c7n-left
c7n-left evaluates Cloud Custodian policies against Terraform infrastructure-as-code assets, so teams can check cloud resource definitions before applying th…
What c7n-left is
c7n-left evaluates Cloud Custodian policies against Terraform infrastructure-as-code assets, so teams can check cloud resource definitions before applying them. It evaluates Terraform root modules; remote module dependencies must be fetched with Terraform first. Policies can use standard Custodian filters, cover multiple resource types, filter taggable resources, and traverse resource relationships across multiple hops. The taggable-resource filter supports Terraform resources from AWS, Azure, GCP, OCI, and Tencent Cloud. Command-line filters narrow checks by policy or resource name, category, minimum severity, resource type, or ID. GitHub output can place findings in pull requests as annotations. By default, policy matches make a run exit with code 1, while `--warn-on` can turn selected matches into warnings. Tests pair Terraform files with YAML or JSON assertion plans. The package installs with `pip install c7n-left`; macOS and Linux support Python versions above 3.10, and Docker images are recommended for Windows. c7n-left is free and open source under Apache 2.0.
Good
- Free and open source under Apache 2.0.
- GitHub output reports findings as pull-request annotations.
- Policy tests use Terraform files and YAML or JSON plans.
- Signed Docker images include documented cosign verification.
- Policies can filter resources and traverse relationships.
Watch out
- Remote Terraform modules must be fetched before evaluation.
- Windows use is directed to Docker images.
- The command-line interface may change.
Who it suits
c7n-left suits cloud teams that want to check Terraform changes against Cloud Custodian policies, especially in CI systems. It is useful for teams working with supported cloud resources and pull-request workflows.
Verdict
c7n-left brings Cloud Custodian policy checks to Terraform assets, with filters, tests, and pull-request annotations. Account for the remote-module prerequisite and changing CLI when adding it to a workflow.
The facts
Each one read from c7n-left's own pages, with the date it was checked.
What it does
- CI integration
- Its GitHub output mode reports annotations directly into pull requests.checked 3 Oct 2001
- CLI stability
- The documentation warns that the command-line interface is subject to change.checked 3 Oct 2001
- Container security
- The project provides signed Docker images built on Chainguard's Wolfi Linux and documents verification with cosign.checked 3 Oct 2001
- Default failure behavior
- Policy matches cause the run to exit with code 1 by default, while `--warn-on` can make selected matches log as warnings instead.checked 3 Oct 2001
- Docker security
- The project provides signed Docker images based on Chainguard’s Wolfi Linux, and documents signature verification with cosign.checked 3 Oct 2001
- IaC input
- c7n-left evaluates Terraform root modules, and remote module dependencies must be fetched with Terraform before running it.checked 3 Oct 2001
- Install
- The package can be installed with `pip install c7n-left`.checked 3 Oct 2001
- Intended users
- The documentation says c7n-left is typically run in CI systems.checked 3 Oct 2001
- Known limitation
- Remote Terraform module dependencies must be fetched with Terraform before c7n-left runs.checked 3 Oct 2001
- Policy checks
- Policies can check Terraform resources using Custodian filters, including tag checks and multi-hop resource traversal.checked 3 Oct 2001
- Policy controls
- Command-line filters can select policies and resources by name, category, minimum severity, resource type, or ID.checked 3 Oct 2001
- Policy language
- Policies support standard Custodian filters, multiple resource types, taggable-resource filtering, and multi-hop resource graph traversal.checked 3 Oct 2001
- Policy testing
- c7n-left supports tests that match policy findings against assertions in plan files.checked 3 Oct 2001
- Policy tests
- c7n-left supports policy tests using Terraform files and YAML or JSON assertion plans.checked 3 Oct 2001
- Project and audience
- Cloud Custodian is an open-source rules engine for managing public cloud accounts and resources, with policies for security, compliance, tagging, and cost management.checked 3 Oct 2001
- Project scope
- Cloud Custodian supports AWS, Azure, and GCP, with Kubernetes, Tencent Cloud, and OpenStack support described as beta on its homepage.checked 3 Oct 2001
- Provider coverage
- The taggable filter supports Terraform resources from AWS, Azure, GCP, OCI, and Tencent Cloud providers.checked 3 Oct 2001
- Purpose
- c7n-left evaluates Cloud Custodian policies directly against infrastructure-as-code source assets.checked 3 Oct 2001
- Supported environments
- The package supports Python versions above 3.10 on macOS and Linux; the documentation recommends Docker images for Windows.checked 3 Oct 2001
Where it runs
- Install platforms
- The package supports Python above 3.10 on macOS and Linux, and recommends Docker images for Windows.checked 3 Oct 2001
Money
- License and price
- Cloud Custodian is open source, free for everyone to use, and distributed under the Apache 2.0 license.checked 3 Oct 2001
Alternatives to c7n-left
- 1
Aikido CSPM
Free planWebAPILinuxmacOS7.9From $300 a month - 2
Kyverno
Free planOpen sourceWebAPILinuxmacOS7.7Free plan - 3
Snyk Open Source
Free planWebAPILinuxmacOS7.5From $25 a month - 4
Fairwinds Polaris
Free planWebLinuxmacOSSelf-hosted7.1Free plan - 5
KloudSec IaC Security
Free planWebAPILinuxmacOS7.0From $79 a month - 6
kube-score
Free planWebLinuxmacOSSelf-hosted6.9Free plan