Cloud Custodian — Cloud Security & Cost Governance Rules Engine

What it is

Cloud Custodian is a CNCF-hosted rules engine that lets teams define cloud governance policies in YAML. Each policy specifies a resource type (EC2 instances, S3 buckets, Azure VMs), filters to match non-compliant resources, and actions to remediate (tag, stop, terminate, encrypt, notify). It supports AWS, Azure, GCP, and Kubernetes.

Cloud Custodian is built for DevOps engineers, security teams, and FinOps practitioners who need automated enforcement of security posture, compliance mandates, and cost optimization rules across multi-cloud environments.

How it saves time or tokens

Without Custodian, teams write ad-hoc scripts per cloud provider to audit resources. Custodian replaces those scripts with a declarative DSL -- one YAML file per policy. The engine handles API pagination, rate limiting, credential management, and retry logic. Policies run as Lambda functions or Cloud Functions for real-time event-driven enforcement, eliminating cron-based audit lag. For AI workflows, the YAML format is concise enough that generating or reviewing policies consumes minimal tokens.

How to use

1. Install the CLI: pip install c7n (add c7n-azure or c7n-gcp for non-AWS clouds).
2. Write a policy YAML file defining resource type, filters, and actions.
3. Run the policy: custodian run -s output policy.yml. Results are written to the output directory.

Example

policies:
  - name: s3-require-encryption
    resource: s3
    filters:
      - type: bucket-encryption
        state: false
    actions:
      - type: notify
        subject: 'Unencrypted S3 bucket found'
        to:
          - security-team@example.com
        transport:
          type: sqs
          queue: custodian-notifications

This policy scans all S3 buckets, filters those without encryption enabled, and sends a notification via SQS.

Related on TokRepo

• DevOps AI tools -- infrastructure automation and cloud management tools
• Security AI tools -- security scanning and compliance utilities

Common pitfalls

• Running policies with destructive actions (terminate, delete) without first doing a dry run. Always test with --dryrun before applying actions that modify or remove resources.
• Forgetting to scope policies by region. By default Custodian runs in your default region only. Use --region all or specify regions explicitly for global coverage.
• Not setting up proper IAM roles for Lambda-mode policies. Custodian needs permissions to both read resources and perform the configured actions.