CLOUDCUSTODIAN

AWS ACM health

6 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

Count AWS ACM certificates that are unused, Expiring, or expired and failed status.

Tasks:

• Check for unused ACM certificates in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Check for Expiring ACM certificates in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Check for expired ACM certificates in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Check for Failed Status ACM Certificates in AWS Region `${AWS_REGION}` in AWS Account `${AWS_ACCOUNT_ID}`
• Check for Pending Validation ACM Certificates in AWS Region `${AWS_REGION}` in AWS Account `${AWS_ACCOUNT_ID}`
• Generate Health Score

Source Code

AWS ACM health

5 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

List AWS ACM certificates that are unused, Expiring, or expired and failed status.

Tasks:

• List Unused ACM Certificates in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`
• List Expiring ACM Certificates in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`
• List Expired ACM Certificates in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`
• List Failed Status ACM Certificates in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`
• List Pending Validation ACM Certificates in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`

Source Code Discoverable

AWS EC2 Health

4 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

Count the number of EC2 instances that are stale or stopped

Tasks:

• Check for stale AWS EC2 instances in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Check for stopped AWS EC2 instances in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Check for invalid AWS Auto Scaling Groups in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Generate Health Score

Source Code

AWS EC2 Health

3 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

Check for EC2 instances that are stale or stopped

Tasks:

• List stale AWS EC2 instances in AWS Region `AWS_REGION` in AWS account `AWS_ACCOUNT_ID`
• List stopped AWS EC2 instances in AWS Region `AWS_REGION` in AWS account `AWS_ACCOUNT_ID`
• List invalid AWS Auto Scaling Groups in AWS Region AWS_REGION in AWS account AWS_ACCOUNT_ID

Source Code Discoverable

AWS network health

5 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

Count publicly accessible security groups, unused EIPs, unused ELBs, and VPCs with flow logs disabled

Tasks:

• Check for publicly accessible security groups in AWS account `${AWS_ACCOUNT_ID}`
• Check for unused Elastic IPs in AWS account `${AWS_ACCOUNT_ID}`
• Check for unused ELBs in AWS account `${AWS_ACCOUNT_ID}`
• Check for VPCs with Flow Logs disabled in AWS account `${AWS_ACCOUNT_ID}`
• Generate Health Score

Source Code

AWS network health

4 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

List publicly accessible security groups, unused EIPs, unused ELBs, and VPCs with flow logs disabled

Tasks:

• List Publicly Accessible Security Groups in AWS account `AWS_ACCOUNT_ID`
• List unused Elastic IPs in AWS account `AWS_ACCOUNT_ID`
• List unused ELBs in AWS account `AWS_ACCOUNT_ID`
• List VPCs with Flow Logs Disabled in AWS account `AWS_ACCOUNT_ID`

Source Code Discoverable

AWS RDS health

4 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

Check AWS RDS instances that are unencrypted, publicly accessible, or have backups disabled.

Tasks:

• Check for unencrypted RDS instances in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Check for publicly accessible RDS instances in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Check for disabled backup RDS instances in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Generate Health Score

Source Code

AWS RDS health

3 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

List AWS RDS instances that are unencrypted, publicly accessible, or have backups disabled.

Tasks:

• List Unencrypted RDS Instances in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`
• List Publicly Accessible RDS Instances in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`
• List RDS Instances with Backups Disabled in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`

Source Code Discoverable

AWS S3 Health

1 Troubleshooting Commands

Contributed by stewartshea

Codecollection: aws-c7n-codecollection

---

Counts the number of S3 buckets in an Account that are insecure or unhealthy.

Tasks:

• Count S3 Buckets With Public Access in AWS Account `${AWS_ACCOUNT_NAME}`

Source Code

AWS S3 Health

1 Troubleshooting Commands

Contributed by stewartshea

Codecollection: aws-c7n-codecollection

---

Generates a report on S3 buckets in an Account that are insecure or unhealthy.

Tasks:

• List S3 Buckets With Public Access in AWS Account `AWS_ACCOUNT_NAME`

Source Code Discoverable

AWS CloudWatch Logs health

4 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

Check AWS Monitoring Configuration Health

Tasks:

• Check CloudWatch Log Groups Without Retention Period in AWS Region `${AWS_REGION}` in AWS account `${AWS_ACCOUNT_ID}`
• Check if CloudTrail exists and is configured for multi-region in AWS Region `${AWS_REGION}` in AWS Account `${AWS_ACCOUNT_ID}`
• Check CloudTrail Without CloudWatch Logs in AWS Region `${AWS_REGION}` in AWS Account `${AWS_ACCOUNT_ID}`
• Generate Health Score

Source Code

AWS CloudWatch Logs health

3 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

Check AWS Monitoring Configuration Health

Tasks:

• List CloudWatch Log Groups Without Retention Period in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`
• Check CloudTrail Configuration in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`
• Check for CloudTrail integration with CloudWatch Logs in AWS Region `AWS_REGION` in AWS Account `AWS_ACCOUNT_ID`

Source Code Discoverable

AWS EBS Health

4 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

Counts the number of EBS resources by identifying unattached volumes, unused and aged snapshots, and unencrypted volumes.

Tasks:

• Check Unattached EBS Volumes in `${AWS_REGION}`
• Check Unencrypted EBS Volumes in `${AWS_REGION}`
• Check Unused EBS Snapshots in `${AWS_REGION}`
• Generate EBS Score

Source Code

AWS EBS Health

3 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: aws-c7n-codecollection

---

Check for AWS EBS resources by identifying unattached volumes, unused snapshots, and unencrypted volumes.

Tasks:

• List Unattached EBS Volumes in AWS Region `AWS_REGION` in AWS account `AWS_ACCOUNT_ID`
• List Unencrypted EBS Volumes in AWS Region `AWS_REGION` in AWS account `AWS_ACCOUNT_ID`
• List Unused EBS Snapshots in AWS Region `AWS_REGION` in AWS account `AWS_ACCOUNT_ID`

Source Code Discoverable

Azure Virtual Machine Health

11 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: azure-c7n-codecollection

---

Count Virtual machines that are publicly accessible, have high CPU usage, underutilized memory, stopped state, unused network interfaces, and unused public IPs in Azure

Tasks:

• Check Azure VM Health in resource group `${AZURE_RESOURCE_GROUP}`
• Check for VMs With Public IP in resource group `${AZURE_RESOURCE_GROUP}`
• Check for Stopped VMs in resource group `${AZURE_RESOURCE_GROUP}`
• Check for VMs With High CPU Usage in resource group `${AZURE_RESOURCE_GROUP}`
• Check for Underutilized VMs Based on CPU Usage in resource group `${AZURE_RESOURCE_GROUP}`
• Check for VMs With High Memory Usage in resource group `${AZURE_RESOURCE_GROUP}`
• Check for Underutilized VMs Based on Memory Usage in resource group `${AZURE_RESOURCE_GROUP}`
• Check for Unused Network Interfaces in resource group `${AZURE_RESOURCE_GROUP}`
• Check for Unused Public IPs in resource group `${AZURE_RESOURCE_GROUP}`
• Check VMs Agent Status in resource group `${AZURE_RESOURCE_GROUP}`
• Generate Health Score

Source Code

Azure Virtual Machine Health

10 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: azure-c7n-codecollection

---

List Virtual machines that are publicly accessible, have high CPU usage, underutilized memory, stopped state, unused network interfaces, and unused public IPs in Azure

Tasks:

• List VMs Health in resource group `AZURE_RESOURCE_GROUP`
• List VMs With Public IP in resource group `AZURE_RESOURCE_GROUP`
• List Stopped VMs in resource group `AZURE_RESOURCE_GROUP`
• List VMs With High CPU Usage in resource group `AZURE_RESOURCE_GROUP`
• List Underutilized VMs Based on CPU Usage in resource group `AZURE_RESOURCE_GROUP`
• List VMs With High Memory Usage in resource group `AZURE_RESOURCE_GROUP`
• List Underutilized VMs Based on Memory Usage in resource group `AZURE_RESOURCE_GROUP`
• List Unused Network Interfaces in resource group `AZURE_RESOURCE_GROUP`
• List Unused Public IPs in resource group `AZURE_RESOURCE_GROUP`
• List VMs Agent Status in resource group `AZURE_RESOURCE_GROUP`

Source Code Discoverable Troubleshooting CheatSheet

Azure Database Health

10 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: azure-c7n-codecollection

---

Count databases that are publicly accessible, without replication, without high availability configuration, with high CPU usage, high memory usage, high cache miss rate, low availability, and risky configuration changes in Azure

Tasks:

• Score Database Availability in resource group `${AZURE_RESOURCE_GROUP}`
• Count Publicly Accessible Databases in resource group `${AZURE_RESOURCE_GROUP}`
• Count Databases Without Replication in resource group `${AZURE_RESOURCE_GROUP}`
• Count Databases Without High Availability in resource group `${AZURE_RESOURCE_GROUP}`
• Count Databases With High CPU Usage in resource group `${AZURE_RESOURCE_GROUP}`
• Count Databases With High Memory Usage in resource group `${AZURE_RESOURCE_GROUP}`
• Count Redis Caches With High Cache Miss Rate in resource group `${AZURE_RESOURCE_GROUP}`
• Count Databases With Health Issues in resource group `${AZURE_RESOURCE_GROUP}`
• Count Risky Database Configuration Changes in resource group `${AZURE_RESOURCE_GROUP}`
• Generate Health Score

Source Code

Azure Database Health

9 Troubleshooting Commands

Contributed by saurabh3460

Codecollection: azure-c7n-codecollection

---

List databases that are publicly accessible, without replication, without high availability configuration, with high CPU usage, high memory usage, high cache miss rate, and low availability in Azure

Tasks:

• List Database Availability in resource group `AZURE_RESOURCE_GROUP`
• List Publicly Accessible Databases in resource group `AZURE_RESOURCE_GROUP`
• List Databases Without Replication in resource group `AZURE_RESOURCE_GROUP`
• List Databases Without High Availability in resource group `AZURE_RESOURCE_GROUP`
• List Databases With High CPU Usage in resource group `AZURE_RESOURCE_GROUP`
• List All Databases With High Memory Usage in resource group `AZURE_RESOURCE_GROUP`
• List Redis Caches With High Cache Miss Rate in resource group `AZURE_RESOURCE_GROUP`
• List Database Resource Health in resource group `AZURE_RESOURCE_GROUP`
• List Database Changes in resource group `AZURE_RESOURCE_GROUP`

Source Code Discoverable Troubleshooting CheatSheet