c7n-org

What it is and what it does

c7n-org is a command-line tool that extends Cloud Custodian to orchestrate policy execution across multiple cloud accounts or subscriptions in parallel. Instead of running policies account-by-account, you define all your accounts in a YAML configuration file and c7n-org distributes policy execution across them, collecting results into a structured output directory. It supports AWS (via Organizations API), Azure, GCP, and OCI, and provides filtering by account name, ID, tags, regions, and policies.

The tool operates in several modes: `run` executes Custodian policies across accounts, `run-script` executes arbitrary scripts with cloud credentials injected, `report` generates CSV summaries from policy results, `validate` checks policies without cloud access, and `aws-accounts` auto-generates AWS account configuration from your Organizations API. Variables defined per-account are interpolated into policies at execution time, allowing account-specific customization without duplicating policy files.

Use it for:

• Enforce tagging standards across all AWS accounts in an organization in a single command.
• Run compliance policies (e.g., encryption, public access checks) on multiple Azure subscriptions in parallel.
• Generate a cross-account report of non-compliant resources and remediation actions taken.
• Validate policy syntax and variable expansion before deploying to production accounts.
• Execute cleanup scripts (e.g., terminate orphaned resources) across GCP projects with environment variables injected.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Runs Cloud Custodian policies in parallel across multiple AWS accounts, Azure subscriptions, GCP projects, or OCI tenancies from a single configuration file.

Yes. c7n-org is actively maintained, has low install friction, carries no known vulnerabilities, and solves a real operational need for anyone managing multiple cloud accounts. The permissive Apache-2.0 license removes legal friction. Install it if you use Cloud Custodian and manage more than one account or subscription.

Install

c7n-org on PyPI

pip install c7n-org

uv add c7n-org

poetry add c7n-org

Installing c7n-org

Before you install

Low install friction; depends only on c7n and click. Active maintenance with a release 78 days ago and continuous repository activity.

License in practice

Apache-2.0 permissive license; you can use, modify, and distribute this package freely in commercial and private projects without restriction.

Quickstart

pip install c7n-org

# Create accounts.yml with your account configuration
# Then run policies across accounts:
c7n-org run -c accounts.yml -s output -u policy.yml

Requires Python 3.9.2 or later (up to 3.x); cloud credentials (AWS IAM role, Azure credentials, GCP service account, or OCI config) must be configured before execution.

Verify before relying

• Whether parallel execution across regions is truly automatic by default or requires explicit configuration.
• Performance characteristics and typical execution time for large account sets.
• Whether the package handles credential rotation or session refresh during long-running multi-account operations.

Package facts

Evidence: c7n_org-0.6.50-py3-none-any.whl

Tags

More Distributed Computing packages