Governance

The Governance module allows organisations to define, enforce, and track compliance policies across connected cloud accounts (CSP) and managed hosts. Policies are organised into Groups — a named collection that aggregates compliance scores and provides a logical boundary for enforcement.

Provider Support

Supported

• AWS
• Azure
• Ubuntu

Not Supported

• GCP
• GitHub
• Docker Hub
• Docker

Architecture

Policy Evaluation Flow

1. Trigger — Either the cron scheduler fires (based on schedule + scheduleTimezone) or a user manually triggers a run.
2. Evaluation — For CSP, Cloud Custodian is invoked with the policy YAML against the target account. For Host, the shell script runs on the target host.
3. Result — The engine records an ExecutionRun with status, duration, non-compliant resource count (CSP) or expected-output mismatch (Host), and any error.
4. Score update — The group's complianceScore is recalculated as the percentage of policy runs in the last evaluation cycle that returned Success.

Compliance Score Calculation

A policy group's compliance score is derived as:

complianceScore = (successfulRuns / totalRuns) × 100

Where successfulRuns counts runs with status: "Success" across all member policies in the latest evaluation cycle. A run with status: "Partial" counts as a partial pass (0.5 weight).

Open-Source Tools

Roadmap