# cloud-custodian/cloud-custodian

Rules engine for cloud security, cost optimization, and governance, DSL in yaml for policies to query, filter, and take actions on resources

Repository: https://github.com/cloud-custodian/cloud-custodian
Canonical: https://ross.abutalabs.com/products/cloud-custodian
Homepage: https://cloudcustodian.io
Language: Python
License: Apache-2.0
License Family: permissive
Topics: aws, compliance, cloud, rules-engine, cloud-computing, management, serverless, gcp, azure, finops, kubernetes, oci, tencent-cloud, terraform
Last push: 2026-08-26T14:34:39+00:00

## Health v2 (maintenance only)
Score: 90/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 74, longevity 100
- inputs: {"age_days": 3838, "days_push": 7, "days_rel": 97, "gap_med": 63.0, "n_releases_24m": 11}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 6053, forks 1644 (observed 2026-08-28T04:09:34.656880+00:00)

## What it is
Cloud Custodian (c7n) is a Python-based stateless rules engine for managing public cloud accounts and resources via YAML policy DSLs with filters and actions. It enforces security, compliance, and cost-optimization policies across AWS, Azure, GCP, and other providers, running locally, on cron, or as provisioned serverless functions.

## Use cases
- enforce encryption and access compliance policies across cloud accounts
- turn off EC2 instances and ASGs off-hours to save cost
- garbage collect unused or untagged cloud resources
- enforce tag compliance and mark non-compliant resources for remediation
- run policy checks against terraform IaC in CI pipelines
- real-time remediation of cloud security events via serverless functions
- replace ad-hoc cloud management scripts with declarative policies

## When to choose
- you need unified governance, security, and cost management across AWS, Azure, and GCP
- you want declarative YAML policies instead of maintaining custom cloud scripts
- you need real-time enforcement via serverless event integration
- you want compliance-as-code with dry-run, metrics, and structured reporting

## When to avoid
- you only use on-premises or non-cloud infrastructure
- you need a full CSPM commercial product with dashboards and support
- you prefer imperative configuration management tools like Ansible for host-level tasks

## Facets
- artifact type: cli-tool
- maturity: stable
- function: security, configuration-management, workflow-automation, monitoring, infrastructure-as-code, cli, scheduling, webhook
- domain: cloud-computing, security, infrastructure-as-code, self-hosted
- platform: python, windows, serverless, cloud
- tags: cloud-governance, finops, policy-as-code, compliance-as-code, yaml-dsl, aws, azure, gcp, cost-optimization, cncf, devops, automation, linux, macos, docker

## Member repositories
- cloud-custodian/cloud-custodian (main) score 90

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:09:34.656880+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:48:54.930815+00:00, confidence not recorded.
  - readme: https://github.com/cloud-custodian/cloud-custodian (fetched 2026-08-28T04:09:34.656880+00:00, sha 58070d2ca2ec)
  - homepage: https://cloudcustodian.io (fetched 2026-08-29T08:45:21.740071+00:00, sha a88fbe7a780a)
  - site_page: https://cloudcustodian.io/getting-started (fetched 2026-08-29T08:45:21.742388+00:00, sha 517789f56965)
  - site_page: https://cloudcustodian.io/docs/index.html (fetched 2026-08-29T08:45:21.744346+00:00, sha 81b9f7965d45)
  - site_page: https://cloudcustodian.io/getting-started/filters (fetched 2026-08-29T08:45:21.746109+00:00, sha d8d172c5eec3)
  - site_page: https://cloudcustodian.io/getting-started/actions (fetched 2026-08-29T08:45:21.748136+00:00, sha 776a5ac377b4)
  - site_page: https://cloudcustodian.io/getting-started/advanced (fetched 2026-08-29T08:45:21.749700+00:00, sha 0fcf00fd708c)
  - site_page: https://cloudcustodian.io/getting-started/policyStructure (fetched 2026-08-29T08:45:21.751322+00:00, sha 29170b7708a8)
  - site_page: https://cloudcustodian.io/docs/quickstart/index.html (fetched 2026-08-29T08:45:21.752859+00:00, sha 341129685ca0)
  - site_page: https://cloudcustodian.io/docs/aws/examples/offhours.html (fetched 2026-08-29T08:45:21.754691+00:00, sha e1f94a477548)
- Data as of 2026-08-30T08:39:29.467469+00:00.