Cloud Custodian

---




name: cloud-custodian
compatibility: opencode
completeness: 95
content-types:
- guidance
- examples
- do-dont
- config
description: '"Provides Cloud Custodian in Cloud-Native Engineering -/rules engine
  for cloud infrastructure management"'
license: MIT
maturity: stable
metadata:
  domain: cncf
  output-format: manifests
  related-skills: null
  role: reference
  scope: infrastructure
  triggers: cloud custodian, cloud-custodian, cloud-native, engineering, rules
  archetypes:
  - educational
  - strategic
  anti_triggers:
  - brainstorming
  - vague ideation
  - non-containerized architecture
  response_profile:
    verbosity: medium
    directive_strength: low
    abstraction_level: strategic
version: "1.0.0"




---




# Cloud Custodian in Cloud-Native Engineering

**Category:** security  
**Status:** Active  
**Stars:** 4,100  
**Last Updated:** 2026-04-22  
**Primary Language:** Python  
**Documentation:** [https://cloudcustodian.io/](https://cloudcustodian.io/)  

---

## Purpose and Use Cases

Cloud Custodian is a rules engine for managing cloud infrastructure, enabling policy enforcement, compliance checking, and automated remediation across multiple cloud providers.

### What Problem Does It Solve?

The complexity of managing cloud resources across multiple providers with consistent policies. It provides a unified policy framework for security, compliance, and cost optimization.

### When to Use This Project

Use Cloud Custodian when you need policy enforcement for cloud resources, want to check compliance against standards, need automated remediation for security issues, or manage resources across multiple cloud providers.

### Key Use Cases


- **Policy Enforcement**: Enforce security and compliance policies
- **Compliance Checking**: Check against CIS benchmarks and other standards
- **Cost Optimization**: Identify and remove unused resources
- **Security Automation**: Automated security remediation
- **Resource Tagging**: Enforce resource tagging policies
- **Garbage Collection**: Clean up unused resources
- **Cross-Cloud**: Manage AWS, Azure, GCP with unified policies


---

## Architecture Design Patterns

### Core Components

- **Policy Engine**: Core policy evaluation engine
- **Executor**: Execute policies against cloud resources
- **Reporter**: Generate policy execution reports
- **Actions**: Remediation actions for policy violations
- **Filters**: Resource filtering and selection
- **Sources**: Cloud provider integration modules

### Component Interactions

1. **Policy → Policy Engine**: Load policy definitions
2. **Policy Engine → Executor**: Execute policies
3. **Executor → Cloud API**: Query cloud resources
4. **Executor → Filters**: Filter resources
5. **Executor → Actions**: Apply remediation actions
6. **Executor → Reporter**: Generate reports

### Data Flow Patterns

1. **Policy Execution**: Policy loaded → Resources queried → Filters applied → Actions executed → Report generated
2. **Resource Discovery**: Cloud API → Resource collection → Filtering → Policy matching → Actions
3. **Report Generation**: Execution results → Analysis → Report → Output

### Design Principles

- **Policy-First**: Policy-driven infrastructure management
- **Declarative**: Policies defined in YAML
- **Extensible**: Custom policies and actions
- **Multi-Cloud**: Support for AWS, Azure, GCP
- **Automated**: Automated policy execution
- **Actionable**: Remediation capabilities

---

## Integration Approaches

### Integration with Other CNCF Projects

- **Kubernetes**: Kubernetes resource management
- **OpenPolicyAgent**: Policy evaluation with OPA
- **Prometheus**: Metrics collection for policy execution
- **Grafana**: Policy execution visualization
- **OpenTelemetry**: Tracing for policy execution
- **Falco**: Security event correlation

### API Patterns

- **YAML Policies**: Declarative policy definitions
- **Cloud API**: Cloud provider APIs (AWS, Azure, GCP)
- **REST API**: Policy management API
- **Webhook API**: Policy notifications

### Configuration Patterns

- **Policy YAML**: Declarative policy definitions
- **Variables**: Policy variables for reusability
- **Conditions**: Conditional policy execution
- **Actions**: Remediation action configuration

### Extension Mechanisms

- **Custom Policies**: Write custom policies
- **Custom Actions**: Write custom remediation actions
- **Custom Sources**: Add new cloud providers
- **Custom Filters**: Write custom filters

---

## Common Pitfalls and How to Avoid Them

### Configuration Issues

- **Policy Syntax**: YAML syntax errors
- **Cloud Credentials**: Missing or incorrect credentials
- **Policy Scope**: Too broad or too narrow policy scope
- **Action Permissions**: Insufficient permissions for actions
- **Filter Logic**: Incorrect filter definitions

### Performance Issues

- **API Rate Limits**: Cloud provider API rate limiting
- **Policy Execution Time**: Long policy execution
- **Resource Queries**: Large resource collections
- **Storage Usage**: Report storage growth

### Operational Challenges

- **Policy Updates**: Managing policy updates
- **Policy Testing**: Test policies before production
- **Multi-Cloud**: Synchronize policies across clouds
- **Reporting**: Analyze policy execution reports
- **Alerting**: Configure policy violation alerts

### Security Pitfalls

- **Credential Security**: Store credentials securely
- **Policy Permissions**: Least privilege for policy execution
- **Report Security**: Secure report storage
- **Action Safety**: Safe remediation actions

---

## Coding Practices

### Idiomatic Configuration

- **Policy YAML**: Declarative policy definitions
- **Variables**: Use variables for reusability
- **Tags**: Resource tagging policies
- **Schedules**: Scheduled policy execution

### API Usage Patterns

- **Policy CLI**: Execute policies with c7n CLI
- **Policy API**: Programmatic policy management
- **Cloud API**: Cloud provider API integration

### Observability Best Practices

- **Metrics**: Policy execution metrics
- **Logging**: Policy execution logs
- **Tracing**: Policy execution tracing
- **Reports**: Policy execution reports
- **Dashboards**: Visualization of policy results

### Development Workflow

- **Local Testing**: Test policies locally
- **Debugging**: Policy execution debugging
- **Testing**: Policy testing framework
- **CI/CD**: Automated policy testing
- **Tools**: c7n, cloudcustodian, cloud provider CLIs

---

## Fundamentals

### Essential Concepts

- **Policy**: Rule definition for resource management
- **Resource**: Cloud resource being managed
- **Filter**: Resource selection criteria
- **Action**: Remediation action
- **Executor**: Policy execution engine
- **Reporter**: Policy execution reporter

### Terminology Glossary

- **Policy**: Rule definition
- **Resource**: Cloud resource
- **Filter**: Selection criteria
- **Action**: Remediation action
- **Executor**: Execution engine
- **Reporter**: Reporting module
- **Condition**: Policy condition
- **Variable**: Policy variable

### Data Models and Types

- **Policy**: Policy definition
- **Resource**: Resource data
- **Filter**: Filter definition
- **Action**: Action definition
- **Result**: Execution result
- **Report**: Report data

### Lifecycle Management

- **Policy Lifecycle**: Create → Test → Deploy → Execute → Report
- **Resource Lifecycle**: Query → Filter → Match → Action
- **Execution Lifecycle**: Load → Execute → Report → Cleanup

### State Management

- **Policy State**: Current policy state
- **Resource State**: Resource data
- **Result State**: Execution results
- **Report State**: Report data

---

## Scaling and Deployment Patterns

### Horizontal Scaling

- **Policy Scaling**: Parallel policy execution
- **Executor Scaling**: Multiple executors
- **Reporter Scaling**: Report generation scaling

### High Availability

- **Executor HA**: Multiple executor instances
- **Storage HA**: Report storage HA
- **Service Discovery**: Kubernetes service discovery

### Production Deployments

- **Executor Deployment**: Production executor setup
- **Policy Repository**: Policy version control
- **Notifications**: Alerting configuration
- **Monitoring**: Policy execution monitoring
- **Security**: Credential and access management

### Upgrade Strategies

- **Policy Updates**: Roll out policy updates
- **Executor Updates**: Zero-downtime executor updates
- **Reporter Updates**: Report generation updates

### Resource Management

- **CPU/Memory Limits**: Appropriate resource requests
- **Storage**: Report storage management
- **Network**: Cloud API communication
- **API Quotas**: Plan for API limits

---

## Additional Resources

- **Official Documentation:** [https://cloudcustodian.io/docs/](https://cloudcustodian.io/docs/)
- **GitHub Repository:** [github.com/cloud-custodian/cloud-custodian](https://github.com/cloud-custodian/cloud-custodian)
- **CNCF Project Page:** [cncf.io/projects/cloud-custodian/](https://www.cncf.io/projects/cloud-custodian/)
- **Community:** Check the GitHub repository for community channels
- **Versioning:** Refer to project's release notes for version-specific features

---

## Troubleshooting

### Common Issues

1. **Deployment Failures**
   - Check pod logs for errors
   - Verify configuration values
   - Ensure network connectivity

2. **Performance Issues**
   - Monitor resource usage
   - Adjust resource limits
   - Check for bottlenecks

3. **Configuration Errors**
   - Validate YAML syntax
   - Check required fields
   - Verify environment-specific settings

4. **Integration Problems**
   - Verify API compatibility
   - Check dependency versions
   - Review integration documentation

### Getting Help

- Check official documentation
- Search GitHub issues
- Join community channels
- Review logs and metrics
*Content generated automatically. Verify against official documentation before production use.*

## Examples

### Basic Configuration


```yaml
# Basic configuration example
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{project_name}}-config
  namespace: default
data:
  # Configuration goes here
  config.yaml: |
    # Base configuration
    # Add your settings here
```

### Kubernetes Deployment


```yaml
# Kubernetes deployment for {{project_name}}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{project_name}}
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: {{project_name}}
  template:
    metadata:
      labels:
        app: {{project_name}}
    spec:
      containers:
      - name: {{project_name}}
        image: {{project_name}}:latest
        ports:
        - containerPort: 8080
        resources:
          limits:
            memory: "128Mi"
            cpu: "500m"
```

### Kubernetes Service


```yaml
# Kubernetes service for {{project_name}}
apiVersion: v1
kind: Service
metadata:
  name: {{project_name}}
  namespace: default
spec:
  selector:
    app: {{project_name}}
  ports:
  - protocol: TCP
    port: 80
    targetPort: 8080
  type: ClusterIP
```

---

## When to Use

Use this skill when:

- **Integrating a CNCF project into Kubernetes infrastructure** — You need to configure, deploy, or troubleshoot a cloud-native tool within a cluster
- **Designing cloud-native architecture** — You are selecting and integrating CNCF tools to solve specific infrastructure challenges
- **Resolving operational issues** — A CNCF component is misbehaving, underperforming, or needs configuration changes
---

## Core Workflow

1. **Assess Requirements** — Understand the use case, scale, integration needs, and existing infrastructure. **Checkpoint:** Document requirements, constraints, and success criteria.

2. **Design Architecture** — Plan component interactions, data flow, and deployment strategy using cloud-native best practices. **Checkpoint:** Verify the architecture addresses all requirements and follows CNCF conventions.

3. **Implement & Configure** — Create manifests, configurations, and deployment scripts. Include resource limits, health checks, and observability hooks. **Checkpoint:** Validate all YAML against schema and test in a staging environment.

4. **Deploy & Monitor** — Apply manifests to the cluster, verify component health, and confirm observability is working. **Checkpoint:** Confirm all pods/services are running, probes passing, and metrics/alerts configured.

---

## Constraints

### MUST DO
- Include at least one complete working YAML manifest example
- Note when content is auto-generated vs. manually verified
- Reference relevant CNCF project documentation

### MUST NOT DO
- Deploy manifests without testing in a staging environment first
- Use deprecated API versions (e.g., apps/v1beta1)
- Omit resource limits and requests in Kubernetes manifests