Rules engine for AWS management, DSL in yaml for query, filter, and actions on resources
- type: enable-cloudtrail
trail: events-trail
bucket: aws-cloudtrail-logs-{account_id} results in botocore.exceptions.ClientError: An error occurred (InvalidLocationConstraint) when calling the CreateBucket operation: The specified location-constraint is not valid. Running with a default region
1 reply
RDS publicly accessible issue - I have an RDS that is set as publicly accessible on the Connectivity segment.
Executing this policy does not detect it. any thoughts? thanks!
`
policies:
- name: aws_rds_publicaly_accessible
resource: rds
filters:- PubliclyAccessible: true
`
- PubliclyAccessible: true
16 replies
#Checking 4. Volume throughput is less than 125 Mbps (Read Bytes Sum + Write Bytes Sum for each minutes should be less than 7500, i.e. 125 x 60)
#Checking 5. Volume IOPS are less than 3000 (Read IOPS Sum + Write IOPS Sum for each minute should be less than 180,000, i.e. 3000 x 60)
Hello,
I am seeing an issue with the c7n mailer notifications, I have included an email address under cc field in my c7n policy, but the same email is also appearing under to field when email is received, see above screenshot. we would like to see 'to' and 'cc' separated. Is this a bug, can I get fix?
Here is my notify action:
actions:
- type: notify
template: default-tag.html
subject: "{{account_id }} | {{region}} | S3 - AWS Custodian Tagging Findings"
to:
- "{acc_owner}"
cc:
- IT-AWSCustodian@abc.comP.S: acc_owner variable doesn't contain 'IT-AWSCustodian@abc.com' email address.
10 replies
I have a policy to send notification emails directly to users. It appears that the notifications are being sent multiple times. I'm trying to understand why this might be? When I look at the logs, I see that only 1 event was triggered, but it looks like the lambda is running multiple times. I'm seeing an access denied error in the logs. Would this cause the function to reprocess and duplicate sends? Is it being sent multiple times because of multiple users?
boto3.exceptions.S3UploadFailedError: Failed to upload /tmp/tmp3foduz1n/metadata.json.gz to custodian-results-bucket/iam-aging-key-notification-owner-XXXXXXXXXXXX/2021/10/14/21/metadata.json.gz: An error occurred (AccessDenied) when calling the PutObject operation: Access Denied
[ERROR] 2021-10-14T21:07:16.544Z 59665190-1b2a-4454-8d83-c30374c84a1d error during policy execution Traceback (most recent call last): File "/var/runtime/boto3/s3/transfer.py", line 279, in upload_file future.result() File "/var/runtime/s3transfer/futures.py", line 106, in result return self._coordinator.result() File "/var/runtime/s3transfer/futures.py", line 265, in result raise self._exception File "/var/runtime/s3transfer/tasks.py", line 126, in __call__ return self._execute_main(kwargs) File "/var/runtime/s3transfer/tasks.py", line 150, in _execute_main return_value = self._main(**kwargs) File "/var/runtime/s3transfer/upload.py", line 694, in _main client.put_object(Bucket=bucket, Key=key, Body=body, **extra_args) File "/var/runtime/botocore/client.py", line 386, in _api_call return self._make_api_call(operation_name, kwargs) File "/var/runtime/botocore/client.py", line 705, in _make_api_call raise error_class(parsed_response, operation_name) botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the PutObject operation: Access Denied During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/var/task/c7n/handler.py", line 165, in dispatch_event p.push(event, context) File "/var/task/c7n/policy.py", line 1164, in push return mode.run(event, lambda_ctx) File "/var/task/c7n/policy.py", line 531, in run return PullMode.run(self) File "/var/task/c7n/policy.py", line 334, in run return resources File "/var/task/c7n/ctx.py", line 103, in __exit__ self.output.__exit__(exc_type, exc_value, exc_traceback) File "/var/task/c7n/output.py", line 486, in __exit__ self.upload() File "/var/task/c7n/output.py", line 494, in upload self.upload_file(os.path.join(root, f), key) File "/var/task/c7n/resources/aws.py", line 542, in upload_file self.transfer.upload_file( File "/var/runtime/boto3/s3/transfer.py", line 285, in upload_file raise S3UploadFailedError( boto3.exceptions.S3UploadFailedError: Failed to upload /tmp/tmp3foduz1n/metadata.json.gz to custodian-results-bucket/iam-aging-key-notification-owner-XXXXXXXXXXXX/2021/10/14/21/metadata.json.gz: An error occurred (AccessDenied) when calling the PutObject operation: Access DeniedHere is the policy (with the mode information removed - I'm just using periodic):
- name: iam-aging-key-notification-owner-XXXXXXXXXXXX
mode:
resource: iam-user
description: Notify IAM users with aging access keys
filters:
- type: access-key
key: Status
value: Active
- type: access-key
key: CreateDate
value_type: age
value: 170
op: greater-than
- "tag:OwnerContact": present
actions:
- type: notify
template: iam_user_notification
to:
- resource-owner
subject: "[Custodian] AWS Access Keys"
violation_desc: "XXXXXXXXXXXX - Aging Access Keys"
action_desc: "All personal IAM access keys must be rotated after 180 days. Please rotate your AWS IAM Access keys. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html."
transport:
type: sqs
queue: https://sqs.us-east-1.amazonaws.com/<queueurl>
Hi all,
New to the group. Hoping to get some assistance on the following policy filter if possible?
- name: secgrp-risk-remediate
mode:
resource: security-group
description:
filters:
- or:
- type: ingress
OnlyPorts: [ 443 ]
Cidr:
value: "0.0.0.0/0"
- type: ingress
OnlyPorts: [ 443 ]
CidrV6:
value: "::/0"
- and:
- type: value
key: "tag:application"
value: "cc_exempted"
value_type: normalize
op: not-equal
- type: ingress
OnlyPorts: [ 9999 ]
Cidr:
value: "0.0.0.0/0"I'm trying to allow SGs with a particular tag and inbound port to be allowed, but the policy always removes the rule from the group.
Is this because it's matching on one of the other OR conditions?
2 replies
Hi Team, i'm new in custodian and i try to find a way to store the response locally in the same structure as i customized for webhook. The resources.json and metadata.json files don't contain what i need, so i trying to set that up.
My .yaml file config is:
- name: IAM-Test
description: IAM-Test
resource: account
region: us-east-1
filters:
- or:
- and:
- type: password-policy
key: RequireUppercaseCharacters
value: false
actions:
- type: webhook
url: https://hooks.slack.com
body: |-
{
"attachments": [
{
"fallback": `CloudCustodian`,
"color": `warning`,
"fields": [
{
"title": `Account Id`,
"value": resource.account_id,
"short": `true`
},
{
"title": `Account Name`,
"value": resource.account_name,
"short": `true`
},
{ "There may be other custom fields": "custom field value"}
],
"icon_emoji": `:rotating_lights:`
}
]
}Thanks.
dumb question but
policies:
- name: IAM User with active access key
resource: iam-user
region: us-east-1
filters:
- type: access-key
key: Status
value: Active
- not:
- or:
- tag:vendor: "true"
- tag:Name: "orgaccess+aws@foo.com is there a way to add not in account 1111111 somehow to the rule?
45 replies
Hello all,
I'm looking into using Cloud Custodian to automatically add an owner tag to and EC2 instance and its EBS volumes when the instance is launched.
In the documentation I've seen this policy which looks like a very good starting point:
https://cloudcustodian.io/docs/aws/examples/ec2-auto-tag-user.html
In some video from the youtube Stacklet channel, I also saw an example of copying tags from the instance to the volumes using the copy-instance-tags action:
https://cloudcustodian.io/docs/aws/resources/ebs.html#aws-ebs-actions-copy-instance-tags
However, I'm not sure about how that would work.
My understanding is that the EC2 policy would be triggered by CloudWatch by parsing CloudTrail logs.
How would the EBS volume policy be triggered?
Using the pull or the periodic execution mode doesn't seem to be the best approach
because ideally, the volumes should be tagged at the same time as the instance.
Unfortunately, it doesn't seem to be possible to tag both the EC2 instance and the EBS volumes in the same rule.
What would be the best approach to do this?
6 replies
Hello, is it possible to parse a raw JSON string using the event filter?
Currently, I'm using JMESPATH query for key in my event filter, and because the actual value of policyDocument attribute is escaped raw stringify JSON, it is unable to parse it. Is there a way within custodian policy to convert this to an object that can be parsed by JMESPATH? If not, any recommendations on how I can parse this?
Thank you!
Here's an example of my partial event payload:
{
"version": "0",
"id": "5710ee03-2735-056e-02e3-e5baad43ae30",
"detail-type": "AWS API Call via CloudTrail",
"detail": {
"eventTime": "2021-10-18T21:31:11Z",
"eventSource": "iam.amazonaws.com",
"eventName": "PutRolePolicy",
"awsRegion": "us-east-1",
"sourceIPAddress": "cloudformation.amazonaws.com",
"userAgent": "cloudformation.amazonaws.com",
"requestParameters": {
"roleName": "test",
"policyName": "allow-all",
"policyDocument": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":\"*\",\"Resource\":\"*\",\"Effect\":\"Allow\",\"Sid\":\"AllowAllAdmin\"}]}"
},
"responseElements": null,
},
"debug": true
}Here's the custodian policy I'm working with:
policies:
- name: iam-role-has-admin-policy-attached
resource: aws.iam-role
description: |
Cloud Custodian IAM Role has Administrative policy attached
mode:
type: cloudtrail
events:
- source: iam.amazonaws.com
event: PutRolePolicy
ids: "requestParameters.roleName"
filters:
- type: event
key: "detail.requestParameters.policyDocument.Statement[].Action"
value_type: swap
op: in
value: "*"How do you manage the lifecycle of the policies that create resources, such as lambda functions or cloudwatch metric filters? My understanding is that I need to delete those resources on my own. Is that correct? Is there maybe a custodian policy that is able to remove resources created by custodian itself based on tags?
To provide some background about what I was expecting as a new custodian user:
- in terraform there's a state file and when a resource is removed from the terraform code, terraform will remove the resource in the next apply command call
- in ansible there isn't any state file, but it's possible to set state to either present or absent. Hence, when I want to remove a resource from my code, I can set the state to absent first, let ansible remove it and then remove it from the code.
5 replies
Regards conditional execution of policy actions. I found this issue:
cloud-custodian/cloud-custodian#6024
Just wondering if there are any plans to implement this? Or if it is possible in another way?
My use-case is:
1) Run SSM "send-command" action.
2) IF successful run "tag" action to tag the resource to show particular piece of software has been installed.
ELSE don't tag and try send-command action again next time policy runs.
3 replies
Hello, is there a way to conditionally handle errors raised while performing any of the actions?
For example, I have a policy where if IAM role has allow-all policy, it will attach a aws-managed deny-all policy. However, if the IAM role already has 10 managed policies attached, Custodian lambda function raises an error LimitExceeded. What I would like to do is.. handle this by detaching one of the 10 managed policies and attempt it again.
Thank you!
My sample policy:
policies:
- name: iam-role-has-admin-policy-attached-test
resource: aws.iam-role
description: |
Cloud Custodian IAM Role has Administrative policy attached
mode:
type: cloudtrail
role: arn:aws:iam::111111111111:role/test-role
events:
- source: iam.amazonaws.com
event: PutRolePolicy
ids: "requestParameters.roleName"
filters:
- or:
- type: has-specific-managed-policy
value: AdministratorAccess
- type: check-permissions
match: denied
actions:
- '*:*'
- type: value
key: AssumeRolePolicyDocument.Statement[].Action
value_type: swap
op: in
value: 'sts:AssumeRoleWithSAML'
actions:
- type: set-policy
state: attached
arn: arn:aws:iam::aws:policy/AWSDenyAllError message from the Custodian lambda function:
{
"errorMessage": "An error occurred (LimitExceeded) when calling the AttachRolePolicy operation: Cannot exceed quota for PoliciesPerRole: 10",
"errorType": "LimitExceededException",
"stackTrace": [
" File \"/var/task/custodian_policy.py\", line 4, in run\n return handler.dispatch_event(event, context)\n",
" File \"/var/task/c7n/handler.py\", line 165, in dispatch_event\n p.push(event, context)\n",
" File \"/var/task/c7n/policy.py\", line 1164, in push\n return mode.run(event, lambda_ctx)\n",
" File \"/var/task/c7n/policy.py\", line 459, in run\n return self.run_resource_set(event, resources)\n",
" File \"/var/task/c7n/policy.py\", line 489, in run_resource_set\n results = action.process(resources)\n",
" File \"/var/task/c7n/resources/iam.py\", line 1091, in process\n client.attach_role_policy(\n",
" File \"/var/runtime/botocore/client.py\", line 386, in _api_call\n return self._make_api_call(operation_name, kwargs)\n",
" File \"/var/runtime/botocore/client.py\", line 705, in _make_api_call\n raise error_class(parsed_response, operation_name)\n"
]
}
I've deployed CIS benchmark validation in AWS accounts via Cloud Custodian. The Cloud Custodian policy gets deployed as part of AWS account creation that is executed via a bash script. The CC policy does get deployed successfully in the new AWS account, but NOT in all the AWS regions. I see the following error message in the regions given below:
2021-10-17 20:06:10,343: c7n_org:ERROR Exception running policy:cis-cloudtrail-is-secure-and-running account:<account_name> region:ap-northeast-1 error:An error occurred (InvalidParameterValueException) when calling the CreateFunction operation: The role defined for the function cannot be assumed by Lambda.
2021-10-17 20:06:10,560: c7n_org:ERROR Exception running policy:cis-cloudtrail-is-secure-and-running account:<account_name> region:eu-west-1 error:An error occurred (InvalidParameterValueException) when calling the CreateFunction operation: The role defined for the function cannot be assumed by Lambda.Regions:
ap-northeast-1
eu-west-1
eu-west-2
ap-northeast-3
eu-west-3
ap-south-1The ap-northeast-3 (Osaka) region is not enabled for new AWS accounts in my organization, so it makes sense if the CC policy is not deployed in that region. But all the other regions are enabled for new AWS accounts and the error occurs in only these regions and is successfully deployed in the other regions.
Based on some information gathered from this forum and stack overflow, i did re-verify that the IAM role does have "lambda.amazonaws.com" in it's trust relationship (if not, the policy would not have deployed in all the AWS regions). The other information I was able to gather was this error could be prevented by introducing a few seconds of delay, for which I used the "delay" property for the "cloudtrail" mode in the CC policy. Adding the "delay" property did not resolve the issue.
However, I did notice that this error occurs only if I invoke the policy execution via the account creation bash script. If I execute the CC policy from my local machine, the CC policy is executed successfully in all the regions.
Has anybody experienced such an issue? If so, how can I troubleshoot, why a CC policy is failing in certain AWS regions?
6 replies
check-permissions filter take into consideration the AWS Organizations SCPs? The reason I'm asking is because I am getting inconsistent results and trying to understand if this filter when used against aws.iam-role resource evaluates more than just the in-line policies and managed policies that are attached to the IAM role.
7 replies
Hello,
I am trying to access specific data from resource.json file into webhook action filter in policy yaml file
Or How I can use entire json data to post in webhook ?
for example, I need CidrIp info into my webhook action json file
How I am going to access it ?
Here is my resource.json
{
"Description": "launch-wizard-3 created 2021-10-18T20:14:49.325-04:00",
"GroupName": "launch-wizard-3",
"IpPermissions": [
{
"FromPort": 80,
"IpProtocol": "tcp",
"IpRanges": [
{
"CidrIp": "0.0.0.0/0"
}
],
"Ipv6Ranges": [],
"PrefixListIds": [],
"ToPort": 80,
"UserIdGroupPairs": []
},
{
"FromPort": 22,
"IpProtocol": "tcp",
"IpRanges": [
{
"CidrIp": "0.0.0.0/0",
"Description": ""
}
],
"Ipv6Ranges": [],
"PrefixListIds": [],
"ToPort": 22,
"UserIdGroupPairs": []
}
],
14 replies
I got question related to storing the policy pass/violation into our database. In this regard, we got 3 questions:
1) How to find if policy has passed or been violated?
2) Instead of posting to webhook, we want to store the results into database. Whats the recommended way to do that?
3) Is there any policy package readily available for NIST/CIS compliance for AWS.
Thanks for help in advance. I appreciate the awesome community.
6 replies
2 replies
6 replies
- name: zsec-enforce-ASGPublicIpPolicy
resource: asg
mode:
type: cloudtrail
events:
- source: autoscaling.amazonaws.com
event: CreateAutoScalingGroup
ids: requestParameters.autoScalingGroupName
role: zsecEnforcementsLambdaRole
filters:
- type: launch-config
key: "AssociatePublicIpAddress"
value: true
actions:
- suspend- name: zsec-enforce-ASGPublicIpPolicy
resource: asg
mode:
type: cloudtrail
events:
- source: autoscaling.amazonaws.com
event: CreateAutoScalingGroup
ids: requestParameters.autoScalingGroupName
role: zsecEnforcementsLambdaRole
filters:
- type: value
key: MinSize
value: 1
op: eq
actions:
- suspend2021-10-20T22:43:30.871-07:00 START RequestId: 3793703f-6f8a-4e16-8ef7-d524089dffde Version: $LATEST
2021-10-20T22:43:31.684-07:00 [INFO] 2021-10-21T05:43:31.668Z 3793703f-6f8a-4e16-8ef7-d524089dffde Processing event
{
"version": "0",
"id": "f0d64faa-dc3c-fcb5-fb86-4e5a0728bc58",
"detail-type": "AWS API Call via CloudTrail",
"source": "aws.autoscaling",
"account": "xxxxxxxx8633",
"time": "2021-10-21T05:43:13Z",
"region": "eu-central-1",
"resources": [],
"detail": {
"eventVersion": "1.08",
"userIdentity": {
"type": "AssumedRole",
"principalId": "AROAI2VPKICTIPIAGCZSS:aalten@xxxxx.com",
"arn": "arn:aws:sts::xxxxxxxx8633:assumed-role/Full-Admin-SAML-Role/aalten@xxxxx.com",
"accountId": "xxxxxxxx8633",
"accessKeyId": "ASIARBGJCOO4ZD5244OA",
"sessionContext": {
"sessionIssuer": {
"type": "Role",
"principalId": "AROAI2VPKICTIPIAGCZSS",
"arn": "arn:aws:iam::xxxxxxxx8633:role/Full-Admin-SAML-Role",
"accountId": "xxxxxxxx8633",
"userName": "Full-Admin-SAML-Role"
},
"webIdFederationData": {},
"attributes": {
"creationDate": "2021-10-21T03:08:17Z",
"mfaAuthenticated": "false"
}
}
},
"eventTime": "2021-10-21T05:43:13Z",
"eventSource": "autoscaling.amazonaws.com",
"eventName": "CreateAutoScalingGroup",
"awsRegion": "eu-central-1",
"sourceIPAddress": "98.47.41.143",
"userAgent": "aws-internal/3 aws-sdk-java/1.12.75 Linux/5.4.141-78.230.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/standard",
"requestParameters": {
"minSize": 1,
"tags": [
{
"propagateAtLaunch": true,
"key": "Name",
"value": "aalten-test-public-asg-33",
"resourceType": "auto-scaling-group"
}
],
"maxSize": 1,
"newInstancesProtectedFromScaleIn": false,
"autoScalingGroupName": "aalten-test-public-asg-33",
"healthCheckType": "EC2",
"healthCheckGracePeriod": 300,
"desiredCapacity": 1,
"launchConfigurationName": "aalten-launch-config-public-internet-1",
"vPCZoneIdentifier": "subnet-6340202e"
},
"responseElements": null,
"requestID": "e7dff48e-de6e-4203-9d49-719bb73b87b8",
"eventID": "3e2837d6-8388-4f95-a2bf-79959e1bc2c8",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "xxxxxxxx8633",
"eventCategory": "Management"
},
"debug": true
}2021-10-20T22:43:31.684-07:00 [DEBUG] 2021-10-21T05:43:31.684Z 3793703f-6f8a-4e16-8ef7-d524089dffde Disabling cache
2021-10-20T22:43:31.685-07:00 [WARNING] 2021-10-21T05:43:31.685Z 3793703f-6f8a-4e16-8ef7-d524089dffde Custodian reserves policy lambda tags starting with custodian - policy specifies custodian-info
2021-10-20T22:43:31.685-07:00 [INFO] 2021-10-21T05:43:31.685Z 3793703f-6f8a-4e16-8ef7-d524089dffde Found resource ids:['aalten-test-public-asg-33']
[INFO] 2021-10-21T05:43:31.685Z 3793703f-6f8a-4e16-8ef7-d524089dffde Found resource ids:['aalten-test-public-asg-33']
2021-10-20T22:43:31.992-07:00 [INFO] 2021-10-21T05:43:31.991Z 3793703f-6f8a-4e16-8ef7-d524089dffde Resources [{'AutoScalingGroupName': 'aalten-test-public-asg-33', 'AutoScalingGroupARN': 'arn:aws:autoscaling:eu-central-1:xxxxxxxx8633:autoScalingGroup:c530605e-c1bb-40b8-81e0-46781cd90eda:autoScalingGroupName/aalten-test-public-asg-33', 'LaunchConfigurationName': 'aalten-launch-config-public-internet-1', 'MinSize': 1, 'MaxSize': 1, 'DesiredCapacity': 1, 'DefaultCooldown': 300, 'AvailabilityZones': ['eu-central-1c'], 'LoadBalancerNames': [], 'TargetGroupARNs': [], 'HealthCheckType': 'EC2', 'HealthCheckGracePeriod': 300, 'Instances': [{'InstanceId': 'i-0e07ac595df620bce', 'InstanceType': 'c4.large', 'AvailabilityZone': 'eu-central-1c', 'LifecycleState': 'Pending', 'HealthStatus': 'Healthy', 'LaunchConfigurationName': 'aalten-launch-config-public-internet-1', 'ProtectedFromScaleIn': False}], 'CreatedTime': datetime.datetime(2021, 10, 21, 5, 43, 13, 211000, tzinfo=tzlocal()), 'SuspendedProcesses': [], 'VPCZoneIdentifier': 'subnet-6340202e', 'EnabledMetrics': [], 'Tags': [{'ResourceId': 'aalten-test-public-asg-33', 'ResourceType': 'auto-scaling-group', 'Key': 'Name', 'Value': 'aalten-test-public-asg-33', 'PropagateAtLaunch': True}], 'TerminationPolicies': ['Default'], 'NewInstancesProtectedFromScaleIn': False, 'ServiceLinkedRoleARN': 'arn:aws:iam::xxxxxxxx8633:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling'}]
2021-10-20T22:43:31.992-07:00 [INFO] 2021-10-21T05:43:31.992Z 3793703f-6f8a-4e16-8ef7-d524089dffde Filtering resources using 1 filters
2021-10-20T22:43:32.072-07:00 [DEBUG] 2021-10-21T05:43:32.071Z 3793703f-6f8a-4e16-8ef7-d524089dffde Filter #1 applied 1->0 filter:
{
"type": "launch-config",
"key": "AssociatePublicIpAddress",
"value": true
}
[DEBUG] 2021-10-21T05:43:32.071Z 3793703f-6f8a-4e16-8ef7-d524089dffde Filter #1 applied 1->0 filter: {"type": "launch-config", "key": "AssociatePublicIpAddress", "value": true}
2021-10-20T22:43:32.072-07:00 [DEBUG] 2021-10-21T05:43:32.072Z 3793703f-6f8a-4e16-8ef7-d524089dffde Filtered from 1 to 0 asg
2021-10-20T22:43:32.072-07:00 [INFO] 2021-10-21T05:43:32.072Z 3793703f-6f8a-4e16-8ef7-d524089dffde Filtered resources 0 of 1
2021-10-20T22:43:32.072-07:00 [INFO] 2021-10-21T05:43:32.072Z 3793703f-6f8a-4e16-8ef7-d524089dffde policy:zsec-enforce-ASGPublicIpPolicy resources:asg no resources matched
2021-10-20T22:43:32.073-07:00 END RequestId: 3793703f-6f8a-4e16-8ef7-d524089dffde
2021-10-20T22:43:32.073-07:00 REPORT RequestId: 3793703f-6f8a-4e16-8ef7-d524089dffde Duration: 1202.16 ms Billed Duration: 1203 ms Memory Size: 512 MB Max Memory Used: 78 MB Init Duration: 572.68 ms$ custodian version
0.9.13
Hello, I'm looking to set the TLS security policy on some Cloudfront distributions. I tried the following action, but received this error (my credentials have access to update the distro)
botocore.exceptions.ClientError: An error occurred (InternalError) when calling the UpdateDistribution operation (reached max retries: 4):Is there a way to set the MinimumProtocolVersion with c7n?
actions:
- type: set-attributes
attributes:
ViewerCertificate:
MinimumProtocolVersion: TLSv1.2_2018
Hi
I'm having trouble checking if multi-region cloud trail in my account. Below is my policy.
policies:
- name: check-cloudtrail-multi-region
resource: aws.account
filters:
- type: check-cloudtrail
multi-region: trueand the output is this none even if I have a trail that is muti-region.
2021-10-24 16:45:52,103: custodian.policy:INFO policy:check-cloudtrail-multi-region resource:aws.account region:us-east-2 count:0 time:2.99Can anyone advise what is wrong with my policy?
Thanks in advance!
1 reply
