cloud-custodian/cloud-custodian
Cloud Custodian
Cloud Custodian is an open-source rules engine that uses declarative YAML policies to query, filter, and take automated actions on cloud resources for governance and compliance. It functions as a stateless policy execution engine, where each policy evaluation runs as an independent, idempotent operation without maintaining internal state between runs. Policies are defined using a YAML-based domain-specific language that structures rules as a query-filter-action pipeline.
The engine supports dry-run validation, allowing users to simulate policy actions against live resources without applying changes, verifying intended behavior before execution. It employs a filter-chain resource querying approach that narrows results through successive criteria, and a plugin-based action architecture that extends policy behavior through pluggable modules for remediation tasks like tagging or deletion. Policies can be invoked on a cron-based schedule or in response to cloud events for automated enforcement.
The project covers automated governance remediation, cloud asset querying and filtering, compliance reporting and auditing, and policy dry-run validation. It enables enforcement of security, cost, and compliance rules through automated detection and remediation of violations, including identification of unused or over-provisioned resources to optimize cloud spending. The documentation provides guidance on defining YAML-based rules that query, filter, and act on cloud resources to enforce governance requirements.
Features
- YAML Policy Definitions - A policy engine that defines cloud resource management rules in YAML, enabling querying, filtering, and automated actions across accounts.
- AWS Governance Tools - A tool that enforces security, cost, and compliance policies on AWS resources through declarative YAML rules and automated remediation.
- Filter-Chain Resource Queries - Scanning cloud accounts for resources matching specified criteria using a flexible filter chain in policy definitions.
- YAML - An open-source rules engine that uses YAML policies to query, filter, and take automated actions on cloud resources for governance and compliance.
- Scheduled - Invokes policy evaluations on a cron-based schedule or in response to cloud events for automated enforcement.
- Scheduled Policy Enforcement - Runs scheduled policies that detect policy violations and trigger remediation workflows without manual intervention.
- Stateless Policy Execution - Runs each policy evaluation as an independent, idempotent operation without maintaining internal state between runs.
- Cloud Resource Remediation - Triggers automated actions on cloud resources when policy conditions are met, such as stopping, tagging, or deleting non-compliant items.
- Policy-Driven Remediation - Running scheduled or event-driven policies that detect violations and trigger remediation workflows without manual intervention.
- Automated Remediation Policies - Scans cloud resources against YAML-defined rules and automatically remediates violations to maintain compliance.
- Scheduled Policy Remediation - A framework that automates cloud governance by running scheduled policies to detect violations and trigger remediation workflows.
- Cloud Governance Policies - Defines YAML-based rules that query, filter, and act on AWS resources to enforce security, cost, and compliance requirements.
- Cloud Security Policies - Enforcing security and compliance rules across cloud resources by defining YAML policies that detect and automatically remediate misconfigurations.
- Cloud Policy Dry-Runs - Simulates policy actions against live resources without applying changes to verify intended behavior before execution.
- Cloud Governance DSLs - Defines governance rules as declarative YAML documents with a query-filter-action pipeline structure.
- Filter-Chain Resource Queries - Scans AWS accounts for resources matching specified criteria using a flexible filter chain in policy definitions.
- Plugin-Based Architectures - Extends policy behavior through pluggable action modules that execute remediation tasks like tagging or deletion.
- Cloud Infrastructure Cost Optimization - Identifying and acting on unused or over-provisioned cloud resources to reduce spending through automated termination or resizing.
- Automated Resource Remediation - Identifies unused or over-provisioned resources and applies actions like termination or resizing to reduce spending.
- Compliance Report Generators - Produces structured metrics and detailed output from policy evaluations for auditing and monitoring cloud infrastructure.
- Audit and Compliance - Producing structured metrics and detailed output from policy evaluations for auditing and monitoring cloud infrastructure.
- Cloud Security - Framework for multi-cloud security analysis.
- Security Assessment Tools - Rules engine for cloud security, governance, and automated remediation.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
