Cloud CustodianAWS 资源管理工具
Cloud Custodian 是一个用于 AWS 资源管理的规则引擎。允许用户通过图表、格式化输出制定策略来增强云资源的管理。包含很多特别的脚本，这是一个轻量级而且灵活的工具。
用户可以通过它来管理 AWS 环境，确保安全策略、asg 以及无用资源垃圾收集策略被正确使用，降低资源管理的成本。
可以使用简单的 YAML 配置文件来编写 Custodian 策略和指定资源类型（ (ec2, asg, redshift 等)。Custodian 的出现是为了统一大量的各种脚本和工具来管理 AWS 账号。提供统一的操作和报表功能。
Custodian 集成了 lambda 和 cloudwatch 事件来提供实时增强策略和内置配置来查询和操作账号资源。
配置示例：
policies:
- name: remediate-extant-keys
description: |
Scan through all s3 buckets in an account and ensure all objects
are encrypted (default to AES256).
resources: s3
actions:
- encrypt-keys
- name: ec2-require-non-public-and-encrypted-volumes
resource: ec2
description: |
Provision a lambda and cloud watch event target
that looks at all new instances not in an autoscale group
and terminates those with unencrypted volumes.
mode:
type: cloudtrail
events:
- RunInstances
filters:
- Encrypted: false
actions:
- terminate
- name: tag-compliance
resources: ec2
description:
Schedule a resource that does not meet tag compliance policies
to be stopped in four days.
filters:
- State.Name: running
- "tag:Environment": absent
- "tag:AppId": absent
- or:
- "tag:OwnerContact": absent
- "tag:DeptID": absent
actions:
- type: mark-for-op
op: stop
days: 4
运行：
# Directory for outputs
$ mkdir out
# Validate the configuration
$ custodian validate -c policy.yml
# Dryrun on the policies (no actions executed)
$ custodian run --dryrun -c policy.yml -s out
# Run the policy
$ custodian run -c policy.yml -s out
评论