Cloud Custodian AWS資源管理工具

Cloud Custodian 是一個(gè)用于 AWS 資源管理的規(guī)則引擎。允許用戶通過圖表、格式化輸出制定策略來增強(qiáng)云資源的管理。包含很多特別的腳本，這是一個(gè)輕量級(jí)而且靈活的工具。

用戶可以通過它來管理 AWS 環(huán)境，確保安全策略、asg 以及無用資源垃圾收集策略被正確使用，降低資源管理的成本。

可以使用簡單的 YAML 配置文件來編寫 Custodian 策略和指定資源類型（ (ec2, asg, redshift 等)。Custodian 的出現(xiàn)是為了統(tǒng)一大量的各種腳本和工具來管理 AWS 賬號(hào)。提供統(tǒng)一的操作和報(bào)表功能。

Custodian 集成了 lambda 和 cloudwatch 事件來提供實(shí)時(shí)增強(qiáng)策略和內(nèi)置配置來查詢和操作賬號(hào)資源。

配置示例：

policies:
?-?name:?remediate-extant-keys
???description:?|
?????Scan?through?all?s3?buckets?in?an?account?and?ensure?all?objects
?????are?encrypted?(default?to?AES256).??
???resources:?s3
???actions:
?????-?encrypt-keys

?-?name:?ec2-require-non-public-and-encrypted-volumes
???resource:?ec2?
???description:?|
?????Provision?a?lambda?and?cloud?watch?event?target
?????that?looks?at?all?new?instances?not?in?an?autoscale?group
?????and?terminates?those?with?unencrypted?volumes.
???mode:
?????type:?cloudtrail???
?????events:
??????-?RunInstances
???filters:
?????-?Encrypted:?false
???actions:
?????-?terminate

?-?name:?tag-compliance
???resources:?ec2
???description:
?????Schedule?a?resource?that?does?not?meet?tag?compliance?policies
?????to?be?stopped?in?four?days.
???filters:
?????-?State.Name:?running
?????-?"tag:Environment":?absent
?????-?"tag:AppId":?absent
?????-?or:
???????-?"tag:OwnerContact":?absent
???????-?"tag:DeptID":?absent
???actions:
?????-?type:?mark-for-op
???????op:?stop
???????days:?4

運(yùn)行：

#?Directory?for?outputs
$?mkdir?out

#?Validate?the?configuration
$?custodian?validate?-c?policy.yml

#?Dryrun?on?the?policies?(no?actions?executed)
$?custodian?run?--dryrun?-c?policy.yml?-s?out

#?Run?the?policy?
$?custodian?run?-c?policy.yml?-s?out