Community Meeting Minutes 2022-08-29 #7713

castrojo · 2022-08-31T13:54:31Z

castrojo
Aug 31, 2022
Maintainer

C7n Community Meeting Minutes

August 29th 2022

:::info

URL: meet.google.com/mii-evqh-esh
Date: August 29th, 2022 (2:00 PM (ET) / 11:00 PM (PT) / 6PM (UTC))
Timezone Converter (Click me)
Agenda

Intros 10m
Agenda Items 20m
PR Party 30m

Meeting Contact: Jorge: [email protected]
Video Archive and Transcripts: https://mtngs.io/cloud-custodian/community-meetings/
:::

Agenda Item

Intros, etc.
Governance Updates
- See this GitHub issue for the latest draft revisions.
Governance as Code day CFPs are open!
We're testing Slack! Join us:
- Invite page
- This is beta, we'll kick the tyres for a bit and then decide when to move.

Weekly Stats

	Opened this week	Closed this week
Issues	30	20
PR's	58	57


New stars
New forks

Highlights:

[Sonny] Elasticache metrics: Elasticache metrics #7703
[Sonny] Each/Any support in value filters?
- k8s will need this

PR's Opened

💥 #5971: AWS Security Group Cidr Ingress bugfix
#7702: aws - dlm-policy - fix tags, add tag/remove-tag actions
💥 #7701: releng - sign docker images
#7700: Adding kms-key-gilter for secrets manager
#7698: Add FMS WAFv2 support for alb, cloudfront
💥 #7697: c7n_kube - mode/k8s-validator - add new validating admission controller mode
- TODO: Needs docs, architecture diagram, instructions -- tests done
#7696: Added query parameter support as AMI resource to Rds
#7692: core - recreate cache connection as needed
💥 #7688: feat: init skeleton for tencentcloud
#7687: tools/c7n-org - warn on AuthFailure when listing regions
#7684: core - value-from - fix issue with sqlkv cache
💥 #7682: aws - output - try to determine bucket region without a client
#7681: Add CreateNotebookInstance shortcut
#7680: aws - s3 sqs and sns - fix has-statement filter with action star
#7675: aws - workspaces - fix connection-status filter when there is no status
#7674: Added mark-for-op action and marked-for-op filter for FIS
#7673: aws - user-pool/identity-pool - add support for tagging
#7670: azure-blob-soft-delete
💥 #7669: releng - docker - swap out for buildx
#7668: Datalake registered location
#7666: aws - kms - more cross account condition keys
#7664: Azure sqlserver auditing
💥 #7659: core - sqlkv cache file
#7657: feat: Allow to pass role to "put_subscription_filter" Allow to pass IAM role to "put_subscription_filter" call #7609
#7654: Fix for VPC FlowLog issue VPC flow-logs policy Errors #7648
#7653: Fix for VPC FlowLog issue VPC flow-logs policy Errors #7648
#7652: feat: add lambda handler as parameter Support for lambda layers and how to adjust environment/handler? #7635
#7651: metrics - end_time round up 1 unit to include now
#7649: Fix for VPC FlowLog issue VPC flow-logs policy Errors #7648
#7645: aws - quotas - update quotas onto the default quotas
#7644: c7n-org - support vars in the script args
#7643: mailer - jinja get_date_age support seconds
#7642: c7n-org - no overwrite when merge acct tags to resource result
#7638: aws - actions - kms tagging
#7637: gcp - marked-for-op - fix to support actions with hyphens
#7636: releng - bump package versions for 0.9.18.0
#7632: aws - apigw cross-account, handle policy mangling and use correct default
#7631: offhour - escape tag restricted chars with uxx
#7630: gcp - also get project id from GCP_PROJECT env
#7629: gcp - metrics - start/end time need to end with Z
#7628: Add new count filter to the RDS and RDS Cluster resources
#7627: Only disable Stop/Termination Protection only when necessary
#7626: Added new resource securityContacts
#7624: gcp - sql - fix augment function in GCP SQL
#7622: aws.event-rule | Filter unknown arns and add event-bus as a valid target
#7621: releng - docs build - update cache keys to address stale cache issue
#7619: releng - docker update poetry version and update ubuntu base image
#7618: Aws.rds.cluster.paragroup.filter
#7617: Allow to pass role to subscription-filter Allow to pass IAM role to "put_subscription_filter" call #7609
#7614: Update URL for Meeting Archives
#7613: Add myself as admin contact for the project
#7611: aws - filters - add aws:SourceAccount support to cross-account filter
#7608: feat: add ec2 filter for disableApiStop attribute
#7607: fix: terminate only 'batch' number of instances a request
#7605: releng - update policystream to use 22.04 and remove libgit compilation
#7603: gcp - gke - add labels filters and actions
#7602: release - 0.9.18.0 - prep for release 0.9.18
#7601: lint - fix E275 findings from pycodestyle 2.9.0

PR's Closed

#7692: core - recreate cache connection as needed
#7687: tools/c7n-org - warn on AuthFailure when listing regions
#7684: core - value-from - fix issue with sqlkv cache
#7680: aws - s3 sqs and sns - fix has-statement filter with action star
#7676: dont merge
#7675: aws - workspaces - fix connection-status filter when there is no status
#7673: aws - user-pool/identity-pool - add support for tagging
#7669: releng - docker - swap out for buildx
#7659: core - sqlkv cache file
#7657: feat: Allow to pass role to "put_subscription_filter" Allow to pass IAM role to "put_subscription_filter" call #7609
#7653: Fix for VPC FlowLog issue VPC flow-logs policy Errors #7648
#7651: metrics - end_time round up 1 unit to include now
#7649: Fix for VPC FlowLog issue VPC flow-logs policy Errors #7648
#7645: aws - quotas - update quotas onto the default quotas
#7643: mailer - jinja get_date_age support seconds
#7642: c7n-org - no overwrite when merge acct tags to resource result
#7638: aws - actions - kms tagging
#7637: gcp - marked-for-op - fix to support actions with hyphens
#7636: releng - bump package versions for 0.9.18.0
#7632: aws - apigw cross-account, handle policy mangling and use correct default
#7631: offhour - escape tag restricted chars with uxx
#7630: gcp - also get project id from GCP_PROJECT env
#7629: gcp - metrics - start/end time need to end with Z
#7628: Add new count filter to the RDS and RDS Cluster resources
#7627: Only disable Stop/Termination Protection only when necessary
#7624: gcp - sql - fix augment function in GCP SQL
#7622: aws.event-rule | Filter unknown arns and add event-bus as a valid target
#7621: releng - docs build - update cache keys to address stale cache issue
#7619: releng - docker update poetry version and update ubuntu base image
#7617: Allow to pass role to subscription-filter Allow to pass IAM role to "put_subscription_filter" call #7609
#7614: Update URL for Meeting Archives
#7613: Add myself as admin contact for the project
#7611: aws - filters - add aws:SourceAccount support to cross-account filter
#7608: feat: add ec2 filter for disableApiStop attribute
#7607: fix: terminate only 'batch' number of instances a request
#7605: releng - update policystream to use 22.04 and remove libgit compilation
#7602: release - 0.9.18.0 - prep for release 0.9.18
#7601: lint - fix E275 findings from pycodestyle 2.9.0
#7598: Make Terminate force=True work with Stop Protection
#7594: fix: skip incorrect action_date instead of failing c7n
#7592: Get Bucket Encryption Fails When No Encryption Configuration Is Present but KMS Bucket Key is Enabled
#7588: aws - cloudfront - support fetching with arns
#7586: tools/c7n-mailer - fix null exception of notify_action_to
#7578: Created a filter on account resource to check if s3 bucket i.e.registered for lake-formation belongs to same account or not
#7572: aws - quotas - include aws default service quotas
#7561: AWS - Connect - Create new Connect resource and instance-attribute filter
#7538: tools/c7n_mailer - support for gcp
#7525: aws - sns and sqs- add reusable "has-statement" filter
#7499: aws-cross-az-nat-gw-filter
#7498: gcp - gcp-periodic - trigger type is http, fix for delta_resource, require service-account
#7460: AWS - Workspaces - Create filter for workspaces directory connection aliases
#7307: aws - metrics - align metric window with cloudwatch retention schedule
#7273: aws - rename and update lakeformation resource
#7252: Fsx backup checks
#7221: slack_delivery: Allow using email address in tag's value
#6907: releng - docker builds with buildx
#5885: aws - apigw cross-account, handle policy mangling and use correct default

Issues Opened

#7699: Incorrect parsing of Data LifeCycle Manager policy tags
#7695: GetBucketLocation api failure for cross region buckets
💥 #7694: Add ECR metrics filter support
#7693: sqlkvcache errors when using value_from
#7691: Add various Connect resource types and implement tagging filter/action
#7690: Add Glue Connections tagging filter and action
💥 #7686: Added c7n:Id to resources.json
#7685: AWS GovCloud c7n-org AuthFailure
#7683: aws.service-quota usage-filter exception
#7679: AttributeError: __enter__ from SqlKvCache when using value_from
#7678: s3-public-block-enable-all
#7665: Add KMS condition key handlers for cross-account filter
#7662: Investigate moving chat/support to slack
#7661: Not working on isolated subnet due to global sts endpoint timeout
#7660: Any way to filter on tags for Cognito identity-pool or user-pool?
#7656: Cloud custodian v0.9.18.0 is not able to find our policy file in the container
#7648: VPC flow-logs policy Errors
#7647: Add delete action and remove-statement action for secrets manager
#7646: Add KMS filter for Secrets Manager
#7641: aws.iam-role - [ERROR] ClientError: An error occurred (Throttling) when calling the SimulatePrincipalPolicy operation (reached max retries: 4): Rate exceeded
#7639: AttributeError: 'list' object has no attribute 'get'
#7635: Support for lambda layers and how to adjust environment/handler?
#7634: UnitTests using assertTrue(x, y) instead of assertEqual(x, y)
#7623: GCP mark(ed)-for-op support op that contains hyphen
#7620: ci - doc builds not using cache and thus taking excess time
#7612: DocumentDB offHours downtime support
#7610: Policy using resource: iam-policy recieves UnrecognizedClientException during dry-run in GovCloud
#7609: Allow to pass IAM role to "put_subscription_filter" call
#7600: CI lint failing with E275 errors in pycodestyle 2.9.0
#7599: GuardDuty support for newer resources

Issues Closed

#7685: AWS GovCloud c7n-org AuthFailure
#7679: AttributeError: __enter__ from SqlKvCache when using value_from
#7678: s3-public-block-enable-all
#7660: Any way to filter on tags for Cognito identity-pool or user-pool?
#7623: GCP mark(ed)-for-op support op that contains hyphen
#7620: ci - doc builds not using cache and thus taking excess time
#7612: DocumentDB offHours downtime support
#7609: Allow to pass IAM role to "put_subscription_filter" call
#7600: CI lint failing with E275 errors in pycodestyle 2.9.0
#7597: [EC2] Force Terminate does not work when disableApiStop is set
#7583: Add Secrets Manager secrets resource
#7577: c7n-org Out of Memory (OOM) Condition When Running Merged Policy File Across 500+ Accounts
#7566: account-service-limits for s3
#7564: Error using event-rule invalid-targets filter
#7471: Add AWS Connect resource to Cloud custodian
#7248: AWS Workspaces 'c7n:ConnectionStatus' Failing
#6367: feat: Generic Helm Chart?
#6258: Cross account filter in rest-api returning error while execution
#5602: Use Bazel for better builds
#5182: memory usage increase - 0.8.45.0 upgrade

Chat Log

00:00:23.579,00:00:26.579
Jorge Castro: https://hackmd.io/l-3mUKN6SHam7SbWM41uhw

00:04:28.827,00:04:31.827
Kapil Thangavelu: Please fill out these forms in tripiclate ;-)

00:05:02.185,00:05:05.185
David Shepherd: LOL, You need to update your SAF Records and request a UTEP exception.

00:06:45.388,00:06:48.388
Jorge Castro: https://hackmd.io/l-3mUKN6SHam7SbWM41uhw

00:08:57.550,00:09:00.550
Jorge Castro: https://communityinviter.com/apps/cloud-custodian/c7n-chat

00:10:16.516,00:10:19.516
Kapil Thangavelu: K8s you later ;-) or now ;-)

00:19:49.689,00:19:52.689
Jorge Castro: #7697

00:20:03.864,00:20:06.864
Kapil Thangavelu: Re kubecon .. na 2022 ~ Detroit.. doing a custodian event at a cool game place (video games + drinks)

00:20:18.417,00:20:21.417
David Shepherd: nice.

00:20:41.319,00:20:44.319
David Shepherd: KubeconParties.com just went up.

00:20:57.776,00:21:00.776
Jorge Castro: I'll submit it!

00:24:58.513,00:25:01.513
Kapil Thangavelu: Tabling some topics for the end if time.. tencent cloud provider and shift-left re ongoing larger work items that are in progress.

00:41:34.582,00:41:37.582
Pratyush Mishra: #7695

00:42:29.142,00:42:32.142
Sonny Shi: re tencentcloud wonder if it's worth doing something like defining a top level 'provider' key in the policies file so you wont have to write out like 'tencentcloud.vm', same thing for the other providers. i dont think believe we support cross-provider policy collection right now anyway

00:43:12.521,00:43:15.521
Baby Surya Tejaswi Dulla (CONT): Hi everyone , This is Surya. Can we take a look at this PR #7709

00:43:25.002,00:43:28.002
Kapil Thangavelu: Yeah we’ve ruminated on a top level overlay key that inherits down to policies for common metadata and the like, would work here, albeit in this case its only on the prefix so perhaps not.

00:47:46.323,00:47:49.323
Baby Surya Tejaswi Dulla (CONT): Thank you !

00:50:37.588,00:50:40.588
Sonny Shi: c7n-left?

00:51:17.598,00:51:20.598
Jorge Castro: or c7n-infra?

00:54:08.517,00:54:11.517
Kapil Thangavelu: https://github.com/aquasecurity/defsec

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Cloud Custodian

Community Meeting Minutes 2022-08-29 #7713

{{title}}

Replies: 0 comments

Select a reply

Cloud Custodian

Community Meeting Minutes 2022-08-29 #7713

castrojo Aug 31, 2022 Maintainer

C7n Community Meeting Minutes

August 29th 2022

Agenda Item

Weekly Stats

Highlights:

PR's Opened

PR's Closed

Issues Opened

Issues Closed

Chat Log

Replies: 0 comments

castrojo
Aug 31, 2022
Maintainer