Introduction to Cloud Custodian, simple rules for your Cloud, Cluster, and Terraform
summary
Cloud Custodian provides a single YAML policy engine that runs across AWS/Azure/GCP, Kubernetes and Terraform, with both pull and real-time admission controller modes, and a Terraform static analyzer shipped as c7n-left that wraps TF-parse. It enforces things like KMS encryption and SQS encryption, auto-tags or notifies owners, can deny creations via admission webhooks, produce CSV reports, run in CI/dry-run, and helped find $15k/month wasted GitLab runners; Helm chart mounts policies via a ConfigMap.
AI-written summary · about
chapters (25)
- 0:00Cloud Custodian intro
- 0:22What is Cloud Custodian
- 1:46Managing costs
- 3:12Ensuring compliance
- 3:54Enforcing correctness
- 5:19Policy examples
- 5:39Pull vs event-driven
- 7:03Software development lifecycle for policies
- 7:26Kubernetes support
- 8:28K8s policies demo
- 10:22Admission controller mode
- 13:09Terraform support
- 15:17TFParse for Terraform
- 16:20vs Open Policy Agent
- 17:43vs Kyverno
- 18:48Q&A 1
- 23:25Q&A 2
- 26:46Leftover resources
- 28:28Reporting formats
- 29:33Resource dependencies
- 31:01Policy examples
- 31:42Resources to catch up and get started
- 33:09K8s admission details
- 34:11Q&A 3
- 35:57Closing remarks
related talks
31mCommodified IaC using Terraform Cloud
52mTerraform Cloud Learn Lab: Validate Infrastructure and Enforce OPA Policies
05mLessons learned from building a cloud-native platform
44mEvolution of Infrastructure Management
18mA Cloud-Native Tool for the mass
31mA Comprehensive Approach to Cloud Security Posture Management
22mLessons Learned from Scaling Infrastructure as Code
50mFrom Code to Compliance: Enforcing Azure Security with Terraform and...