c7n

What it is and what it does

Cloud Custodian is a policy engine that lets you define cloud infrastructure rules in simple YAML files and enforce them across AWS, Azure, and GCP. You write policies specifying resource types (like EC2 instances or S3 buckets), filters to match resources, and actions to take on them—then run them on-demand, via cron, or as serverless functions triggered by cloud events. It consolidates ad-hoc cloud management scripts into a unified tool with built-in compliance checking, cost optimization, tagging enforcement, and real-time policy execution.

The package depends on boto3 for AWS, standard libraries like cryptography, jsonschema, and pyyaml for configuration parsing, and tabulate for output formatting. It's designed for teams managing large cloud fleets who need repeatable, auditable policy enforcement without writing custom code for each rule. Policies can run in dry-run mode first to preview what they would do, and results are stored in cloud-native object storage for reporting.

Use it for:

• Enforce security compliance by automatically terminating EC2 instances with unencrypted volumes or removing cross-account S3 bucket access.
• Manage costs by scheduling unused resources for deletion or stopping instances outside business hours across multiple accounts.
• Validate infrastructure-as-code (Terraform, etc.) policies on developer workstations or in CI pipelines before deployment.
• Apply consistent tagging policies across resources and stop instances that don't meet tag compliance requirements.
• Monitor and report on resource compliance in real-time by integrating with CloudWatch Events, Config Rules, or cloud provider audit logs.
• Automate garbage collection of orphaned or temporary resources across large existing cloud fleets.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Cloud Custodian is a rules engine that enforces cloud infrastructure policies across AWS, Azure, and GCP by defining filters and actions in YAML to manage compliance, security, and cost.

Yes. Cloud Custodian is actively maintained, has no known vulnerabilities, installs with low friction, and is widely used (top 5000 PyPI packages). It's a mature CNCF Incubating project with permissive licensing suitable for enterprise use. Install it if you need to automate cloud compliance, security, or cost management across AWS, Azure, or GCP at scale.

Install

c7n on PyPI

pip install c7n

uv add c7n

poetry add c7n

Installing c7n

Before you install

Low install friction with 8 common runtime dependencies. Active maintenance with recent commits and regular releases; last release 78 days ago. Supports current Python versions (3.10.2+).

License in practice

Apache-2.0 permissive license allows commercial and private use with minimal restrictions; suitable for enterprise adoption.

Quickstart

pip install c7n

echo 'policies:
  - name: example
    resource: aws.s3
    filters:
      - type: cross-account
    actions:
      - type: remove-statements
        statement_ids: matched' > policy.yml

custodian run --dryrun -s output policy.yml

Requires Python 3.10.2 or later; cloud provider credentials (AWS, Azure, or GCP) must be configured in environment or local config.

Verify before relying

• Specific number of supported AWS, Azure, and GCP resource types and available filters/actions.
• Performance characteristics when running against large existing fleets or multi-account environments.
• Serverless provisioning details and supported event sources beyond those mentioned.
• Whether infrastructure-as-code validation works offline or requires cloud provider API access.

Package facts

Evidence: c7n-0.9.51-py3-none-any.whl

Tags

More Distributed Computing packages

Further reading