Features

• Cloud Watch Metric filters for all supported resources (great for finding unused resources)
• Cross Account access filters for all resources that support an iam access policy
• Extend Custodian with custom lambda functions as actions
• EBS snapshot action for copying encrypted snapshots cross region.
• RDS auto-patch action to ensure auto patch minor version maintenance is enabled.
• Script to restore instance from snapshots (tools/ec2restore.py)

Features

• New Resources (lambda, api gateway, kinesis, log groups, firehose)
• Invalid filter for autoscale groups can detect structurally invalid autoscale groups (invalid subnets, ami, snapshots, etc)
• Filter for log groups to detect last write to a group
• Delete action for log groups
• Rds snapshot resource (@ewbankkit)
• Metrics retrieval script (tools/policymetrics.py)

Bug fixes

• handle ami without snapshot id in ebs snapshot cleanup (@ewbankkit)
• redshift delete action bad session factory reference
• elb batch size 1 for tags per api requirements
• elb ignore policy not found due to concurrent activity (@ewbankkit)
• elb set-ssl-policy, handle extant policy with same name
• rds retention period / ensure db instance backup eligibility (@ewbankkit)
• ec2 stop is more tolerant of invalid state and auto filters params
• s3 missing policy statement, plays nice if there is no policy on a bucket
• asg not-encrypted filter plays nice if the ami is no longer present

• refactor internal query model to use skew
• version subcommand
• elb ssl-policy check now annotates elb with the protocol/settings that caused the match (brandon clodius)
• rds & elb tag support
• validation on duplicate policy names

• s3 large file support via multpart copy
• rds support for marked-for-op, mark-for-op
• elb support for marked-for-op, mark-for-op
• asg support for cwe events
• policies can now have tags (classification and grouping)
• config file supports vars section for yaml references to repeated config
• cwe has better support for multiple manually configured cloudtrail events in a single policy.
• tools/vocabulary.py to auto gen yaml file of valid policy language elements
• enforce policy name conventions via schema
• asg suspend and tag real world fixes (lower concurrency, and play nice with invalid instance states)
• cw logs fix to ensure log entries are in timestamped order
• s3 has statement filter

• s3 bucket policy remove-statements action
• s3 attach-encrypt realtime encryption
• fix for cli regression on reports introduced in 0.8.7

• new asg filters for image-age and launch-config
• new s3 filter is-log-target, that checks to see if the bucket is being logged to by elb, s3, cloudtrails.
• fix cli regression from 0.8.6

• pypy support (30% perf improve on s3 full scans)
• rds actions for manual snapshot and automatic backup retention configuration (joshua root)
• asg vpc filter
• when notifying on large resource sets, batch into groups of 500
• asg resume grace period before restarting asg suspended processes
• long name ops for value filters (equal, not-equal, etc) (kit ewbank)
• greatly improved test coverage

CHANGE LOG

• Feature: EC2 snapshot function
  • Created Snapshot class for creating EC2 snapshots
• Feature: Add an ELB action to set SSL listener policy
  • This action will create/attach Policy to ELB
  • This action can be used in conjunction with the SSL whitelist filter
• Bug Fix: Redshift Resource - If cache is empty, query
• Bug Fix: RDS/ELB Tag Support
  • Support added for RDS and ELB tagging
• Bug Fix: Formatters for RDS and ELB
• Feature: Add S3 'delete-global-grants' action
  • Remove global grants from bucket ACLs
  • Heuristically determine the grantee type
• Bug Fix: Pass Lambda Event to Actions
  • Pass Lambda event through to actions that want it

CHANGE LOG

• Reformat s3stat function
  • cleanup formatting on s3stat, use a cache of conns to CW, handle permission errors on buckets
  • add region to makefile
• Adding a fix to the ImageAge filter
  • Custodian was raising a NotImplementedError on ImageAge because the date_attribute property wasn't defined in the filter. Setting date_attribute = 'CreationDate' resolved the error.
• AMI and EBS formatters. S3 formatter tweaks
• Update functions without alias, cleanup log subscription permission id
  • functions without alias, cleanup log subscription permission id
  • speed up travis test execution, output test times
• Create cache folder if nonexistent
  • create cache folder if nonexistant
  • removing test_load
• Update s3stat.py to properly deal with multi-region
  • The results dict would show empty when the bucket was not in the same region that the boto3.Session() was established in. Not sure if it is a bug with cloudwatch or not, but this fix is working for my needs.
  • Crawl bucket region instead of all regions
• Add region to cache key, log transport test cleanup, gitter link
  • qualify cache keys with region, add gitter link to readme, cache save fails gracefully
  • .drone.yml dummy values for aws creds for log signing
  • cwl test, close handler to cleanup transport thread