davidclin/cloudcustodian-policies

Cloud Custodian policy that logs unused security groups

cloudcustodian-policies's Issues

Custodian diagram

Hi. I like your diagram a lot and would love to use it in a presentation. The current image is exported on a white background. I tried using Gimp to make it transparent which worked on the background and didn't work on the text.

I had some questions too

• Do you give permission to use your diagram in private presentations?
• Would you export the diagram as a transparent image so I can use it with my black background presentation template?
• What is R3 and how does it pull the custodian configs ? Is this a CD pipeline ?
• Does custodian automatically create policy metrics or does that need to be configured?
• How do you stream logs for errors? Is this a private lambda or is this public or part of custodian ?
• Does R3 alert user on custodian action or is the lambda policy itself ?
• How does SQS send consolidated email every 15mins ? I thought each of the policy lambdas push a message to SQS, then the custodian-mailer pulls off the message every 5 minutes, and processes the notification against SES / Slack / Datadog, etc.

Thank you!

licence

Hi,

Thanks for your efforts here!

Would you be able to confirm the license for your work?

Eamonn

Slack webhook

@davidclin, could you please share how you deal with slack webhooks. I've tried the last custodian release, but got an error when executed a mailer:
Traceback (most recent call last):
File "/root/cloud-custodian/c7n_mailer/bin/c7n-mailer", line 11, in
load_entry_point('c7n-mailer', 'console_scripts', 'c7n-mailer')()
File "/root/cloud-custodian/tools/c7n_mailer/c7n_mailer/cli.py", line 146, in main
MailerSqsQueueProcessor(mailer_config, aws_session, logger).run()
File "/root/cloud-custodian/tools/c7n_mailer/c7n_mailer/sqs_queue_processor.py", line 126, in run
self.process_sqs_message(sqs_message)
File "/root/cloud-custodian/tools/c7n_mailer/c7n_mailer/sqs_queue_processor.py", line 145, in process_sqs_message
sqs_message = json.loads(zlib.decompress(base64.b64decode(body)))
File "/usr/lib/python3.5/json/init.py", line 312, in loads
s.class.name))
TypeError: the JSON object must be str, not 'bytes'

Not sure whether my settings are correct. Could you please share how you specify webhook in the configuration

s3-server access logging unable to pass region name

I'm trying to pass the region name variable into the policy

       - type: value
         key: "Logging"
         value: empty
       - type: value
         key: "Location.LocationConstraint"
         value_from:
            url: file:///.development/polices/env.json
            format: json
            expr: '{region}'
         value: '{region}'
         op: eq
         value_type: swap

The variable file JSON looks like :

{
   "us-east-1" : null ,
   "us-west-1" : "us-west-1"
 }

means for server access logging of s3 works fine with all regions bypassing the "Location.LocationConstraint" key as region name except for the region us-east-1 it should be null as shown in the above example
Any workaround this would be helpfull