Cloud Custodian can help you enforce a fleet of policies that control cloud costs, avoid potential breaches, and meet regulatory requirements across an ever-increasing number of cloud services and providers. You can review these documents for sample cloud custodian policies.

Cloud Custodian has numerous execution modes, most of which are cloud provider specific. Pull mode policies work across all cloud providers and are the default execution mode if no mode is specified in the policy being executed. Many of the following execution modes work by automatically provisioning serverless functions with the appropriate triggers when the policy is executed. For AWS you can execute policies in the following modes: pull, asg-instance-state, cloudtrail, config-poll-rule, config-rule, ec2-instance-state, guard-duty, hub-finding, periodic, and phd. For Azure you can execute policies in the following modes: pull, azure-event-grid, azure-periodic, container-event, and container-periodic. For GCP you can execute policies in the following modes: pull, gcp-audit, gcp-periodic, and gcp-scc. To see more details on the supported execution modes, see the Cloud Custodian Execution Modes docs – AWS, Azure, GCP.

Cloud Custodian synthesizes the complexity of policy authorship into simple YAML. Each policy is for a specific resource type and consists of a vocabulary of actions and filters that can run in different modes. At the most basic level, each policy must have a name and resource specified. Here is an example tag compliance policy for AWS. View policy 

Cloud Custodian has hundreds of built-in actions across its supported resources. At a high level, these actions include things like applying tags to resources, modifying resource attributes, deleting resources, sending notifications, triggering lambda functions, sending webhooks, and a lot more. Many actions are specific to the resource the policy is running against. To see the full list of supported resource actions, see the Cloud Custodian Reference docs – AWS, Azure, GCP.