aws.log-group

Filters

config-compliance

cross-account

event

finding

kms-key

last-write

list-item

marked-for-op

metrics

ops-item

reduce

subscription-filter

tag-count

value

cross-account

Check a resource’s embedded iam policy for cross account access.

Permissions - logs:DescribeSubscriptionFilters

kms-key

Filter a resource by its associated kms key and optionally the aliasname of the kms key by using ‘c7n:AliasName’

example:

Match a specific key alias:

policies:
    - name: dms-encrypt-key-check
      resource: dms-instance
      filters:
        - type: kms-key
          key: "c7n:AliasName"
          value: alias/aws/dms

Or match against native key attributes such as KeyManager, which more explicitly distinguishes between AWS and CUSTOMER-managed keys. The above policy can also be written as:

policies:
    - name: dms-aws-managed-key
      resource: dms-instance
      filters:
        - type: kms-key
          key: KeyManager
          value: AWS

Permissions - kms:ListKeys, tag:GetResources, kms:ListResourceTags, kms:DescribeKey

last-write

Filters CloudWatch log groups by last write

example:

policies:
  - name: cloudwatch-stale-groups
    resource: log-group
    filters:
      - type: last-write
        days: 60

Permissions - logs:DescribeLogStreams

Actions

auto-tag-user

copy-related-tag

delete

invoke-lambda

invoke-sfn

mark-for-op

notify

post-finding

post-item

put-metric

put-subscription-filter

remove-tag

rename-tag

retention

set-encryption

tag

webhook

delete

example:

policies:
  - name: cloudwatch-delete-stale-log-group
    resource: log-group
    filters:
      - type: last-write
        days: 182.5
    actions:
      - delete

Permissions - logs:DeleteLogGroup

put-subscription-filter

Create/Update a subscription filter and associate with a log group

example:

policies:
  - name: cloudwatch-put-subscription-filter
    resource: log-group
    actions:
      - type: put-subscription-filter
        filter_name: AllLambda
        filter_pattern: ip
        destination_arn: arn:aws:logs:us-east-1:1234567890:destination:lambda
        distribution: Random
        role_arn: "arn:aws:iam::{account_id}:role/testCrossAccountRole"

Permissions - logs:PutSubscriptionFilter

rename-tag

Rename an existing tag key to a new value.

example:

rename Application, and Bap to App, if a resource has both of the old keys then we’ll use the value specified by Application, which is based on the order of values of old_keys.

policies:
- name: rename-tags-example
  resource: aws.log-group
  filters:
    - or:
      - "tag:Bap": present
      - "tag:Application": present
  actions:
    - type: rename-tag
      old_keys: [Application, Bap]
      new_key: App

Permissions - tag:TagResources, tag:UntagResources

retention

Action to set the retention period (in days) for CloudWatch log groups

example:

policies:
  - name: cloudwatch-set-log-group-retention
    resource: log-group
    actions:
      - type: retention
        days: 200

Permissions - logs:PutRetentionPolicy

set-encryption

Encrypt/Decrypt a log group

example:

policies:
  - name: encrypt-log-group
    resource: log-group
    filters:
      - kmsKeyId: absent
    actions:
      - type: set-encryption
        kms-key: alias/mylogkey
        state: True

  - name: decrypt-log-group
    resource: log-group
    filters:
      - kmsKeyId: kms:key:arn
    actions:
      - type: set-encryption
        state: False

Permissions - logs:AssociateKmsKey, logs:DisassociateKmsKey, kms:DescribeKey