cloud-custodian/cloud-custodian
Cloud Custodian
Cloud Custodian is an open-source rules engine that uses declarative YAML policies to query, filter, and take automated actions on cloud resources for governance and compliance. It functions as a stateless policy execution engine, where each policy evaluation runs as an independent, idempotent operation without maintaining internal state between runs. Policies are defined using a YAML-based domain-specific language that structures rules as a query-filter-action pipeline.
The engine supports dry-run validation, allowing users to simulate policy actions against live resources without applying changes, verifying intended behavior before execution. It employs a filter-chain resource querying approach that narrows results through successive criteria, and a plugin-based action architecture that extends policy behavior through pluggable modules for remediation tasks like tagging or deletion. Policies can be invoked on a cron-based schedule or in response to cloud events for automated enforcement.
The project covers automated governance remediation, cloud asset querying and filtering, compliance reporting and auditing, and policy dry-run validation. It enables enforcement of security, cost, and compliance rules through automated detection and remediation of violations, including identification of unused or over-provisioned resources to optimize cloud spending. The documentation provides guidance on defining YAML-based rules that query, filter, and act on cloud resources to enforce governance requirements.
Features
- YAML Policy Definitions - A policy engine that defines cloud resource management rules in YAML, enabling querying, filtering, and automated actions across accounts.
- AWS Governance Tools - A tool that enforces security, cost, and compliance policies on AWS resources through declarative YAML rules and automated remediation.
- Filter-Chain Resource Queries - Scanning cloud accounts for resources matching specified criteria using a flexible filter chain in policy definitions.
- YAML - An open-source rules engine that uses YAML policies to query, filter, and take automated actions on cloud resources for governance and compliance.
- Scheduled - Invokes policy evaluations on a cron-based schedule or in response to cloud events for automated enforcement.
- Scheduled Policy Enforcement - Runs scheduled policies that detect policy violations and trigger remediation workflows without manual intervention.
- Stateless Policy Execution - Runs each policy evaluation as an independent, idempotent operation without maintaining internal state between runs.
- Cloud Resource Remediation - Triggers automated actions on cloud resources when policy conditions are met, such as stopping, tagging, or deleting non-compliant items.
- Policy-Driven Remediation - Running scheduled or event-driven policies that detect violations and trigger remediation workflows without manual intervention.
- Automated Remediation Policies - Scans cloud resources against YAML-defined rules and automatically remediates violations to maintain compliance.
- Scheduled Policy Remediation - A framework that automates cloud governance by running scheduled policies to detect violations and trigger remediation workflows.
- Cloud Governance Policies - Defines YAML-based rules that query, filter, and act on AWS resources to enforce security, cost, and compliance requirements.
- Cloud Security Policies - Enforcing security and compliance rules across cloud resources by defining YAML policies that detect and automatically remediate misconfigurations.
- Cloud Policy Dry-Runs - Simulates policy actions against live resources without applying changes to verify intended behavior before execution.
- Cloud Governance DSLs - Defines governance rules as declarative YAML documents with a query-filter-action pipeline structure.
- Filter-Chain Resource Queries - Scans AWS accounts for resources matching specified criteria using a flexible filter chain in policy definitions.
- Plugin-Based Architectures - Extends policy behavior through pluggable action modules that execute remediation tasks like tagging or deletion.
- Cloud Infrastructure Cost Optimization - Identifying and acting on unused or over-provisioned cloud resources to reduce spending through automated termination or resizing.
- Automated Resource Remediation - Identifies unused or over-provisioned resources and applies actions like termination or resizing to reduce spending.
- Compliance Report Generators - Produces structured metrics and detailed output from policy evaluations for auditing and monitoring cloud infrastructure.
- Audit and Compliance - Producing structured metrics and detailed output from policy evaluations for auditing and monitoring cloud infrastructure.
- Cloud Security - Framework for multi-cloud security analysis.
- Security Assessment Tools - Rules engine for cloud security, governance, and automated remediation.
