Tag: compliance

start-policy.yml

policies:
  - name: start-policy
    resource: aws.ec2
    query:
      - instance-state-name: stopped
    filters:
      - "tag:owner": present
    actions:
      - start

stop-policy.yml

policies:
  - name: stop-policy
    resource: aws.ec2
    filters:
      - "tag:owner": present
    actions:
      - stop

custodian run --cache-period 0 start-policy.yml -s output
custodian run --cache-period 0 stop-policy.yml -s output

https://cloudcustodian.io/docs/aws/gettingstarted.html

Deregister aws ami older than 30 days:

policies:
  - name: ebs-delete-old-ebs-snapshots
    resource: ami
    filters:
        - type: image-age
          days: 30
          op: ge
    actions:
        - deregister

Delete aws snapshot older than 30 days:

policies:
  - name: ebs-delete-old-ebs-snapshots
    resource: ebs-snapshot
    filters:
        - type: age
          days: 30
          op: ge
    actions:
        - delete

Docker CloudCustodian

docker run -it -v $(pwd)/output:/opt/custodian/output -v $(pwd):/opt/custodian/ --env-file <(env | grep "^AWS\|^AZURE\|^GOOGLE|^kubeconfig") cloudcustodian/c7n run -v -s /opt/custodian/output /opt/custodian/policy.yml

docker run -it --entrypoint=/bin/bash -v $(pwd)/output:/opt/custodian/output -v $(pwd):/opt/custodian/ --env-file <(env | grep "^AWS\|^AZURE\|^GOOGLE|^kubeconfig") cloudcustodian/c7n