CLOUDCUSTODIAN

AWS ACM health

6 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

Count AWS ACM certificates that are unused, Expiring, or expired and failed status.

Tasks:

• Check for unused ACM certificates in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Check for Expiring ACM certificates in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Check for expired ACM certificates in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Check for Failed Status ACM Certificates in AWS Region `${AWS_REGION}` in AWS Account `${AWS_ACCOUNT_ID}`
• Check for Pending Validation ACM Certificates in AWS Region `${AWS_REGION}` in AWS Account `${AWS_ACCOUNT_ID}`
• Generate Health Score

Source Code

AWS ACM health

5 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

List AWS ACM certificates that are unused, Expiring, or expired and failed status.

Tasks:

• List Unused ACM Certificates in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`
• List Expiring ACM Certificates in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`
• List Expired ACM Certificates in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`
• List Failed Status ACM Certificates in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`
• List Pending Validation ACM Certificates in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`

Source Code Discoverable

AWS EC2 Health

4 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

Count the number of EC2 instances that are stale or stopped

Tasks:

• Check for stale AWS EC2 instances in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Check for stopped AWS EC2 instances in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Check for invalid AWS Auto Scaling Groups in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Generate Health Score

Source Code

AWS EC2 Health

3 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

Check for EC2 instances that are stale or stopped

Tasks:

• List stale AWS EC2 instances in AWS Region `AWS_REGION` in AWS account `AWS_ACCOUNT_ID`
• List stopped AWS EC2 instances in AWS Region `AWS_REGION` in AWS account `AWS_ACCOUNT_ID`
• List invalid AWS Auto Scaling Groups in AWS Region AWS_REGION in AWS account AWS_ACCOUNT_ID

Source Code Discoverable

AWS network health

5 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

Count publicly accessible security groups, unused EIPs, unused ELBs, and VPCs with flow logs disabled

Tasks:

• Check for publicly accessible security groups in AWS account `${AWS_ACCOUNT_ID}`
• Check for unused Elastic IPs in AWS account `${AWS_ACCOUNT_ID}`
• Check for unused ELBs in AWS account `${AWS_ACCOUNT_ID}`
• Check for VPCs with Flow Logs disabled in AWS account `${AWS_ACCOUNT_ID}`
• Generate Health Score

Source Code

AWS network health

4 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

List publicly accessible security groups, unused EIPs, unused ELBs, and VPCs with flow logs disabled

Tasks:

• List Publicly Accessible Security Groups in AWS account `AWS_ACCOUNT_ID`
• List unused Elastic IPs in AWS account `AWS_ACCOUNT_ID`
• List unused ELBs in AWS account `AWS_ACCOUNT_ID`
• List VPCs with Flow Logs Disabled in AWS account `AWS_ACCOUNT_ID`

Source Code Discoverable

AWS RDS health

4 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

Check AWS RDS instances that are unencrypted, publicly accessible, or have backups disabled.

Tasks:

• Check for unencrypted RDS instances in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Check for publicly accessible RDS instances in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Check for disabled backup RDS instances in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Generate Health Score

Source Code

AWS RDS health

3 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

List AWS RDS instances that are unencrypted, publicly accessible, or have backups disabled.

Tasks:

• List Unencrypted RDS Instances in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`
• List Publicly Accessible RDS Instances in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`
• List RDS Instances with Backups Disabled in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`

Source Code Discoverable

AWS S3 Health

1 Troubleshooting Commands

Contributed by stewartshea

Codecollection: aws-c7n-codecollection

---

Counts the number of S3 buckets in an Account that are insecure or unhealthy.

Tasks:

• Count S3 Buckets With Public Access in AWS Account `${AWS_ACCOUNT_NAME}`

Source Code

AWS S3 Health

1 Troubleshooting Commands

Contributed by stewartshea

Codecollection: aws-c7n-codecollection

---

Generates a report on S3 buckets in an Account that are insecure or unhealthy.

Tasks:

• List S3 Buckets With Public Access in AWS Account `AWS_ACCOUNT_NAME`

Source Code Discoverable

AWS CloudWatch Logs health

4 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

Check AWS Monitoring Configuration Health

Tasks:

• Check CloudWatch Log Groups Without Retention Period in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Check if CloudTrail exists and is configured for multi-region in AWS Region `${AWS_REGION}` in AWS Account `${AWS_ACCOUNT_ID}`
• Check CloudTrail Without CloudWatch Logs in AWS Region `${AWS_REGION}` in AWS Account `${AWS_ACCOUNT_ID}`
• Generate Health Score

Source Code

AWS CloudWatch Logs health

3 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

Check AWS Monitoring Configuration Health

Tasks:

• List CloudWatch Log Groups Without Retention Period in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`
• Check CloudTrail Configuration in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`
• Check for CloudTrail integration with CloudWatch Logs in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`

Source Code Discoverable

AWS EBS Health

4 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

Counts the number of EBS resources by identifying unattached volumes, unused and aged snapshots, and unencrypted volumes.

Tasks:

• Check Unattached EBS Volumes in `${AWS_REGION}`
• Check Unencrypted EBS Volumes in `${AWS_REGION}`
• Check Unused EBS Snapshots in `${AWS_REGION}`
• Generate EBS Score

Source Code

AWS EBS Health

3 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

Check for AWS EBS resources by identifying unattached volumes, unused snapshots, and unencrypted volumes.

Tasks:

• List Unattached EBS Volumes in AWS Region `AWS_REGION` in AWS account `AWS_ACCOUNT_ID`
• List Unencrypted EBS Volumes in AWS Region `AWS_REGION` in AWS account `AWS_ACCOUNT_ID`
• List Unused EBS Snapshots in AWS Region `AWS_REGION` in AWS account `AWS_ACCOUNT_ID`

Source Code Discoverable

Azure Virtual Machine Health

11 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: azure-c7n-codecollection

---

Count Virtual machines that are publicly accessible, have high CPU usage, underutilized memory, stopped state, unused network interfaces, and unused public IPs in Azure

Tasks:

• Check Azure VM Health in resource group `${AZURE_RESOURCE_GROUP}`
• Check for VMs With Public IP in resource group `${AZURE_RESOURCE_GROUP}`
• Check for Stopped VMs in resource group `${AZURE_RESOURCE_GROUP}`
• Check for VMs With High CPU Usage in resource group `${AZURE_RESOURCE_GROUP}`
• Check for Underutilized VMs Based on CPU Usage in resource group `${AZURE_RESOURCE_GROUP}`
• Check for VMs With High Memory Usage in resource group `${AZURE_RESOURCE_GROUP}`
• Check for Underutilized VMs Based on Memory Usage in resource group `${AZURE_RESOURCE_GROUP}`
• Check for Unused Network Interfaces in resource group `${AZURE_RESOURCE_GROUP}`
• Check for Unused Public IPs in resource group `${AZURE_RESOURCE_GROUP}`
• Check VMs Agent Status in resource group `${AZURE_RESOURCE_GROUP}`
• Generate Health Score

Source Code

Azure Virtual Machine Health

10 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: azure-c7n-codecollection

---

List Virtual machines that are publicly accessible, have high CPU usage, underutilized memory, stopped state, unused network interfaces, and unused public IPs in Azure

Tasks:

• List VMs Health in resource group `AZURE_RESOURCE_GROUP`
• List VMs With Public IP in resource group `AZURE_RESOURCE_GROUP`
• List Stopped VMs in resource group `AZURE_RESOURCE_GROUP`
• List VMs With High CPU Usage in resource group `AZURE_RESOURCE_GROUP`
• List Underutilized VMs Based on CPU Usage in resource group `AZURE_RESOURCE_GROUP`
• List VMs With High Memory Usage in resource group `AZURE_RESOURCE_GROUP`
• List Underutilized VMs Based on Memory Usage in resource group `AZURE_RESOURCE_GROUP`
• List Unused Network Interfaces in resource group `AZURE_RESOURCE_GROUP`
• List Unused Public IPs in resource group `AZURE_RESOURCE_GROUP`
• List VMs Agent Status in resource group `AZURE_RESOURCE_GROUP`

Source Code Discoverable Troubleshooting CheatSheet

Azure Database Health

9 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: azure-c7n-codecollection

---

Count databases that are publicly accessible, without replication, without high availability configuration, with high CPU usage, high memory usage, high cache miss rate, and low availability in Azure

Tasks:

• Score Database Availability in resource group `${AZURE_RESOURCE_GROUP}`
• Count Publicly Accessible Databases in resource group `${AZURE_RESOURCE_GROUP}`
• Count Databases Without Replication in resource group `${AZURE_RESOURCE_GROUP}`
• Count Databases Without High Availability in resource group `${AZURE_RESOURCE_GROUP}`
• Count Databases With High CPU Usage in resource group `${AZURE_RESOURCE_GROUP}`
• Count Databases With High Memory Usage in resource group `${AZURE_RESOURCE_GROUP}`
• Count Redis Caches With High Cache Miss Rate in resource group `${AZURE_RESOURCE_GROUP}`
• Count Databases With Health Issues in resource group `${AZURE_RESOURCE_GROUP}`
• Generate Health Score

Source Code

Azure Database Health

9 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: azure-c7n-codecollection

---

List databases that are publicly accessible, without replication, without high availability configuration, with high CPU usage, high memory usage, high cache miss rate, and low availability in Azure

Tasks:

• List Database Availability in resource group `AZURE_RESOURCE_GROUP`
• List Publicly Accessible Databases in resource group `AZURE_RESOURCE_GROUP`
• List Databases Without Replication in resource group `AZURE_RESOURCE_GROUP`
• List Databases Without High Availability in resource group `AZURE_RESOURCE_GROUP`
• List Databases With High CPU Usage in resource group `AZURE_RESOURCE_GROUP`
• List All Databases With High Memory Usage in resource group `AZURE_RESOURCE_GROUP`
• List Redis Caches With High Cache Miss Rate in resource group `AZURE_RESOURCE_GROUP`
• List Database Resource Health in resource group `AZURE_RESOURCE_GROUP`
• List Database Changes in resource group `AZURE_RESOURCE_GROUP`

Source Code Discoverable Troubleshooting CheatSheet