---
id: c7n-org
version: "0.6.50"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# c7n-org — Cloud Custodian - Parallel Execution

License: permissive · Maintenance: active · Downloads: 6.9M/mo

## What it is and what it does

c7n-org is a command-line tool that extends Cloud Custodian to orchestrate policy execution across multiple cloud accounts or subscriptions in parallel. Instead of running policies account-by-account, you define all your accounts in a YAML configuration file and c7n-org distributes policy execution across them, collecting results into a structured output directory. It supports AWS (via Organizations API), Azure, GCP, and OCI, and provides filtering by account name, ID, tags, regions, and policies.

The tool operates in several modes: `run` executes Custodian policies across accounts, `run-script` executes arbitrary scripts with cloud credentials injected, `report` generates CSV summaries from policy results, `validate` checks policies without cloud access, and `aws-accounts` auto-generates AWS account configuration from your Organizations API. Variables defined per-account are interpolated into policies at execution time, allowing account-specific customization without duplicating policy files.

Use it for:

- Enforce tagging standards across all AWS accounts in an organization in a single command.
- Run compliance policies (e.g., encryption, public access checks) on multiple Azure subscriptions in parallel.
- Generate a cross-account report of non-compliant resources and remediation actions taken.
- Validate policy syntax and variable expansion before deploying to production accounts.
- Execute cleanup scripts (e.g., terminate orphaned resources) across GCP projects with environment variables injected.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Runs Cloud Custodian policies in parallel across multiple AWS accounts, Azure subscriptions, GCP projects, or OCI tenancies from a single configuration file.

Yes. c7n-org is actively maintained, has low install friction, carries no known vulnerabilities, and solves a real operational need for anyone managing multiple cloud accounts. The permissive Apache-2.0 license removes legal friction. Install it if you use Cloud Custodian and manage more than one account or subscription.

## Install

pip install c7n-org
uv add c7n-org
poetry add c7n-org

## Installing c7n-org

Before you install: Low install friction; depends only on c7n and click. Active maintenance with a release 78 days ago and continuous repository activity.

License in practice: Apache-2.0 permissive license; you can use, modify, and distribute this package freely in commercial and private projects without restriction.

Quickstart:

pip install c7n-org

# Create accounts.yml with your account configuration
# Then run policies across accounts:
c7n-org run -c accounts.yml -s output -u policy.yml

Requires Python 3.9.2 or later (up to 3.x); cloud credentials (AWS IAM role, Azure credentials, GCP service account, or OCI config) must be configured before execution.

Verify before relying:

- Whether parallel execution across regions is truly automatic by default or requires explicit configuration.
- Performance characteristics and typical execution time for large account sets.
- Whether the package handles credential rotation or session refresh during long-running multi-account operations.

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 6.9M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

multi-account cloud policy execution, parallel custodian across aws accounts, cloud resource governance at scale, cross-cloud compliance automation, batch policy enforcement multiple clouds, organization-wide cloud custodian, multi-subscription azure policy runner, cloud-governance, multi-account, infrastructure-automation

[View on SkillFed](https://skillfed.io/packages/c7n-org) · [View on PyPI](https://pypi.org/project/c7n-org/)