Rules engine for AWS management, DSL in yaml for query, filter, and actions on resources
Hi everyone,
Im trying to get unused iam-roles with the following policy:
- name: tag-unused-iam-roles
resource: iam-role
comment: |
Mark unused IAM roles
filters:
- type: usage
match-operator: all
LastAuthenticated:
type: value
value_type: age
op: greater-than
value: 120
- not:
- type: value
key: RoleName
op: regex
value: ^(AWSServiceRole?)\w+
actions:
- type: mark-for-op
tag: c7n_iam_unused_role
op: delete
days: 30When scanning the account I'm getting 1 role that has been used today.
"RoleLastUsed": {
"LastUsedDate": "2020-10-12T11:48:54+00:00",
"Region": "eu-north-1"
}its also catch roles that never been used before.
Does anyone managed to scan unused roles without mistakes ?
thanks.
5 replies
- Type: network", but it is still not working. 
3 replies
policies:
- name: asg-unencrypted
resource: asg
filters:
- type: launch-config
key: "BlockDeviceMappings[].Ebs.Encrypted"
value: true
Hi. Trying out policy for Internet facing classic and new type of LB.
The below works..
policies:
- name: elb-delete-new-internet-facing
resource: elb
mode:
type: cloudtrail
events:
description: |- CreateLoadBalancer
Any newly created Classic Load Balanacers launched with
a internet-facing schema will be deleted right away.
filters:- type: event
key: "detail.requestParameters.scheme"
op: eq
value: "internet-facing"
- type: event
But with "resource: app-elb" it does not. It is the same "createloadbalancer'" in both cases, but I see this error in Lambda logs...and consequently I dont get email when it creates the app-elb.
"14:34:05
[WARNING] 2020-10-13T14:34:05.870Z a63bb89e-9d95-4182-9cb7-8349c2061aff Could not find resource ids
[WARNING] 2020-10-13T14:34:05.870Z a63bb89e-9d95-4182-9cb7-8349c2061aff Could not find resource ids"
11 replies
https://gist.github.com/MichaelDavisTSN/a6611447501d8446198c20b7f722de40
we use a modified version of the gcproject.py script, but it does have the statement "include yaml"
8 replies
- type: metrics
name: CPUUtilization
statistics: Average
days: 30
period: 86400
value: 25
op: less-thanhaving trouble with this policy code(with or without quotes):
actions:
- type: set-labels
remove: ["custodian-tag-compliance"]getting error:
c7n_org:ERROR Exception running policy:compute-label-compliance-shared-services-untag account:<removed> region:global error:'NoneType' object has no attribute 'items'
26 replies
@kapilt this is what I did for unused s3:
filters: - type: metrics name: AllRequests days: 1 value: 1 op: greater-thanso If I run it tomo, it should highlight buckets which not been touched for a day, did I get that right?
Getting no results for this filter. Also request metric has been enabled.
18 replies
8 replies
10 replies
rename-tag on an ec2 to address various versions of a tag key? My old keys come in all sorts of cases, like TaG, tAg, TAg, taG etc .. and I want them to be renamed to Tag. This action doesnt seem to be working - actions:
- type: rename-tag
old-key: TAg
new-key: Tag
- type: rename-tag
old-key: TaG
new-key: Tag
5 replies
policies:
- name: c7n-mailer-test
resource: aws.sqs
filters:
- "tag:MailerTest": absent
actions:
- type: notify
template: default
priority_header: '2'
subject: testing the c7n mailer
to:
- tag:owner
transport:
type: sqs
queue: https://sqs.us-east-1.amazonaws.com/592361377849/c7n-mailer-test
cloud-custodian/cloud-custodian#5201
@jtroberts83 did you manage to find a work-around for this issue?
3 replies
c7n-org in an automated fashion from a CI/CD Pipeline. At the moment I'm using Terraform to create resources on a master account, an sqs for mailer along with a role for the mailer lambda and a IAM user called c7n-deployer that will be used to create roles and permissions on the target accounts. The c7n-org accounts config requires a role on the target account that has permissions for the user c7n-deployer in the master account to assume, am I understanding that correctly? but in order to create the correct permissions in the target accounts, it sounds like the role needs to exist prior to running c7n-org. I'm sorry if these question are trivial, I'm also new to AWS.
2 replies
@Avuthu_gitlab
Azure policy for auto-tag-user with random characters:
policies:
- name: custodian_arm_resource_disk_write
resource: azure.armresource
mode:
type: azure-event-grid
events: [{
resourceProvider: 'Microsoft.Compute/disks',
event: 'write'
}]
provision-options:
servicePlan:
name: c7n-azure
resourceGroupName: c7n-azure
location: East US 2
appInsights:
name: c7n-azure
identity:
type: UserAssigned
id: c7n-aci
description: |
Tag a newly created disk with the 'Owner Email' tag.
actions:
- type: auto-tag-user
tag: Custodian_onwer
- type: auto-tag-date
tag: DateCreated
format: "%m-%d-%Y"Activity logs clearly states that Onwer tag is supposed to be tagged with email id.
"properties": {
"statusCode": "Accepted",
"serviceRequestId": "fe65b5a4-bf7f-49fe-bff4-9bf8bf109708",
"responseBody": "{\"name\":\"azure-tagging\",\"location\":\"eastus2\",\"tags\":{\"Owner\":\"navuthu@xxxxxxxxxxx.com\"},\"managedBy\":\"/subscriptions/XXXXXXXXXXXXXXXXXXXX/resourceGroups/CloudCustodian-RG/providers/Microsoft.Compute/virtualMachines/tag-testing-123\",\"sku\":{\"name\":\"StandardSSD_LRS\",\"tier\":\"Standard\"},\"properties\":{\"creationData\":{\"createOption\":\"Empty\"},\"diskSizeGB\":4,\"provisioningState\":\"Updating\",\"isArmResource\":true,\"faultDomain\":0}}",
"eventCategory": "Administrative"OP on console is
1 reply
as i understand it (please correct me where i'm wrong), there is a "syntactic sugar" style for value filters, such that - Engine: aurora-postgresql is the equivalent of
- type: value
key: Engine
value: aurora-postgresql
op: eqi would like to learn more about this style of filter definition, but haven't come across much in the documentation (there are examples using the style without much explanation). can someone point me toward docs or other resources?
4 replies
5 replies
