capitalone/cloud-custodian
Cloud Custodian
Cloud Custodian is a multi-cloud governance engine and policy enforcement tool designed to automate security, compliance, and cost optimization across various cloud providers. It functions as a rules engine that uses a declarative domain specific language to query cloud resources and execute corrective actions based on predefined filters.
The system operates as a serverless policy orchestrator, deploying provider-specific functions to trigger real-time enforcement in response to cloud resource changes. It provides a provider-agnostic resource abstraction to maintain consistent operational policies across multiple accounts, subscriptions, and projects.
Its capabilities cover cloud infrastructure auditing, including the analysis of assets within continuous integration pipelines and the generation of compliance reporting. The tool also supports cost optimization to identify and remove unused resources and includes a simulation mode to identify affected resources without applying actual changes.
Features
- Cloud Governance Policies - Provides a complete engine for defining and enforcing security, cost, and compliance policies across cloud resources.
- Cloud Infrastructure Cost Optimization - Automatically identifies and removes unused or oversized cloud resources to reduce infrastructure spending.
- Event-Driven Resource Enforcement - Provisions serverless functions and event sources to trigger real-time policy enforcement based on cloud provider events.
- YAML Policy Definitions - Utilizes a declarative YAML-based domain specific language to define resource filters and corrective governance actions.
- Cloud Resource Managers - Connects to multiple cloud platforms to discover, catalog, and control virtual machines, storage, and network resources.
- Multi-Cloud Account Management - Executes governance policies across multiple accounts, subscriptions, and projects across different cloud providers.
- Serverless Deployment - Deploys provider-specific serverless functions that trigger real-time policy enforcement in response to cloud resource changes.
- Serverless Orchestrators - Orchestrates the deployment and execution of ephemeral, event-driven functions for real-time policy enforcement.
- Cloud Infrastructure Security Auditors - Analyzes cloud resource configurations against security rules across multiple providers to report compliance metrics.
- Cloud Provider Abstractions - Uses a provider-agnostic abstraction layer to map disparate cloud API responses into a common internal format.
- Stateless Policy Execution - Executes governance policies as independent, idempotent operations without maintaining a persistent internal database of cloud state.
- Resource Compliance Monitoring - Continuously tracks cloud resource configurations and outputs matched metrics into object storage and monitoring tools.
- Infrastructure as Code Security - Performs security scanning on infrastructure configuration files within development and CI pipelines.
- Infrastructure Policy Enforcement - Analyzes infrastructure assets within CI pipelines to provide immediate feedback on policy violations.
- Cloud Policy Dry-Runs - Provides a simulation mode to verify policy matching and impact on live cloud resources without applying changes.
- Compliance Reporting - Generates structured compliance data and metrics on resource adherence for auditing infrastructure state.
- Security & Privacy - Policy-driven engine for managing cloud resource compliance and security.
Star history
How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.
