cloud-custodian #general

Jordan S

12/04/2025, 5:07 AM

Hi, can i get feedback for this PR please for issue 2420 on github: https://github.com/cloud-custodian/cloud-custodian/pull/10457 issue: https://github.com/cloud-custodian/cloud-custodian/issues/2420

alam ahmed

12/14/2025, 3:51 PM

HI Everyone!!! I am going to start contributing towards this project if that is okay? Warm regards Alam

✅ 2

Timmy

12/22/2025, 2:28 PM

hi everyone, wanted to ask about using cloud custodian in Google Cloud we want to use custodian as an auto-remediation tool for a situation when someone creates a virtual machine with a public IP address. followed the docs - overall, everything works great out-of-the-box However, we wanted to detach a public IP address from the VM as a way to remediate. Something equivalent to

gcloud compute instances delete-access-config

. Is it possible with the cloud custodian? I looked at the list of possible actions for gcp instance at https://cloudcustodian.io/docs/gcp/resources/instance.html#actions and did not see any way to achieve this...

Deepika Kanwar

12/22/2025, 3:45 PM

Hi anyone knows how the weekend policy takes in effect. I tried the below but it Never starts servers over the weekend, one more issue is that though it has to start 5am daily, on Monday it starts at 1am taking Sunday precedence time. Could you kindly help me on this ? policies: - name: defaultStop description: | Stop instances at 9pm (21:00) on weekdays Tag 'gfl_c7n-schedule' must be set to 'true' mode: # set the polling rate schedule: "rate(20 minutes)" type: periodic resource: aws.ec2 filters: # set the filters for the default job - "tag:gfl_c7n-schedule": "true" - type: offhour # override the default tag key tag: gfl_c7n-schedule default_tz: America/Toronto # set the 24-hour time to turn off the EC2 instance offhour: 21 # no action if instance uptime is < 1 hour - type: instance-age hours: 1 actions: - stop - name: defaultStart description: | Start instance at 5am each on weekdays Instances are stopped from Friday 9pm(21:00) to Monday 5am but exceptional sunday start instances are allowed Tag 'gfl_c7n-schedule' must be set to 'true' mode: schedule: "rate(20 minutes)" type: periodic resource: aws.ec2 filters: - "tag:gfl_c7n-schedule": "true" - type: onhour tag: gfl_c7n-schedule default_tz: America/Toronto onhour: 5 actions: - start - name: defaultSundayStart description: | Start instance at 1am on Sundays [for testing purposes, included Saturday as well] -weekend exception Instances are stopped from Friday 21:00 to Monday 5:00 but exceptional sunday start instances are allowed Tag 'gfl_c7n-schedule' must be set to 'true' mode: schedule: "rate(20 minutes)" type: periodic resource: aws.ec2 filters: - "tag:gfl_c7n-schedule": "true" - type: onhour tag: gfl_c7n-schedule default_tz: America/Toronto onhour: 1 # requirement to start at 1:00 AM on Sundays for patching purposes weekends-only: true actions: - start

alam ahmed

12/28/2025, 3:34 PM

HI, I have pushed my pr fixed the issue by "Remove enum restriction from credential filter key schema to allow JMESPath expressions like 'access_keys[?active]' to pass validation. The filter already supports JMESPath at runtime via ValueFilter, but schema validation was blocking these expressions." Fix credential filter key validation to support JMESPath expressions (PR #10496

Josh Reichardt

01/01/2026, 4:58 PM

Is anyone out there orchestrating cloud custodian with GitHub Actions? I see the docs recommend running on ec2 but curious to see if there any technical reasons running in CI would be a bad idea?

Gregory Suvalian

01/02/2026, 2:23 PM

Anybody running cloud custodian via Azure functions? Wanted to see if there is setup instructions for c7n-org execution via Functions or Automation Runbook or any other compute media (short of doing Kubernetes based deployment). Just realizing probably running in Azure DevOps pipelines is actually the cleanest and easiest option

Alan Martinez

02/13/2026, 2:10 AM

Hi everyone, quick question regarding Cloud Custodian and Azure Blob private access. I’m building a policy to validate VM

owners

tags against a list in a JSON file stored in Azure Blob. I want Cloud Custodian to read that JSON as the source of truth (

value_from.url

) and compare values, but the only way that seems to work is if the blob is public. I don’t want this sensitive list to be public. I’ve assigned a User-Assigned Managed Identity with

Storage Blob Data Reader

on the storage account, but Custodian still fails to fetch the JSON because internally

value_from

uses standard HTTP GET (

urllib

) and doesn’t pass Azure auth tokens. (Getting `urllib.error.HTTPError: HTTP Error 409: Public access is not permitted on this storage account.`error ) Is there a maintainable way to have Custodian fetch a private blob with authentication (Managed Identity / Azure AD) without exposing a public URL? I thought of SAS tokens but managing/refreshing them and injecting them into the policy seems fragile. Any recommended patterns for this use case? Thanks!

Andrés Martínez Gutiérrez

02/19/2026, 10:31 PM

"Hi everyone! I just joined from the CNCF Slack. I'm a Python developer (FastAPI) currently taking the AWS Solutions Architect course. I'm very interested in contributing to Cloud Custodian for GSoC 2026, especially on the AWS provider side. I'm looking to get my feet wet with some 'good first issues'. Any suggestions on where to start or which working group to join?"

Charlotte Read

02/24/2026, 5:22 AM

Hi, I've created a feature request to add the bedrock guardrails resource - would like to work on it myself. How can I get it assigned to myself or indicate that I'm actively working on it?

AJ Kerrigan

02/25/2026, 3:48 AM

That command and its docs have been added but not yet released - you can see the awsaccounts script here in the meantime: https://github.com/cloud-custodian/cloud-custodian/blob/main/tools/c7n_org/c7n_org/orgaccounts.py You can run that script with a

--role

option to customize the role it generates in the config - by default it uses

arn:aws:iam::{Id}:role/OrganizationAccountAccessRole

Abhishek Tiwari

03/02/2026, 3:22 PM

Hello Everyone, I’m running Cloud Custodian on Azure and using c7n-mailer with Azure Storage Queue (ASQ). I’m trying to forward notify events to Splunk HEC, but I’m consistently getting the following error from Splunk: Splunk POST returned non-20x response: 400 {"text":"Error in handling indexed fields","code":15,"invalid-event-number":0} Curren*t mailer.yml* splunk_hec_url: https://splunkhec/services/collector/event splunk_hec_token: token splunk_hec_sourcetype: cloud_custodian queue_url: queue_url function_properties: servicePlan: name: c7n-plan storageAccount: name: c7nmaierstorage identity: type: SystemAssigned Policy Example policies: - name: find-unattached-pips resource: azure.publicip filters: - type: value key: properties.ipConfiguration value: null actions: - type: notify to: - splunkhec://index_name transport: type: asq queue: https://storageacc.queue.core.windows.net/c7n-mailer-queue Additional Context 1. This is Azure (not AWS). 2. A custom Python forwarder reading from the same Azure queue and posting to the same HEC token works without issues when sending a minimal JSON payload.

Brian Gaber

03/18/2026, 3:17 PM

In AWS, I want to tag every EBS volume that automatically gets created as a result of an EC2 instance launch, which would be the RunInstances event. However, a CreateVolume event does not occur for a volume that is automatically created and associated with a new EC2. I have tried the policy below, but it does not work because in the CloudTrail RunInstances event, the EBS Volume Id is not found anywhere. Any suggestions?

Copy code

policies:
- name: tag-ebs-volumes-on-ec2-launch
  resource: ebs
  description: |
    Triggered when a new EBS Volume is created for a new EC2 Launch. Checks to see if
    it's missing the CreatedBy and CreatedOn tag. If both missing then four tags get created.
  mode:
    type: cloudtrail
    role: arn:aws:iam::{account_id}:role/cloud-custodian-role-assumed
    events:
      - source: ec2.amazonaws.com
        event: RunInstances
        ids: "responseElements.instancesSet.items[].blockDeviceMappings[].ebs.volumeId"
  filters:
    - and:
      - tag:CreatedBy: absent
      - tag:CreatedOn: absent
  actions:
    - type: copy-related-tag
      resource: ec2
      skip_missing: true
      key: "Attachments[0].InstanceId"
      tags:
        - Name
        - CreatedBy
        - CreatedOn
        - AccountId
        - Region

Jordan S

03/27/2026, 5:02 AM

Hi, is would anyone be interested in a jira integration for the c7n_mailer? I have a fork of cloud custodian that has a jira integration for the mailer, and I'm wondering if it is worthwhile to move it upstream. It allows cloud custodian to create jira issue issues

linguini-dev

03/30/2026, 2:47 PM

Hey folks, I am trying to perform some restrictions on Azure Image Versions but I can't figure out a good way to do it. As my images are in an image gallery,

azure.image

does not work for me. I want to delete all images older than 10 days. I can use

azure.armresource

to get all the Image Definitions and I can use it to get all Image Versions. I correctly see them. However,

azure.armresource

doesn't scrape the

properties

of the objects, just the plain

id,name,etc

so I can't really combine / cross-reference the two. Policy in question:

Copy code

policies:
- name: get-image-definitions
  resource: azure.armresource
  filters:
    - type: resource-type
      values:
        - Microsoft.Compute/galleries/images
    - type: value
      key: id
      op: contains
      value: "/galleries/mygallery/"

- name: get-image-versions
  resource: azure.armresource
  filters:
    - type: resource-type
      values:
        - Microsoft.Compute/galleries/images/versions
    - type: value
      key: id
      op: contains
      value: "/galleries/mygallery/"

Is there any way to get all Versions of a particular Definition? Or to force the

azure.armresource

to pull the

properties

of the object as well ? The

properties

key contains a key called

publishedDate

that I can use to wipe the images without caring which Definition they are a part of.

amanpreet_zop

03/31/2026, 11:06 AM

something i didn't fully appreciate until we hit ~15 clusters: EKS and GKE are quietly charging you $73/month per cluster just to exist. AKS doesn't. at 40 clusters that's basically $35k/year you're paying for nothing before a single pod runs. wrote this up after going through the numbers more carefully than i probably should have on a friday afternoon. cross-AZ charges on AWS especially are sneakier than the control plane fees imo Has anyone here actually felt the Azure Monitor Log Analytics costs at scale, the per-GB number kept coming up in my research but i haven't seen many real war stories on it. https://dev.to/muskan_8abedcc7e12/eks-vs-gke-vs-aks-a-finops-cost-comparison-in-2026-2m12

👀 1

Chauncey Dawkins

04/07/2026, 6:40 PM

Hi. I am just getting started with cloud custodian. Any tips for AWS?

kapilt

04/14/2026, 6:00 PM

Community meeting is starting soon, we don’t currently have a lead for the meeting, but I’ll try to open up the room for attendees, meeting notes https://hackmd.io/K2wmVyyASKqz9FDE-w0Cpg

ajay.gautam

04/20/2026, 9:04 AM

I have the below cloud custodian policy.

Copy code

- name: aws_rds_delete_instances
    resource: aws.rds
    filters:
      - or:
        - type: value
          key: tag:expires_on
          value: 0
          op: gt
          value_type: age
        - "tag:noncompliant_no_owner": present
        - "tag:noncompliant_no_department": present
        - "tag:noncompliant_no_team": present
        - "tag:noncompliant_expires_on": present
    actions:
    - type: delete
      skip-snapshot: false

When run, 5 standalone instances get filtered for deletion but none of them are deleted. I'm using

--cache-period 0

in the commands . Below are the logs

Copy code

2026-04-20 14:02:25,804: custodian.policy:INFO policy:aws_rds_delete_instances resource:aws.rds region:us-east-2 count:5 time:1.97
2026-04-20 14:02:25,805: custodian.actions:WARNING delete implicitly filtered 0 of 5 resources key:DBClusterIdentifier on None
2026-04-20 14:02:25,809: custodian.policy:INFO policy:aws_rds_delete_instances action:delete resources:5 execution_time:0.00

What does this warning mean ?

WARNING delete implicitly filtered 0 of 5 resources key:DBClusterIdentifier on None

What to do such that the instances start getting deleted actually?

ajay.gautam

04/23/2026, 5:45 AM

Is there a way to put delay between two policies? Any

action

that works like

sleep

Afif Mohd-Amir

04/23/2026, 4:48 PM

Is there a way to reference a specific dynamodb url as the value_from value filter? Looking at this doc

kapilt

04/23/2026, 5:10 PM

Custodian turned 10 yrs old since being open sourced this past week.. https://www.fastforward.blog/an-open-source-project-turns-10-and-finds-itself-tailor-made-for-the-agentic-ai-era/

🙌 4

🥳 11

ROHAN Jagtap

05/16/2026, 5:16 PM

hey guys ,i am new here i want contribute to custodian , have recently completed AWS Cloud Developing training badge , is there anything i can help with , i am here to learn ,thank you

EmFl

05/27/2026, 9:23 AM

Hello, Used cloud-custodian a long time ago, switched jobs etc... Now I'm in a new job with heavy Scaleway cloud usage and wondering if there was any ongoing effort tu support this cloud providers ? I would be interested in trying to support some resources (for now buckets are my priority). Would that be of interest to the project ?

John Torres

05/27/2026, 6:19 PM

Are there any good references to onhours/offhours with gcp labels and encoded values?

Lijo John

06/01/2026, 11:08 AM

Hello, I see that Azure CosmosDB, c7n run is missing few properties field (properties.keysMetadata). I tried to search the backlog and previous convos:issues, didn't find any reference to it. Any insights on this? Having this property would help to find out cosmos DB instances where keys weren't changed over a certain period

Mahesh

06/05/2026, 3:53 PM

Hi team, quick question:

Copy code

policies:
  - name: offhours-asg
    resource: asg
    comments: |
      Daily stoppage outside business hours
    mode:
      type: periodic
      schedule: cron(0 * * * ? *)
    filters:
      - or:
          - "tag:Name": "my-tag"
          - "tag:cluster": "my-tag"
          - "tag:eks:cluster-name": "my-tag"
      - or:
          - type: offhour
            opt-out: true
            tag: skip_offhour_scaledown
            offhour: 1
            default_tz: utc
          - type: offhour
            opt-out: true
            tag: skip_offhour_scaledown
            offhour: 5
            default_tz: utc
    actions:
      - stop
      - type: notify
        slack_template: slack_default
        violation_desc:  |
          Not Applicable
        action_desc:  |
          my description
        slack_msg_color: danger
        to:
          - <https://hooks.slack.com/services>...

We can see this policy runs everyday but not Saturdays (by looking at the slack messages). Isn’t this supposed to be running every evenings and night?

Fouzan

06/12/2026, 3:40 PM

hey all - is it possible to get an invite to the c7n community meeting? sorry if this was posted somewhere, missed it!

Nhat Ha

06/25/2026, 2:53 AM

hi team, we're running into an upstream dependency constraint issue and wanted to check if there's a planned path forward. context: • We're trying to upgrade the

cryptography

package to

>=48.0

in our environment due to security requirements, but we're blocked by c7n's pinned dependency. • What we found: ◦ `c7n 0.9.51`(latest) pins`cryptography`to`46.0.7` ◦ All`c7n`versions`>=0.9.47`are pinned to specific cryptography versions (

44.0.3

45.0.7

46.0.5

, or`46.0.7`) ◦ `cryptography >=48.0`is incompatible with any current`c7n`release is there a plan to support

cryptography >= 48.0

in an upcoming

c7n

release? Or is there a recommended workaround (e.g., using a version constraint range instead of a pinned version) that would allow consumers to upgrade

cryptography

independently? Thanks!

Gianncarlo G

07/27/2026, 7:12 PM

Hi everyone! I'm just wondering, I'm trying to get the Custodian mailer to work with Google Chat. I'm assuming there there isn't official support of it?