Cloud Custodian (c7n) is an open-source, cloud-native rules engine for managing public cloud accounts and resources. It enables users to define policies in simple YAML files to ensure well-managed, secure, and cost-optimized cloud infrastructure. It supports major cloud providers like AWS, Azure, and GCP, and can execute policies in real-time (via serverless functions) or periodically (via scheduled jobs). The current version is 0.9.50, and it maintains an active release cadence with frequent updates and feature additions.
pip install c7nVerified import paths — ran on the pinned version, not inferred.
This quickstart demonstrates how to define a simple policy in a YAML file (`policy.yml`) to identify unencrypted S3 buckets in AWS and then execute it using the `custodian` CLI tool. The `--dryrun` flag allows you to preview actions without making actual changes. Ensure your AWS credentials are configured (e.g., via `~/.aws/credentials` or environment variables) for `custodian` to interact with your cloud environment.
Always install the base `c7n` package along with the specific package(s) for your target cloud(s), e.g., `pip install c7n c7n_azure`.
Execute `custodian run --dryrun -s . policy.yml` to review policy impact before running without `--dryrun`.
Use a YAML linter or editor with YAML validation. Ensure the policy file starts with `policies:` followed by a list of policy definitions.
Upgrade your Python environment to a supported version (e.g., Python 3.10.x or 3.11.x).
Refer to your cloud provider's SDK/CLI documentation for credential configuration. For AWS, ensure `~/.aws/credentials` and `~/.aws/config` are set up, or relevant environment variables are exported.
Install `c7n-org` (`pip install c7n_org`) and use its configuration and commands for multi-target execution.
Ensure the IAM role used by Cloud Custodian has the necessary permissions to provision cloud resources (e.g., Lambda functions, CloudWatch Events) and to perform the actions defined in your policies. Consult the Cloud Custodian documentation's 'IAM Setup' section for detailed requirements.
Ensure that AWS credentials are configured correctly via environment variables (e.g., AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN), a shared credentials file (~/.aws/credentials), or by associating an appropriate IAM role with the execution environment.
Install the missing module using pip: `pip install c7n-azure` (or `pip install c7n-gcp`, `pip install c7n-awscc`, `pip install cloud-custodian` as appropriate). Ensure all necessary components are installed, potentially in the correct order, especially when dealing with specific versions.
Review the policy logic for IAM access key management. If the goal is to disable keys, use the 'update' action instead of 'delete' when combining 'credential' and 'access-key' filters. Consult the Cloud Custodian documentation for the specific resource type and supported actions/filters.
Correct the YAML syntax in the policy file, paying close attention to indentation (ensure consistent use of spaces, not tabs) and proper key-value pair formatting. Use a YAML linter (e.g., 'yamllint') to help identify the exact location and nature of the syntax error.