-
Notifications
You must be signed in to change notification settings - Fork 75
/
cfn-garbage-collection-audit.yml
42 lines (42 loc) · 1.32 KB
/
cfn-garbage-collection-audit.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
policies:
- name: cfn-garbage-collection-audit
resource: aws.cfn
description: |
Cloud Custodian CloudFormation Stack Garbage Collection
comments: |
Retrieve Delete old CloudFormation stacks matching given string
mode:
type: periodic
schedule: "rate(1 day)"
role: arn:aws:iam::111111111111:role/cloud_custodian_role_in_cross_account
filters:
- type: value
key: StackName
op: regex
value: ".*your_string_goes_here.*"
- type: value
key: CreationTime
op: greater-than
value_type: age
value: 3
actions:
- type: delete
force: true
- type: post-finding
severity_normalized: 10
types:
- "Software and Configuration Checks/AWS Security Best Practices"
- type: notify
template: cfn-garbage-collection-audit.html
slack_template: slack-cfn-garbage-collection-audit
template_format: 'html'
priority_header: '5'
subject: 'CloudFormation Garbage Collection Audit'
to:
- custodianadmins@email.com
- slack://#channel_name
owner_absent_contact:
- custodianadmins@email.com
transport:
type: sqs
queue: https://sqs.us-east-1.amazonaws.com/111111111111/cloud-cloudcustodian