Cloud Guardianship

This chapter looks at a tool open sourced from a UK bank called Cloud Custodian, which we will use to set up AWS policies and additionally automate the enforcement of those policies. Cloud Custodian was developed by Capital One and has gained deserved popularity over the years. The impetus for Cloud Custodian's Open Source distribution was reportedly its achievement of impressive cost savings. In addition to cost savings, organizing a collection of rulesets to professionals' advantage allows them to improve their visibility and the security posture of their infrastructure. EC2 instances are commonly tagged per environment for security monitoring, by cost center and it is also not uncommon to have tags relating to an instance's operational hours. Filters are generally easy to read but can become more complex and include regular expressions. The extensive compliance coverage of the examples is impressive.