CLOUDCUSTODIAN

AWS S3 Health

1 Troubleshooting Commands

Contributed by stewartshea

Codecollection: aws-c7n-codecollection

---

Counts the number of S3 buckets in an Account that are insecure or unhealthy.

Tasks:

• Count S3 Buckets With Public Access in AWS Account `${AWS_ACCOUNT_NAME}`

Source Code

AWS S3 Health

1 Troubleshooting Commands

Contributed by stewartshea

Codecollection: aws-c7n-codecollection

---

Generates a report on S3 buckets in an Account that are insecure or unhealthy.

Tasks:

• List S3 Buckets With Public Access in AWS Account `AWS_ACCOUNT_NAME`

Source Code Discoverable

AWS RDS health

4 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

Check AWS RDS instances that are unencrypted, publicly accessible, or have backups disabled.

Tasks:

• Check for unencrypted RDS instances in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Check for publicly accessible RDS instances in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Check for disabled backup RDS instances in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Generate Health Score

Source Code

AWS RDS health

3 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

List AWS RDS instances that are unencrypted, publicly accessible, or have backups disabled.

Tasks:

• List Unencrypted RDS Instances in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`
• List Publicly Accessible RDS Instances in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`
• List RDS Instances with Backups Disabled in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`

Source Code Discoverable

AWS EC2 Health

4 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

Count the number of EC2 instances that are stale or stopped

Tasks:

• Check for stale AWS EC2 instances in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Check for stopped AWS EC2 instances in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Check for invalid AWS Auto Scaling Groups in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Generate Health Score

Source Code

AWS EC2 Health

3 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

Check for EC2 instances that are stale or stopped

Tasks:

• List stale AWS EC2 instances in AWS Region `AWS_REGION` in AWS account `AWS_ACCOUNT_ID`
• List stopped AWS EC2 instances in AWS Region `AWS_REGION` in AWS account `AWS_ACCOUNT_ID`
• List invalid AWS Auto Scaling Groups in AWS Region AWS_REGION in AWS account AWS_ACCOUNT_ID

Source Code Discoverable

AWS EBS Health

4 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

Counts the number of EBS resources by identifying unattached volumes, unused and aged snapshots, and unencrypted volumes.

Tasks:

• Check Unattached EBS Volumes in `${AWS_REGION}`
• Check Unencrypted EBS Volumes in `${AWS_REGION}`
• Check Unused EBS Snapshots in `${AWS_REGION}`
• Generate EBS Score

Source Code

AWS EBS Health

3 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

Check for AWS EBS resources by identifying unattached volumes, unused snapshots, and unencrypted volumes.

Tasks:

• List Unattached EBS Volumes in AWS Region `AWS_REGION` in AWS account `AWS_ACCOUNT_ID`
• List Unencrypted EBS Volumes in AWS Region `AWS_REGION` in AWS account `AWS_ACCOUNT_ID`
• List Unused EBS Snapshots in AWS Region `AWS_REGION` in AWS account `AWS_ACCOUNT_ID`

Source Code Discoverable

AWS network health

5 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

Count publicly accessible security groups, unused EIPs, unused ELBs, and VPCs with flow logs disabled

Tasks:

• Check for publicly accessible security groups in AWS account `${AWS_ACCOUNT_ID}`
• Check for unused Elastic IPs in AWS account `${AWS_ACCOUNT_ID}`
• Check for unused ELBs in AWS account `${AWS_ACCOUNT_ID}`
• Check for VPCs with Flow Logs disabled in AWS account `${AWS_ACCOUNT_ID}`
• Generate Health Score

Source Code

AWS network health

4 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

List publicly accessible security groups, unused EIPs, unused ELBs, and VPCs with flow logs disabled

Tasks:

• List Publicly Accessible Security Groups in AWS account `AWS_ACCOUNT_ID`
• List unused Elastic IPs in AWS account `AWS_ACCOUNT_ID`
• List unused ELBs in AWS account `AWS_ACCOUNT_ID`
• List VPCs with Flow Logs Disabled in AWS account `AWS_ACCOUNT_ID`

Source Code Discoverable