Cloud Custodian

ajkerrigan
Mar 18, 2026
Maintainer

What's Changed

multiple providers

core - Add ability to normalize tag keys in filters by @adamsgoldsmith in feat: Add ability to normalize tag keys in filters #10380
aws/azure/gcp - metric(s) filter - add start-of-day option by @iamanmolm in aws/azure/gcp - metric(s) filter - add start-of-day option #10573

aws

aws - cross-account joint condition of org id and wildcard by @jerryhxu in aws cross-account joint condition of org id and wildcard #10499
aws - implement the 'upgrade-available' filter for ElasticSearch by @toastdriven in feat: Implement the 'upgrade-available' filter for ElasticSearch. #10359
aws - implement the 'upgrade-available' filter for AWS EKS by @toastdriven in feat: Implement the 'upgrade-available' filter for AWS EKS. #10362
aws - fix S3 policy actions to refresh resource cache after bucket updates by @ChallaBharadwajReddy in aws(issue-10436) - Fix S3 policy actions to refresh resource cache after bucket updates #10455
aws - rds log when skipping cluster instance deletion by @calebsyring in fix: 10399 aws rds log when skipping cluster instance deletion #10506
aws - eventbridge - api by @Singha22 in AWS - Eventbridge - API #10515
aws - vpc - VpcEndpointPolicySupported filter by @ApogeeAC in aws - vpc - VpcEndpointPolicySupported filter #10507
aws - bedrock - inference profile resource by @calebsyring in aws - bedrock - inference profile resource #10566
aws - added cross-account filter to opensearch ingestion by @leslieetubo in aws - feat: added cross-account filter to opensearch ingestion. #10575
aws - add VPCLatticeListener resource by @toastdriven in feat: Added VPCLatticeListener resource. #10564
aws - use botocore's get_available_partitions instead of hardcoded REGION_PARTITION_MAP by @b177y in Use botocore's get_available_partitions instead of hardcoded REGION_PARTITION_MAP #10135
aws - transfer family web apps by @mattheidelbaugh in aws - transfer family web apps #10480
aws - directconnect add gateway and vif resources by @calebsyring in feat: 10211 aws directconnect add gateway and vif resources #10482
aws - add BedrockModelInvocationJob resource by @toastdriven in feat: Added BedrockModelInvocationJob resource. #10568
aws - remove sqs statements without sid by @calebsyring in fix: 10098 aws remove sqs statements without sid #10493
aws - fix querying Cloudfront WAFv2 in other regions by @toastdriven in bug: Fixed an issue where querying Cloudfront WAFv2 in other regions would fail. #10488
aws - fix GuardDuty filter validation by @germangarces in Fix GuardDuty filter validation #10472
aws - delete managed event rule target by @calebsyring in fix: 10308 aws delete managed event rule target #10492
aws - ebs gp3 modify iops by @calebsyring in fix: 10015 aws ebs gp3 modify iops #10478
aws - create an action for Config to enable/disable by @aholston in Create an action for AWS Config to enable/disable #10581
aws - adds detail_spec to vpc lattice service network resource by @leslieetubo in aws - adds detail_spec to vpc lattice service network resource. #10593
aws - add SavingsPlan resource by @toastdriven in feat: Added SavingsPlan resource. #10454
aws - ebs - handle InvalidVolume.NotFound when tagging EBS volumes by @nitrocode in fix(ebs): handle InvalidVolume.NotFound when tagging EBS volumes #10617
aws - iam-user - fix TypeError masking AccessDenied in DescribeUser augment by @Oluwatobi-Mustapha in aws/iam-user: fix TypeError masking AccessDenied in DescribeUser augment #10614
aws - add UserServiceSpecificCredentials to IAM by @toastdriven in feat: Added UserServiceSpecificCredentials to IAM. #10470
aws - WAF filter updated to allow for AWS Managed Rule Groups by @Singha22 in aws - WAF: Filter Updated to Allow for AWS Managed Rule Groups #10285
aws - bedrock - inference profile del action by @calebsyring in aws - bedrock - inference profile del action #10576
aws - ASG termination by @Singha22 in AWS - ASG Termination #10594
aws - add whitelist_patterns to cross-account filter to skip deleted IAM principals by @nitrocode in fix(filters): add whitelist_patterns to cross-account filter to skip deleted IAM principals #10618
aws - add OpensearchReservedInstance resource by @toastdriven in feat: Added OpensearchReservedInstance resource. #10465
aws - add ec2-image-metadata resource and filter by @ajkerrigan in aws - add ec2-image-metadata resource and filter #10610
aws - add VPCLatticeServiceNetworkAssociation resource by @toastdriven in feat: Added VPCLatticeServiceNetworkAssociation resource. #10567
aws - transfer connectors by @jflim in aws - transfer connectors #10615

gcp

gcp - fix for getting resource id instead of name when the metrics key is resource.labels.instance_id by @ChallaBharadwajReddy in gcp - fix for getting resource id instead of name when the metrics key is resourece.labels.instance_id #10305
gcp - big query + big table label actions by @calebsyring in GCP: Big Query + Big Table Label Actions #10557
gcp - enable set-label action for buckets by @calebsyring in GPC: Enable set-label Action for Buckets #10558
gcp - filter out the global static addresses for resource loadBalancingAddress by @ChallaBharadwajReddy in gcp-fix Filter out the global static addresses for resource loadBalancingAddress #10574
gcp - add set-iam-policy action for gcp.bucket by @mgogoulos in GCP - Add set-iam-policy action for gcp.bucket #10596
gcp - enable set-label action for multiple resources by @KodyMullins in GCP : Enable set-label action for multiple resources #10585
gcp - iam-policy filter - add value filter semantics and remove-bindings: matched by @mgogoulos in feat: gcp - iam-policy filter - add value filter semantics and remove-bindings: matched #10608
gcp - add vertex ai and vertex batch processing job resources by @KodyMullins in GCP - Add vertex ai and Vertex Batch processing job resources #10597
gcp - use empty string for aws partition, test policy loading by @ajkerrigan in gcp - use empty string for aws partition, test policy loading #10631

azure

azure - fix metrics start-of-day test by @ajkerrigan in azure - fix metrics start-of-day test #10606
azure - add new StorageMetricsFilter class and tests by @KodyMullins in Azure - Add new StorageMetricsFilter class and tests. #10587
azure - add several more Azure Entra ID resources by @licquia in feat: Add several more Azure Entra ID resources. #10429
azure - add tag actions to azure subscription resource by @KodyMullins in AZ - Add tag actions to azure subscription resource. #10632

shift-left

c7n-left - gracefully handle uuids that aren't references by @ajkerrigan in c7n-left - gracefully handle uuids that aren't references #10616

docs

docs - document release process by @ajkerrigan in docs - document release process #10547
docs - update maintainer list by @ajkerrigan in docs - update maintainer list #10548
docs - add dmytro-afanasiev as a maintainer by @ajkerrigan in docs - add dmytro-afanasiev as a maintainer #10612

releng

releng - exclude bandit's hardcoded password check by @ajkerrigan in releng - exclude bandit's hardcoded password check #10529
releng - make aws-accounts script a cli command in c7n_org by @jordanst3wart in make aws-accounts script a cli command in c7n_org #10462
releng - fix failing functional tests by @ajkerrigan in tests - fix failing functional tests #10519
releng - bump versions for 0.9.50, update deps, fix test edge cases by @ajkerrigan in releng - bump versions for 0.9.50, update deps, fix test edge cases #10599
releng - bump pyasn1 from 0.6.1 to 0.6.2 by @dependabot[bot] in Bump pyasn1 from 0.6.1 to 0.6.2 #10522
releng - bump protobuf from 6.33.4 to 6.33.5 by @dependabot[bot] in Bump protobuf from 6.33.4 to 6.33.5 #10554

schema changes

aws.bedrock-inference-profile added
aws.bedrock-model-invocation-job added
aws.directconnect-gateway added
aws.directconnect-virtual-interface added
aws.ec2-instance-ami added
aws.event-api-destination added
aws.opensearch-reserved added
aws.savings-plan added
aws.transfer-connector added
aws.transfer-web-app added
aws.vpc-lattice-listener added
aws.vpc-lattice-service-network-association added
azure.entraid-authorization-policy added
azure.entraid-conditional-access-policy added
azure.entraid-named-location added
azure.entraid-security-defaults added
gcp.vertex-ai-batch-prediction-job added
gcp.vertex-ai-endpoint added
gcp.vertex-ai-location added
aws.config-recorder
- added actions: toggle-recording
aws.ec2
- added filters: image-metadata
aws.eks
- added filters: upgrade-available
aws.elasticsearch
- added filters: upgrade-available
aws.iam-user
- added filters: service-specific-credentials
aws.opensearch-ingestion
- added filters: cross-account
aws.transfer-server
- added filters: network-location, security-group, subnet
aws.vpc-endpoint
- added filters: service-details
azure.storage
- added filters: storage-metrics
azure.subscription
- added actions: mark-for-op, tag, tag-trim, untag
- added filters: marked-for-op
gcp.artifact-repository
- added actions: mark-for-op, set-labels
- added filters: marked-for-op
gcp.bigtable-instance
- added actions: mark-for-op, set-labels
- added filters: marked-for-op
gcp.bq-dataset
- added actions: mark-for-op, set-labels
- added filters: marked-for-op
gcp.bq-table
- added actions: mark-for-op, set-labels
- added filters: marked-for-op
gcp.bucket
- added actions: mark-for-op, set-iam-policy, set-labels
- added filters: marked-for-op
gcp.certmanager-certificate
- added filters: marked-for-op
gcp.kms-cryptokey
- added actions: mark-for-op, set-labels
- added filters: marked-for-op

New Contributors

@jordanst3wart made their first contribution in make aws-accounts script a cli command in c7n_org #10462
@ChallaBharadwajReddy made their first contribution in gcp - fix for getting resource id instead of name when the metrics key is resourece.labels.instance_id #10305
@calebsyring made their first contribution in fix: 10399 aws rds log when skipping cluster instance deletion #10506
@ApogeeAC made their first contribution in aws - vpc - VpcEndpointPolicySupported filter #10507
@leslieetubo made their first contribution in aws - feat: added cross-account filter to opensearch ingestion. #10575
@b177y made their first contribution in Use botocore's get_available_partitions instead of hardcoded REGION_PARTITION_MAP #10135
@adamsgoldsmith made their first contribution in feat: Add ability to normalize tag keys in filters #10380
@aholston made their first contribution in Create an action for AWS Config to enable/disable #10581
@mgogoulos made their first contribution in GCP - Add set-iam-policy action for gcp.bucket #10596
@KodyMullins made their first contribution in Azure - Add new StorageMetricsFilter class and tests. #10587
@Oluwatobi-Mustapha made their first contribution in aws/iam-user: fix TypeError masking AccessDenied in DescribeUser augment #10614

Full Changelog: 0.9.49.0...0.9.50.0

This discussion was created from the release 0.9.50.0.

Replies: 0 comments

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment