 0.9.46 adds 10 new AWS Comprehend job resources, client-vpn-endpoint, VPC endpoint service config, KMS schedule-deletion, and more. • New `aws.client-vpn-endpoint` resource enables policies over Client VPN endpoints. • New `aws.vpc-endpoint-service-configuration` resource enables policies over VPC endpoint service configurations. • New `set-security-token-service-preferences` action on `aws.account` for managing STS regional endpoint settings. • New `schedule-deletion` action on `aws.kms-key` for scheduling KMS key deletion via policy. • New `pipeline-config` filter on `aws.opensearch-ingestion` for inspecting pipeline configuration. • New `delete` action on `aws.quicksight-user` for removing QuickSight users via policy. • Adds 9 new AWS Comprehend job resources: `comprehend-document-classification-job`, `comprehend-dominant-language-detection-job`, `comprehend-entities-detection-job`, `comprehend-events-detection-job`, `comprehend-key-phrases-detection-job`, `comprehend-pii-entities-detection-job`, `comprehend-sentiment-detection-job`, `comprehend-targeted-sentiment-detection-job`, and `comprehend-topics-detection-job`. • New `kms-key` filter on `aws.comprehend-document-classifier`, `aws.comprehend-entity-recognizer`, and `aws.comprehend-flywheel` for encryption compliance checks. • New `file-services` filter on `azure.storage` for inspecting Azure Storage file service settings. • New `config-compliance` and `json-diff` filters on `aws.iam-oidc-provider`; `json-diff` filter also added to `aws.identity-pool` and `aws.memorydb-subnet-group`. • Cross-account filter now supports additional condition keys for finer-grained policy matching. • New `policy-statement` filter supports more partial match scenarios. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.45.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.45.0 Mon, 02 Jun 2025 20:24:02 GMT Cloud Custodian 0.9.45 adds Comprehend, Keyspaces, Lex v2, and RAM resource support plus new API Gateway v2 actions. • Adds four new AWS Comprehend resource types: `aws.comprehend-document-classifier`, `aws.comprehend-endpoint`, `aws.comprehend-entity-recognizer`, and `aws.comprehend-flywheel`. • Adds `aws.keyspace` and `aws.keyspace-table` resources for managing Amazon Keyspaces (Cassandra-compatible). • Adds `aws.lexv2-bot-alias` resource with cross-account filter and delete action for Lex v2 bot aliases. • Adds `aws.resource-share-self` and `aws.resource-share-other` resources for managing AWS RAM resource shares. • Adds `delete` and `update` actions to `aws.apigwv2` (API Gateway v2 APIs) and `aws.apigwv2-stage` resources. • Adds `vpc` filter to `aws.cache-cluster` via ElastiCache server-side query support. • Adds `topic` filter to `aws.rds-subscription` for filtering RDS event subscriptions by SNS topic. • Adds `db-parameter` filter to `aws.timestream-influxdb` resources. • Adds `return_allowed` configuration option to the cross-account filter, returning matching allowed statements. • Adds support for extended statistics keys in the `metrics` filter. • Adds `cam-policy-used` filter support for finding unused CAM policies in Tencent Cloud via boolean flag. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.44.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.44.0 Thu, 24 Apr 2025 14:12:18 GMT Cloud Custodian 0.9.44.0 adds 20+ new AWS/Azure resources, WAFv2 rule inspection, EFS cross-account detection, and Shield Protection tagging. • Adds `aws.rds-db-shard-group` resource for managing Aurora Limitless shard groups. • Adds `aws.codedeploy-config` resource and `config` filter on `aws.codedeploy-group` for CodeDeploy deployment configuration policies. • Adds `aws.destination` and `aws.delivery-destination` resources for CloudWatch Logs cross-account log routing. • Adds `aws.payment-cryptography-key` resource with tagging and delete actions. • Adds `aws.ses-dedicated-ip-pool`, `aws.ses-configuration-set-v2`, and `aws.ses-ingress-endpoint` resources for SESv2 management. • Adds `aws.timestream-influxdb` and `aws.timestream-influxdb-cluster` resources. • Adds `aws.fsx-volume` resource and `volume`/`vpc` filters on `aws.fsx`. • Adds new Athena resources: `aws.athena-capacity-reservation`, `aws.athena-data-catalog`, and `aws.athena-work-group`. • Adds `aws.cloudhsm-backup`, `aws.kafka-config`, `aws.kendra`, `aws.lexv2-bot`, and `aws.quicksight-account` resources. • Adds `web-acl-rules` filter to `aws.wafv2` for inspecting WAF rule configurations. • Adds `cross-account` filter and `remove-statements` action to `aws.efs` for EFS policy governance. • Adds `cross-account` filter and `remove-policies` action to `aws.ses-email-identity`. • Adds `topic` filter to `aws.cfn` for filtering stacks by SNS notification topic. • Adds `is-log-forwarding` filter to `aws.directory` for checking Directory Service log forwarding status. • Adds `kms-key` filter to `aws.dms-endpoint`. • Adds `used-by` filter to `aws.elastic-ip`. • Adds `delete` action to `aws.iam-saml-provider` for removing SAML identity providers. • Adds tagging actions (`tag`, `remove-tag`, `mark-for-op`, `auto-tag-user`, `copy-related-tag`) and `finding`/`marked-for-op` filters to `aws.shield-protection`. • Adds `configuration` filter to `aws.swf-domain`. • Adds `directory` filter to `aws.workspaces-directory` for filtering by Active Directory. • Adds ECR lifecycle policy support for `tagPatternList` field in `set-lifecycle` action. • Adds server-side query support to `aws.ecr-image` for more efficient image policy evaluation. • Adds `aws.athena-data-catalog` tagging support. • Removes the 5-security-group maximum limit check in the `modify-security-groups` action. • Adds `azure.postgresql-flexibleserver` resource. • Adds `modify-disk-type` action to `azure.disk` for changing disk SKUs. • Adds `jit-policy-port` filter to `azure.vm` for Just-In-Time access policy inspection. • Adds `management-policy-rules` filter to `azure.storage`. • Adds `webapp` filter to `azure.appserviceplan`. • Adds new TencentCloud resources: `tencentcloud.dns-record`, `tencentcloud.eip`, and `tencentcloud.subnet`. • Adds `s3 set-inventory` schema support for additional optional fields. Breaking changes: • `aws.log-destination` resource has been removed from the schema. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.43.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.43.0 Tue, 04 Feb 2025 15:27:59 GMT Cloud Custodian 0.9.43 adds 11 new AWS resource types, cross-account EFS/SES filters, Shield tagging, and new Azure/Tencent resources. • Adds `aws.lexv2-bot` resource for managing Lex V2 bots. • Adds `aws.timestream-influxdb` resource with `network-location` filter for Timestream InfluxDB instances. • Adds `aws.athena-work-group`, `aws.athena-capacity-reservation`, and `aws.athena-data-catalog` resources for Athena governance. • Adds `aws.cloudhsm-backup` resource for CloudHSM backup management. • Adds `aws.kafka-config` resource for MSK cluster configuration. • Adds `aws.kendra` resource for Amazon Kendra index management. • Adds `aws.quicksight-account` resource for QuickSight account settings. • Adds `aws.ses-configuration-set-v2` and `aws.ses-ingress-endpoint` resources for SESv2 governance. • Adds `cross-account` filter and `remove-statements` action to `aws.efs` for detecting and remediating cross-account EFS access. • Adds `cross-account` filter and `remove-policies` action to `aws.ses-email-identity`. • Adds full tagging support to `aws.shield-protection` (`tag`, `remove-tag`, `auto-tag-user`, `copy-related-tag`, `mark-for-op`, `marked-for-op`) plus `finding` filter. • Adds `used-by` filter to `aws.elastic-ip` to identify in-use Elastic IPs. • Adds `template` filter to `aws.cfn` for searching CloudFormation stack templates. • Adds `is-log-forwarding` filter to `aws.directory` for Directory Service log subscription checks. • Adds `kms-key` filter to `aws.dms-endpoint` to audit DMS endpoint encryption. • Adds `configuration` filter to `aws.swf-domain` for SWF domain configuration inspection. • Adds `has-statement` partial-match support via `policystatement` filter. • Adds support for non-default EventBridge event buses in `aws.event-rule` and event targets. • Adds `azure.afd-endpoint` and `azure.afd-custom-domain` resources for Azure Front Door management. • Adds `webapp` filter to `azure.appserviceplan` to find plans hosting specific web apps. • Adds `management-policy-rules` filter to `azure.storage` for lifecycle rule inspection. • Adds `jit-policy-port` filter to `azure.vm` for Just-In-Time access policy auditing. • Adds ability to set minimum TLS version on Azure storage buckets. • Adds support for custom namespaces in Azure metrics filter. • Adds `tencentcloud.eip`, `tencentcloud.dns-record`, and `tencentcloud.subnet` resources. • Adds `--workspace` option to `c7n-left` for selecting a Terraform workspace during shift-left policy evaluation. • Adds `discard_local_ssd` parameter support to GCP instance `stop` action. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.42.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.42.0 Thu, 14 Nov 2024 20:21:44 GMT Cloud Custodian 0.9.42 adds Global Accelerator, ElastiCache User, Step Functions Activities, and dozens of new filters across AWS and Azure resources. • Adds `aws.globalaccelerator` resource with attribute filter support for managing AWS Global Accelerator endpoints. • Adds `aws.elasticache-user` resource for managing ElastiCache users. • Adds `aws.log-destination` resource for managing CloudWatch Logs destinations. • Adds `aws.sfn-activity` resource with tagging and encryption support for Step Functions activities. • Adds `azure.app-service-environment` resource for managing Azure App Service Environments. • Adds `ec2-metadata-defaults` filter and `set-ec2-metadata-defaults` action on `aws.account` to audit and enforce EC2 instance metadata defaults. • Adds `cross-account` and `has-statement` filters to `aws.dynamodb-table` for detecting cross-account access and IAM policy statements. • Adds `cross-account` filter to `aws.kinesis` for detecting Kinesis streams exposed to other accounts. • Adds `has-statement` filter to `aws.rest-api` for auditing API Gateway resource policies. • Adds `kms-key` filter to `aws.event-bus` for checking EventBridge bus encryption. • Adds `kms-key` filter to `aws.step-machine` for auditing Step Functions state machine encryption. • Adds `url-config` filter to `aws.lambda` for inspecting Lambda function URL configurations. • Adds `ldap`, `settings`, and `trust` filters to `aws.directory` for auditing Directory Service LDAP settings and trust relationships. • Adds `delete` action to `aws.ses-configuration-set` for removing SES configuration sets. • Adds `terraform._` resource support for Terraform shift-left policy evaluation. • Adds `c7n-org run-script` shell passthrough improvement using shlex parsing for more robust argument handling. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.41.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.41.0 Wed, 18 Sep 2024 19:08:29 GMT Cloud Custodian 0.9.41 adds 5 new AWS resources, Azure snapshots, OpenSearch Ingestion, MemoryDB users/ACLs, and a shift-left validate command. • Adds `aws.opensearch-ingestion` resource with filters and actions for managing OpenSearch Ingestion pipelines. • Adds `aws.origin-access-control` resource for managing CloudFront origin access controls. • Adds `aws.memorydb-user`, `aws.memorydb-acl`, and `aws.memorydb-snapshot` resources (snapshot includes tag support and delete action). • Adds `retention` filter to `aws.config-recorder` for querying Config recorder retention settings. • Adds `browser-policy`, `subnet`, `user-access-logging`, and `user-settings` filters to `aws.workspaces-web`. • Adds detail spec to `aws.storage-gateway`, unlocking tag management actions (`tag`, `remove-tag`, `rename-tag`, `copy-related-tag`, `auto-tag-user`, `mark-for-op`) and `marked-for-op` filter. • Adds `azure.snapshot` resource with a delete action. • Restores Terraform as a supported provider in core, enabling schema validation for shift-left (`terraform._` resource). • Adds `from_json` JMESPath function to the value filter for parsing embedded JSON strings during filtering. • Adds `validate` command to `c7n-left` (shift-left CLI) for policy validation against IaC. • Extends `c7n-left` traverse filter to support boolean blocks in attributes. • De-duplicates matched egress/ingress rules in `aws.security-group` results. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.39.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.39.0 Tue, 23 Jul 2024 13:55:45 GMT Cloud Custodian 0.9.39 adds 8 new AWS resource types, EC2 SSM inventory filter, S3 object lock filter, and more. • New `aws.codebuild-credential` resource for managing CodeBuild source credentials. • New `aws.servicediscovery-namespace` resource with instance filter for AWS Service Discovery namespaces. • New AWS Network Manager resources: `aws.networkmanager-core`, `aws.networkmanager-global`, `aws.networkmanager-site`, `aws.networkmanager-device`, and `aws.networkmanager-link`. • New `aws.memorydb-subnet-group` resource, plus `subnet`, `kms-key`, `security-group`, and `network-location` filters on `aws.memorydb`. • New `ssm-inventory` filter on `aws.ec2` to query EC2 instances by SSM inventory and installed packages. • New `lock-configuration` filter on `aws.s3` to check S3 object lock settings. • New `db-parameter` filter on `aws.rds-param-group` and `aws.rds-cluster-param-group` for inspecting RDS parameter group values. • New `content` and `marked-for-op` filters plus tagging actions (`tag`, `remove-tag`, `rename-tag`, `copy-related-tag`, `auto-tag-user`, `mark-for-op`) on `aws.ssm-document`. • New App Mesh filters: `route`, `router`, and `service` on `aws.appmesh-mesh`; `gateway-route` on `aws.appmesh-virtualgateway`. • Adds `values_from` support for DynamoDB as a data source in policy filters. • New `time-range` filter on `gcp.api-key` to find API keys by creation or update time. • ECS resources now include configuration information in policy evaluation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.38.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.38.0 Tue, 18 Jun 2024 11:56:41 GMT Cloud Custodian 0.9.38 adds `aws.memorydb` resource and `delete` action for `gcp.bq-dataset`, plus EC2 snapshot description enhancement. • Adds `aws.memorydb` resource support for MemoryDB clusters, enabling policy writing for this AWS service • Adds `delete` action to `gcp.bq-dataset` resource, allowing datasets to be removed via policies • Enhances the `snapshot` action on `aws.ec2.snapshot` resources to include the associated instance name in the snapshot description Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.37.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.37.0 Wed, 05 Jun 2024 14:04:13 GMT Cloud Custodian 0.9.37.0 adds six new SageMaker resource types, EventBridge scheduler mode, and Timestream filters • `aws.timestream-database` now supports the `kms-key` filter for restricting policies to specific KMS keys • `aws.timestream-table` gains the `consecutive-aws-backups` filter to detect tables lacking continuous backup coverage • Policy Lambda execution mode now accepts `eventbridge-scheduler` via a new configuration option • CLI supports session policy injection for IAM-scoped execution context • New resource types: `aws.sagemaker-compilation-job`, `aws.sagemaker-data-quality-job-definition`, `aws.sagemaker-model-bias-job-definition`, `aws.sagemaker-model-explainability-job-definition`, `aws.sagemaker-model-quality-job-definition`, and `aws.sagemaker-processing-job` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.36.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.36.0 Mon, 29 Apr 2024 13:09:49 GMT Cloud Custodian 0.9.36.0 adds new resource types (SageMaker, Workspaces, Stream Job), filters, and actions for AWS and Azure policy management • Adds `aws.workspaces-bundle` resource support for managing Amazon Workspaces bundles. • Adds `aws.appmesh-virtualnode` resource support for App Mesh mesh policies. • Adds `aws.sagemaker-auto-ml-job`, `aws.sagemaker-cluster`, `aws.sagemaker-domain`, and `aws.sagemaker-hyperparameter-tuning-job` resource types for SageMaker automation policies. • Adds `azure.stream-job` resource support for Azure Stream Analytics job management. • Adds the `snapshots` filter to `aws.ebs` resources to evaluate associated EBS snapshots in policies. • Adds `logging-config` filter and `update-logging-config`, `delete`, `update-delete-protection` actions to `aws.firewall` resources. • Adds `kms-key` filter to `aws.opensearch-serverless` resources for KMS-enabled resource detection. • Adds `json-diff` filter to multiple AWS resources (`app-flow`, `appstream-stack`, `bedrock-agent`, `catalog-product`, `config-recorder`, `dms-endpoint`, `dms-instance`, `event-rule`, `graphql-api`, `s3-access-point`, `s3-access-point-multi`, `sagemaker-endpoint-config`, `sagemaker-notebook`, `scaling-policy`, `ses-configuration-set`) for comparing resource state changes. • Adds `compute-instances` filter to `azure.machine-learning-workspace` resources. • Adds `certificates` filter to `azure.api-management` resources. • Adds `firewall-bypass`, `security-alert-policies`, and `server-configurations` filters to `azure.postgresql-server` resources. • Allows variable references to pass type validation in core policy processing. Breaking changes: • `aws.appmesh-virtual-gateway` resource type has been removed; use `aws.appmesh-virtualgateway` instead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.35.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.35.0 Tue, 05 Mar 2024 21:30:15 GMT New AWS Bedrock resource types and AppMesh support, plus Azure SQL Server audit filters • `aws.appmesh-mesh` and `aws.appmesh-virtual-gateway` resources added for AppMesh management • New `aws.bedrock-agent`, `aws.bedrock-customization-job`, and `aws.bedrock-knowledge-base` resource types added • `aws.s3-storage-lens` resource added to manage Storage Lens configurations • Azure `sql-server` resource gains `auditing-policies`, `failover-group`, and `security-alert-policies` filters • New `is-composite-child` filter on `aws.alarm` resources Breaking changes: • `json-diff` filter removed from `aws.rds-proxy` resource Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.34.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.34.0 Thu, 18 Jan 2024 18:30:11 GMT Cloud Custodian 0.9.34.0 adds `aws.org-account`, `aws.org-policy`, and `aws.s3-directory` resources; new filters and actions for cost optimization and tagging. • Adds `aws.org-account` resource type to query AWS Organization member accounts • Adds `aws.org-policy` resource type to query policies attached to Organizational Units or accounts • Adds `aws.org-unit` resource type to query Organizational Units within an organization • Adds `aws.s3-directory` resource type to manage S3 Express One Zone directories • Adds `azure.synapse` resource type for Azure Synapse Analytics workspaces • Adds `cost-optimization` filter to `aws.asg`, `aws.ebs`, `aws.ec2`, `aws.ecs-service`, and `aws.lambda` resources • Adds `json-diff` filter to `aws.appstream-fleet`, `aws.kms`, `aws.ssm-document`, and `aws.user-pool` resources • Adds `disassociate` action to `aws.elastic-ip` resource • Adds `detach` action to `aws.eni` resource • Adds tagging actions (`auto-tag-user`, `copy-related-tag`, `remove-tag`, `rename-tag`, `tag`) and `marked-for-op` filter to `aws.batch-compute`, `aws.batch-definition`, and `aws.batch-queue` resources • Adds `update` action to `aws.batch-queue` resource • Adds `in` operator support to the `network-location` filter for VPC resources • Adds python3.12 runtime support for lambda policies, defaulting to python3.11 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.33.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.33.0 Wed, 29 Nov 2023 17:07:21 GMT Cloud Custodian 0.9.33.0 adds support for AWS Bedrock, OpenSearch Serverless, ECS network filters, Azure Event Grid, and new OpenStack resources. • Adds `aws.bedrock-custom-model` resource type for managing custom models in Amazon Bedrock • Adds `aws.ec2-capacity-reservation` resource type for EC2 capacity reservations • Adds `aws.opensearch-serverless` resource type for OpenSearch Serverless collections • Adds `aws.workspaces-web` resource type for WorkSpaces Web sessions and endpoints • Adds `network-location` and `security-group` filters to `aws.ecs-service` resources • Adds `network-location` and `security-group` filters to `aws.ecs-task` resources • Adds `delete` action to `aws.iam-oidc-provider` resource type • Adds `pending-maintenance` filter to `aws.rds-cluster` resource type • Adds `aws.app-configuration`, `azure.datalake-analytics`, `azure.kusto`, and other Azure resources • Adds `effective-firewall` filter to `gcp.gke-cluster` resources • Adds `openstack.image`, `openstack.secret`, and `openstack.security-group` resource types Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.32.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.32.0 Tue, 03 Oct 2023 15:46:00 GMT Cloud Custodian v0.9.32.0 adds new resources (Inspector2-finding), filters, actions, and schema types across AWS, Azure, and GCP. • Adds `aws.inspector2-finding` resource support for scanning AWS Inspector2 findings • Adds `delete-environment` and `update-environment` actions to `aws.airflow` resource • Adds `kms-key` filter to `aws.glue-catalog` resource • Adds `delete-empty` action to `aws.vpc` resource • Adds `rotation-policy` filter to `azure.keyvault-key` resource • Adds `iam-policy` and `org-policy` filters to `gcp.organization` resource • Adds `server-config` filter to `gcp.gke-cluster` and `gcp.gke-nodepool` resources • Adds `set-high-availability` action to `gcp.sql-instance` resource • Supports `float` value_type in core policy filters • Allows escaped hyphens via ordinal hex in `offhours` core filter Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.31.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.31.0 Wed, 06 Sep 2023 14:30:24 GMT Cloud Custodian 0.9.31.0 adds support for AWS Access Analyzer, Azure App Insights/Bastion, GCP Instance Group Manager, new S3 bucket-replication filter, and c7n-left --var-file support • Adds `data:aws.access-analyzer-finding` resource type to detect active IAM findings in AWS. • Adds `bucket-replication` filter to S3 policy actions for configuring bucket replication rules. • Adds `--var-file` CLI argument to c7n-left to pass Terraform variable files directly. • Adds `prefix: data.` namespace to c7n-left data resource types. • Adds native OCI output support for logging and blob/object storage destinations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.30.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.30.0 Tue, 15 Aug 2023 16:14:41 GMT Cloud Custodian 0.9.30.0 adds ~27 new AWS/GCP/Azure resource types and multiple new actions/filters for existing resources. • `aws.advisor-check` resource type added for Amazon CloudCheck Advisor findings • `aws.apigwv2-stage` resource type added for API Gateway v2 stages • `aws.appdiscovery-agent` resource type added for Application Discovery Service agents • `aws.appstream-fleet` resource type added for AppStream 2.0 fleets • `aws.appstream-stack` resource type added for AppStream 2.0 stacks • `aws.athena-named-query` resource type added for Athena named queries • `aws.budget` resource type added for AWS Budgets • `aws.cloudwatch-dashboard` resource type added for CloudWatch Dashboards • `aws.datasync-agent` resource type added for DataSync agents • `aws.datasync-task` resource type added for DataSync tasks • `aws.devicefarm-project` resource type added for Device Farm projects • `aws.dms-replication-task` resource type added for DMS replication tasks • `aws.flow-log` resource type added for VPC Flow Logs • `aws.guardduty-finding` resource type added for GuardDuty findings • `aws.lex-bot` resource type added for Lex bots • `aws.quicksight-group` resource type added for QuickSight groups • `aws.quicksight-user` resource type added for QuickSight users • `aws.securityhub-finding` resource type added for Security Hub findings • `aws.ssm-patch-group` resource type added for SSM patch groups • `aws.ssm-session-manager` resource type added for SSM Session Manager resources • `aws.xray-group` resource type added for X-Ray groups • `aws.xray-rule` resource type added for X-Ray rule groups • `azure.front-door-policy` resource type added for Azure Front Door policies • `gcp.cloud-run-revision` resource type added for Cloud Run revisions • `ami.cancel-launch-permission` action added to manage AMI launch permissions • `rds.pending-maintenance` filter added to RDS instances for pending maintenance events • `rds-proxy.delete` action added for removing RDS Proxy instances • `rds-snapshot.instance` filter added to associate snapshots with RDS instances • `transit-attachment.set-flow-log` action added for Transit Gateway attachments • `transit-gateway.set-flow-log` action added for Transit Gateways • `transit-gateway.flow-logs` filter added for Transit Gateway flow logs • `user-pool.wafv2-enabled` filter added for Cognito User Pools • `vpc.modify` action added for modifying VPC attributes • `vpc.metrics` filter added for VPC network usage metrics • `azure.advisor-recommendation` filter added to 50+ Azure resource types Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.29.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.29.0 Thu, 20 Jul 2023 18:15:12 GMT Cloud Custodian 0.9.29.0 adds new AWS/GCP/Azure resources, actions, and filters plus OCI provider updates • `aws.connect-campaign` resource available for querying AWS Connect campaign data • `gcp.armor-policy`, `gcp.dataproc-clusters`, `gcp.patch-deployment`, and `gcp.redis` resources added for GCP cloud coverage • New `ebs-storage` filter on `aws.ecs` to inspect EBS storage configuration • New `intelligent-tiering` filter and `set-intelligent-tiering` action on `aws.s3` for managing S3 intelligent tiering settings • New `waf` filter on `azure.cdnprofile` and `azure.front-door` resources to check WAF status • New `mark-for-op`, `set-labels` actions and `marked-for-op` filter on `gcp.gke-cluster` and `gcp.image` for label operations • Breaking change: OCI provider syntax for actions has been simplified, requiring configuration updates Breaking changes: • OCI provider action syntax has changed; existing policies using the old syntax will fail and require migration to the simplified format described in #8740. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.28.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.28.0 Wed, 28 Jun 2023 16:45:13 GMT Cloud Custodian 0.9.28.0 adds OCI provider support and new resource types for AWS, Azure, and GCP • Adds `oci` provider with resources: `bucket`, `compartment`, `cross_connect`, `group`, `instance`, `subnet`, `user`, `vcn`, and `zone`. • Adds `gcp.notebook` resource type for managing Google Cloud Notebooks. • Adds `aws.ses-email-identity` resource type. • Adds `aws.ses-receipt-rule-set` resource type. • Adds `gcp.datafusion-instance` resource type. • Adds `gcp.app-engine-service` and `gcp.app-engine-service-version` resource types. • Adds `azure.monitor-log-profile` resource type. • Adds `gcp.bigtable-instance`, `gcp.bigtable-instance-cluster`, `gcp.bigtable-instance-table`, and `gcp.bigtable-instance-cluster-backup` resource types. • Adds `_run_command` timeout parameter to the Azure session CLI for controlling execution duration. • Adds `config-compliance` filter to `aws.iam-certificate`, `aws.iam-saml-provider`, and `aws.prefix-list` resources. • Adds `metrics` filter to `aws.vpc-endpoint` and `aws.transit-attachment` resources. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.27.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.27.0 Thu, 25 May 2023 15:40:43 GMT New resource types across AWS, Azure, and GCP plus custom JMESPath functions in c7n core. • Adds `aws.fis-experiment` resource type for Fault Injection Simulator experiments • Adds `aws.pinpoint-app` resource type for Amazon Pinpoint applications • Adds `aws.ses-configuration-set` resource type for SES Configuration Sets • Adds `aws.eks associate-encryption-config` action to enable KMS encryption for EKS clusters • Adds `aws.lambda has-specific-managed-policy` filter to check attached policies • Adds `aws.fsx consecutive-aws-backups` filter for FSx resources • Adds `aws.rds consecutive-aws-backups` filter for RDS instances • Adds `aws.rds-cluster consecutive-aws-backups` filter for RDS clusters • Adds `aws.subnet ip-address-usage` filter to analyze subnet IP utilization • Adds `azure.cdn-custom-domain` resource type for Azure CDN custom domains • Adds `azure.cdn-endpoint` resource type for Azure CDN endpoints • Adds `azure.mariadb` resource type for Azure Database for MariaDB • Adds `azure.open-shift` resource type for Azure OpenShift • Adds `azure.servicebus-namespace` resource type for Service Bus namespaces • Adds `azure.servicebus-namespace-authrules` resource type for Service Bus authorization rules • Adds `azure.spring-app` and `azure.spring-service-instance` resource types • Adds `gcp.artifact-repository` resource type for Artifact Registry repositories • Adds `gcp.compute-project` resource type for GCP compute projects • Adds `gcp.region` pseudo-resource type for region-level queries • Adds `recommend` filter to multiple GCP resources (Cloud Run, Disk, Function, GKE Cluster, Image, Instance, Project, Service Account, SQL Instance) • Enables adding custom functions to JMESPath queries via core extension points • Allows passing function parameters from the CLI entry point to policy functions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.26.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.26.0 Wed, 12 Apr 2023 15:14:21 GMT Cloud Custodian 0.9.26.0 adds policy statement filter to vpc-endpoint resources. • Adds policy statement filter for `vpc-endpoint` resources. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.25.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.25.0 Tue, 11 Apr 2023 14:24:01 GMT Cloud Custodian 0.9.25.0 adds GCP Secret/Cloud Run resources, c7n-left policy testing, and new filters/actions across AWS/Azure/GCP. • Adds `gcp.secret` resource type to scan GCP Secrets Manager secrets • Adds `gcp.cloud-run-service` and `gcp.cloud-run-job` resource types for Cloud Run management • Adds `c7n-left docker image` for isolated policy execution environments • Adds `force` option to `aws.ecs-task-definition` delete action for permanent removal • Adds `safety-rule` filter to `aws.recovery-control-panel` resource • Adds `list-item` core filter for iterating over list-valued attributes in policies • Adds `jmespath` as a `value_path` option in `c7n.filters.value` to supply JMESPath expressions • Adds `topic` filter to `aws.sns-subscription` resource • Adds `flow-logs` filter to `azure.networksecuritygroup` resource • Adds `diagnostic-settings` filter to `azure.subscription` resource • Adds `access-approval` filter to `gcp.project` resource • Adds `essential-contacts` filter to `gcp.organization` resource • Adds `iam-policy` filter to `gcp.service-account` resource • Adds `used` filter to `tencentcloud.security-group` resource Breaking changes: • `aws.kinesis-video` no longer supports the `mark`, `unmark`, `untag` actions or `tag-count` filter Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.24.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.24.0 Thu, 16 Mar 2023 09:18:55 GMT Cloud Custodian 0.9.24.0 adds new AWS resources, filters, actions, and c7n-mailer replay integrations. • `enable-auditlog` action for `aws.elasticsearch` to forward audit logs to CloudWatch • `network-location` filter for `aws.efs-mount-target` and `aws.eks` resources • `lambda-edge` filter for `aws.lambda` resources • `c7n-mailer` replay now supports Slack notifications and SQS event source emulation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.23.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.23.0 Thu, 16 Feb 2023 00:43:01 GMT Adds EMR Serverless App resource support with tag/mark actions; GCP missing filter for logs • `aws.emr-serverless-app` resource type added with `delete`, `tag`, and `mark` actions (PR #8197) • Policy `vars` are now supported in conditions (`policy.load` / core), enabling dynamic policy logic (PR #8014) • AWS CloudWatch Logs filter now supports passing a role ARN to the `put-subscription-filter` call via a new attribute (PR #8246) • GCP `log-project-metric` resource adds a metric alert filter for monitoring log-based metrics (PR #8155) • `aws.timestream-table` and `aws.timestream-database` resource types added (PR #8159) • AWS IAM User resource gains the `set-policy` action to update managed policies (PR #8125) • AWS Secrets Manager resource adds a `set-encryption` action (PR #8168) • GCP filters now enable the 'missing' filter capability (PR #8234) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.22.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.22.0 Wed, 18 Jan 2023 22:51:44 GMT Cloud Custodian 0.9.22.0 adds many new AWS Config Connector resources, c7n-org org-level vars, and Azure Defender Alerts support • `c7n-org` supports org level vars in config file (#8033) • Adds `azure.defender-alert` resource type • Adds `awscc.accessanalyzer_analyzer`, `awscc.acmpca_certificateauthority`, `awscc.amplify_app`, `awscc.apigateway_stage`, `awscc.backup_backupvault`, and dozens more AWS Config Connector resources (full list in release notes) • Adds `readiness-check` resource for AWS (#8112) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.21.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.21.0 Thu, 15 Dec 2022 00:48:48 GMT Cloud Custodian 0.9.21.0 adds `aws.transfer` resources, `c7n-org` `not-accounts` option, and new filters/actions for AWS/Azure/Tencent resources. • `aws.transfer-server` and `aws.transfer-user` resources added • `configuration-parameter` filter for `azure.postgresql-server` • `auditing` filter for `azure.sql-server` • `blob-services` filter for `azure.storage` • `authentication` filter for `azure.webapp` • `logging` filter for `aws.wafv2` • `has-statement` filter for `aws.efs` and `aws.secrets-manager` • `set-rule-state` action for `aws.event-rule` • `consecutive-backups` filter for `aws.dynamodb-table`, `aws.efs`, `aws.redshift` • `auto-tag-user`, `copy-related-tag`, `mark-for-op`, `remove-tag`, `tag` actions for `aws.glue-connection` • `set-role` action for `aws.iam-profile` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.20.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.20.0 Wed, 26 Oct 2022 19:19:04 GMT Cloud Custodian 0.9.20.0 adds RDS Proxy and API GWv2 resources, c7n-left JSON output, and Kubernetes admission mode. • `aws.apigwv2` resource is now available for managing API Gateway v2 resources • `aws.graphql-api` resource added for GraphQL API management • `aws.rds-proxy` resource support for RDS Proxy instances • `c7n_kube mode/k8s-admission` adds admission controller mode for Kubernetes policy enforcement • Add `role` and `cluster-role` resources to `c7n_kube` for Kubernetes RBAC management • `tools/c7n-left` updates JSON output to include resource names and JMESPath query results • `tools/c7n-left` exits with code 1 when resources match policies in shift-left checks • Add `login-profile` filter to `aws.iam-user` for filtering users by login status • Add `put-subscription-filter` action to `aws.log-group` for CloudWatch log configuration • Update TLS endpoint config action for `aws.elasticsearch` • `c7n-org` now supports variables in `run-script` arguments Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.19.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.19.0 Wed, 05 Oct 2022 22:50:10 GMT New AWS resources (catalog-product, datalake-location, awscc providers), TencentCloud support, and CCL directory loader • Adds `aws.catalog-product` resource to Cloud Custodian policy schemas for filtering AWS Service Catalog products. • Adds `aws.datalake-location` resource with new `deregister` action and cross-account filter capabilities. • Introduces `tencentcloud` as a supported cloud provider with `cvm` resource support. • Adds `awscc.*` resources covering AWS Config Cloud Control schema types (e.g., `accessanalyzer_analyzer`, `apigateway_*`). • Adds `set-xray-tracing` action to the `aws.lambda` policy engine. • Adds `metrics` filter for Amazon ECR resources. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.18.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.18.0 Thu, 11 Aug 2022 21:14:13 GMT Adds aws.connect-instance resource, `json-diff` and `has-statement` filters, GCP set-labels action, and new env var for GCP projects. • `GCP_PROJECT` environment variable is now supported to configure the GCP project ID • `aws.connect-instance` resource type is added with instance-attribute filter • `gcp.sql-instance` gains `set-labels` action and `marked-for-op` filter • `json-diff` filter added to `aws.batch-compute`, `aws.batch-queue`, `aws.kafka`, `aws.sagemaker-model`, `aws.step-machine`, and `aws.workspaces` • `has-statement` filter added to `aws.sns` and `aws.sqs` resources • `waf-enabled` filter and `set-waf` action added to `aws.rest-stage` for API Gateway, CloudFront, and ELB • `consecutive-backups` and `subnet` filters added to `aws.fsx` • `connection-aliases` filter added to `aws.workspaces-directory` Breaking changes: • Using the s3 output for cross-account buckets now requires the `GetBucketLocation` permission on the target bucket Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.17.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.17.0 Tue, 21 Jun 2022 19:19:44 GMT New FIS template and WAFv2 support across multiple AWS resources in Cloud Custodian • Adds `aws.fis-template` resource type to manage AWS Fault Injection Simulator templates • Adds `aws.wafv2` resource type for managing Web Access Control Lists • Adds `config-compliance` filter to `aws.account` • Adds `set-wafv2` action and `wafv2-enabled` filter to `aws.app-elb`, `aws.distribution`, and `aws.rest-stage` • Adds `enable-https` action and `domain-options` filter to `aws.cloudsearch` • Adds `set-policy` action to `aws.iam-group` • Adds `engine` filter to `aws.rds` • Adds `dead-letter` filter to `aws.sqs` • Adds `deregister` action to `aws.workspaces-directory` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.16.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.16.0 Tue, 10 May 2022 23:00:20 GMT Cloud Custodian 0.9.16 adds support for AWS Traffic Mirror resources, Azure Defender, and new filters/actions for RDS, ElastiCache, and Glue. • Adds `aws.mirror-session` resource type for managing AWS Traffic Mirror sessions • Adds `aws.mirror-target` resource type for managing AWS Traffic Mirror targets • Adds `cross-cluster` filter for `aws.elasticsearch` resources • Adds `toggle-metrics` action for `aws.glue-job` resources • Adds `consecutive-snapshots` filter for `aws.rds` and `aws.rds-cluster` resources Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.15.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.15.0 Thu, 24 Feb 2022 11:53:20 GMT Cloud Custodian 0.9.15.0 adds AWS Cloud Control Provider (awscc), new resources/actions, and c7n_mailer service-quota formatting • Adds `awscc` experimental cloud control provider supporting hundreds of new resource types like `awscc.apigateway_domainname`, `awscc.backup_backupplan`, and `awscc.cloudformation_stackset` • Adds `modify-ecr-policy` action for the `aws.ecr` resource to programmatically modify ECR repository policy statements • Adds `config-compliance` filter for `aws.artifact-domain` and `json-diff` filter for `aws.codedeploy-app`, `aws.codedeploy-group`, `aws.kinesis`, and `aws.transit-gateway` • Adds `subnet` filter for `aws.ecs-container-instance` resource to filter by subnet ID • Adds `ownership` filter for `aws.s3` resources to check bucket ownership controls • Adds `offhour` and `onhour` filters for `aws.sagemaker-notebook` resources • Adds `modify` action for `aws.subnet` resources to modify subnet attributes • Adds `delete` action for `gcp.bq-table` resources • Adds `apigw-domain-name` resource for API Gateway custom domains • Adds `ecr-image` child resource type for ECR repositories • Updates `c7n_mailer` to add formatting support for `service-quota` reports Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.14.0 https://github.com/cloud-custodian/cloud-custodian/releases/tag/0.9.14.0 Tue, 16 Nov 2021 00:44:55 GMT Adds `aws.airflow`, `aws.s3-access-point`, `azure.advisor-recommendation` resources and `json-diff` filter to multiple AWS resource types. • Adds `aws.airflow` resource type for Apache Airflow environment management • Adds `aws.prefix-list` resource type for VPC prefix list discovery • Adds `aws.s3-access-point` and `aws.s3-access-point-multi` resource types for S3 Access Point management • Adds `azure.advisor-recommendation` resource type for Azure Advisor insights • Adds `json-diff` filter to `aws.backup-plan`, `aws.backup-vault`, `aws.ecr`, `aws.ecs`, and `aws.efs` resources • Adds `subscription-filter` filter to `aws.log-group` resources Breaking changes: • AWS Lambda policy updates may fail if not upgraded before Dec 6, 2021 due to AWS behavior change in lambda provisioning Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloud-custodian