Cloud Custodian Unleashed: Automate and Dominate Cloud Governance

The talk looks at why posture scanning and shift-left checks alone leave gaps for a company running many AWS accounts. The speaker describes an environment spanning dozens of accounts and thousands of Terraform resources, where pipeline checks miss emergency changes, infrastructure created outside Terraform, and leaked credentials, and where default posture findings are noisy because they lack business context.

The core of the session is Cloud Custodian, an open-source tool that lets teams write AWS policies in YAML. Live demos cover using it as a query tool that exports non-compliant resources to a CSV report, a continuous alert on newly created security groups through AWS Config, and automated enforcement that re-enables S3 public access blocking within seconds of a change, triggered through CloudTrail, EventBridge and Lambda. A mark-and-sweep pattern is also shown: flag unused security groups with a tag, notify owners, and delete them only after a waiting period has passed.

The practical takeaways are less about the tool than the process. Start by identifying approved "green paths" for common workloads such as static websites, file storage and scheduled data jobs, build standard patterns around them, and deny or migrate deviations. Align policy filters with Terraform so the two do not fight, involve resource owners and agree on response deadlines, and layer controls such as service control policies and origin access controls so one failing feature does not expose the stack. The demo policies and Terraform are published in a repository for anyone to try.