Writing the Cloud Custodian Policy, Validate, Run, and Reporting
A powerful open-source tool to govern your public cloud resources
This is a quick story, where we discussed how to install the Cloud Custodian, Write the policy in YAML language, Validate the policy for syntax errors, Run/deploy and Understand the output GZ files.
Install the Cloud Custodian on your local machine
We have covered the installation of Cloud Custodian in another story- https://ismsguy.medium.com/what-is-a-cloud-custodian-c33b37b6060
Writing Cloud Custodian Policy
The Cloud Custodian Policies are YAML. You can use Visual Studio Code Editor to write the policy. After writing the policy, you can save it on your local machine. The next step is to validate to make sure it debugs nicely.
Example- Identify AWS Redshift Cluster Publicly Accessiblepolicies:
- name: redshift-cluster-publicly-accessible
Find Redshift clusters that are publicly accessible.This is a
notify only policy. The policy run once every 24 hours.
- "tag:redshift-publicly-accessible-exempt": absent
- PubliclyAccessible: true
schedule: "rate(24 hours)"
- type: delete
Validate your Cloud Custodian Policy
Use the below command to debug your Custodian policy.
custodian validate policy.yml
Run your Cloud Custodian Policy
Use the below command to deploy the Custodian policy to the AWS account. You can also create a terraform template CICD pipeline to deploy the policies to multiple accounts simulateneously.
custodian run ~/Desktop/cloudcustodian/policy.yml -s ~/Desktop/CustodianTest/ --assume arn:aws:iam::1234567891234:role/c7nexecutionrole
Cloud Custodian Reporting
Upon executing the policy, the cloud custodian produces three different files in gzip format as shown below in the screenshot. You can notice they are JSON format which can be further consumed into your SIEM solution.
We have a separate story where we have discussed the Custodian Output very comprehensively- Click Here.