Writing the Cloud Custodian Policy, Validate, Run, and Reporting

Cloud Custodian — Open Source Tool

Install the Cloud Custodian on your local machine

We have covered the installation of Cloud Custodian in another story- https://ismsguy.medium.com/what-is-a-cloud-custodian-c33b37b6060

Writing Cloud Custodian Policy

The Cloud Custodian Policies are YAML. You can use Visual Studio Code Editor to write the policy. After writing the policy, you can save it on your local machine. The next step is to validate to make sure it debugs nicely.

Example- Identify AWS Redshift Cluster Publicly Accessiblepolicies:
- name: redshift-cluster-publicly-accessible
resource: aws.redshift
comments: |
Find Redshift clusters that are publicly accessible.This is a
notify only policy. The policy run once every 24 hours.
filters:
- "tag:redshift-publicly-accessible-exempt": absent
- PubliclyAccessible: true
mode:
type: periodic
schedule: "rate(24 hours)"
execution-options:
output_dir: s3://bucket-name/cclogs/{{policy}}/
runtime: python3.8
action:
- type: delete

Validate your Cloud Custodian Policy

Use the below command to debug your Custodian policy.

custodian validate policy.yml

Run your Cloud Custodian Policy

Use the below command to deploy the Custodian policy to the AWS account. You can also create a terraform template CICD pipeline to deploy the policies to multiple accounts simulateneously.

custodian run ~/Desktop/cloudcustodian/policy.yml -s ~/Desktop/CustodianTest/ --assume arn:aws:iam::1234567891234:role/c7nexecutionrole

Cloud Custodian Reporting

Upon executing the policy, the cloud custodian produces three different files in gzip format as shown below in the screenshot. You can notice they are JSON format which can be further consumed into your SIEM solution.

cloud-custodian-report

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Aakif Shaikh, CISSP, CEH, CHFI, CISA, GWAPT

Aakif Shaikh, CISSP, CEH, CHFI, CISA, GWAPT

Over 18 years of experience in a wide variety of technical domains within information security including information assurance, compliance, and risk management.