HLDModulesGovernance
v1.2 is unreleased — see v1.1 for the current stable release.
Policies
CSP (Cloud Custodian) and Host (Shell Script) policy definitions and execution history.
Policies
Policies define what to check and how to evaluate compliance. MCM supports two policy types: CSP Policies targeting cloud provider resources, and Host Policies targeting managed hosts.
CSP Policy (Cloud Custodian)
CSP policies target cloud provider resources (AWS, Azure, GCP) using Cloud Custodian YAML. The evaluation engine runs the YAML against the connected account and records which resources are non-compliant.
CSP Policy Fields
| Field | Type | Description |
|---|---|---|
name | string | Policy name |
description | string | What this policy enforces |
provider | AWS / Azure / GCP | Target cloud provider |
category | enum | Security, Cost, Compliance, Access, Networking, Tags |
severity | Low / Medium / High | Risk level if non-compliant |
status | Draft / Active | Draft policies are not evaluated |
groupId | string (optional) | Parent policy group |
scheduleEnabled | boolean | Whether automated evaluation is enabled |
schedule | cron expression | e.g. 0 2 * * * — daily at 02 |
scheduleTimezone | string | e.g. UTC, America/New_York |
resourceTarget | string | Cloud Custodian resource type, e.g. aws.ec2 |
yaml | string | Full Cloud Custodian YAML policy definition |
CSP Execution History Fields
Each evaluation run records the following:
| Field | Description |
|---|---|
accountId / accountName | Cloud account the policy ran against |
status | Success, Partial, or Failed |
duration | Wall-clock time to complete the evaluation |
triggeredBy | "System" for scheduled runs, or the user email for manual triggers |
nonComplianceResources | Count of cloud resources that violated the policy |
error | Error message if the run failed or was partial |
executionTime | ISO datetime of when the run started |
Host Policy (Shell Script)
Host policies target managed hosts (Ubuntu, Windows) by running a shell script. Compliance is determined by comparing the script's stdout against a declared expected output string.
Host Policy Fields
| Field | Type | Description |
|---|---|---|
name | string | Policy name |
description | string | What this policy checks |
provider | Ubuntu / Windows | Target host OS |
category | enum | Security, Cost, Compliance, Access, Networking, Tags |
severity | Low / Medium / High | Risk level if non-compliant |
status | Draft / Active | Draft policies are not evaluated |
groupId | string (optional) | Parent policy group |
scheduleEnabled | boolean | Whether automated evaluation is enabled |
schedule | cron expression | e.g. 0 0 * * * — daily at midnight |
scheduleTimezone | string | e.g. UTC |
shellType | bash / sh / powershell | Shell interpreter |
script | string | Shell script to execute on the host |
complianceExpectedOutput | string | If script stdout matches this, the host is compliant |
remediationAvailable | boolean | Whether a remediation script is defined |
remediationScript | string (optional) | Shell script to run when the host is non-compliant |
autoRemediation | boolean | Whether remediation runs automatically on failure |
Host Execution History Fields
| Field | Description |
|---|---|
accountId / accountName | Host identifier and display name |
status | Success, Partial, or Failed |
duration | Time taken to run the script |
triggeredBy | "System" for scheduled, or user email for manual |
error | Error message if execution failed or output did not match |
executionTime | ISO datetime of the run |