Introduction to Cloud Custodian

Relevant source files

The following files were used as context for generating this wiki page:

• README.md
• GOVERNANCE.md
• tools/c7n_left/README.md
• tools/c7n_terraform/readme.md
• tools/c7n_gcp/development.md
• tools/sandbox/c7n_autodoc/README.md
• tools/c7n_sphinxext/c7n_sphinxext/docgen.py

Cloud Custodian, also known as c7n, is a rules engine for managing public cloud accounts and resources. It allows users to define policies in simple YAML configuration files to manage cost, security, and compliance across various cloud providers. Custodian consolidates ad-hoc scripts into a flexible tool with unified metrics and reporting.

Sources: README.md:20-26, README.md:37-39

Core Policy Architecture

A policy represents the fundamental unit of Cloud Custodian. It uses a specific vocabulary of filters and actions applied to a resource type. The policy execution behavior depends on the specified mode.

Policy Components

Component	Description
Resource	The specific cloud service or asset type (e.g., aws.s3, azure.vm, gcp.instance).
Filters	Criteria that narrow down the set of resources for evaluation.
Actions	Operations executed against resources that match the filters.
Mode	Configuration that determines how and when the policy runs (e.g., periodic or event-driven).

Sources: README.md:95-102, tools/c7n_sphinxext/c7n_sphinxext/docgen.py:101-118

Policy Execution Flow

The diagram below illustrates how Cloud Custodian processes a policy against cloud resources.

Multi-Cloud and Provider Support

Cloud Custodian supports multiple public cloud environments. It integrates with cloud-native serverless capabilities for real-time enforcement.

• AWS Provider: Manages Amazon Web Services resources.
• Azure Provider: Manages Microsoft Azure resources.
• GCP Provider: Manages Google Cloud Platform resources.
• Other Providers: Includes support for Oracle Cloud (OCI), Tencent Cloud, and OpenStack.

Sources: README.md:28-32, GOVERNANCE.md:7-15

Shift-Left Infrastructure Evaluation

Cloud Custodian provides tools like c7n-left to evaluate policies against Infrastructure as Code (IaC) assets before deployment. This allows developers to catch misconfigurations in CI/CD pipelines.

c7n-left Features

• Runs policies against Terraform source assets.
• Provides CLI feedback directly on developer workstations.
• Supports multiple output formats including cli, github (for PR annotations), and json.
• Uses a taggable filter to enforce tagging standards across different providers.

Sources: tools/c7n_left/README.md:1-10, tools/c7n_left/README.md:50-65, tools/c7n_terraform/readme.md:7-15

Shift-Left Workflow Diagram

The following diagram shows the integration of policy evaluation within a deployment pipeline.

Governance and Project Organization

Cloud Custodian is a CNCF Incubating project managed by a community of contributors. The project uses a structured governance model to ensure transparency and scalability.

Maintainer Roles

• Core Maintainers: Oversee project-wide changes, security, and CNCF coordination.
• Area Maintainers: Manage specific project areas such as individual cloud providers or specific tools like c7n-mailer and c7n-org.

Sources: README.md:46-47, GOVERNANCE.md:27-45

Summary

Cloud Custodian provides a unified rules engine to manage cloud infrastructure through YAML-based policies. By supporting multiple cloud providers and enabling "shift-left" security for Infrastructure as Code, it ensures compliance from development to production. The project operates under CNCF governance, maintaining a modular architecture that separates resource management, filtering, and remediation actions.

Sources: README.md:20-26, GOVERNANCE.md:1-5