public-instance-audit.yml

policies:
  - name: public-instance-audit
    resource: ec2
    description: |
      Cloud Custodian Public Instance Audit
    comments: |
      Retrieve list of all instances that
      - are not in whitelist
      - attached to a public subnet
      - have public IP address
    mode:
      type: ec2-instance-state
      role: arn:aws:iam::1234567890:role/CloudCustodian 
      events:
        - pending
    filters:
      - not:
          - type: value
            key: "tag:Name"
            value: (david-VPN|davidi-Bastion)
            op: regex
      - or:
        - type: subnet 
          key: "tag:Name"
          op: regex
          value: ".*pub"
        - type: value
          key: "PublicIpAddress"
          value: not-null
      - and:
        - type: value
          key: VpcId
          value: vpc-12345678
    actions:
      - type: notify
        template: public-instance-audit.html
        slack_template: slack-public-instance-audit
        template_format: 'html'
        priority_header: '5'
        subject: 'Security Audit: Public EC2 Instance Launched'
        to:
          - <your-email-address-goes-here> 
          - slack://#<slack-channel>
        owner_absent_contact:
          - <your-email-address-goes-here>
        transport:
          type: sqs
          queue: https://sqs.us-east-1.amazonaws.com/1234567890/cloud-cloudcustodian