Automating the Management of the Operational Health of Cloud Accounts at Scale
summary
Capital One runs Cloud Custodian across many AWS accounts plus custom Lambdas and a Dash monitoring app to enforce rules such as stop if CPU <1.5% over 14 days and instance age ≥14d, tag ownership, automated backups, and enforce no public resources. Servers older than 60 days are recycled for patching, service limits are auto-raised where possible, and tag validation and owner reassignment run automatically. A missing max-resources-percent circuit breaker once deleted ~50% of an environment; recovery took about four hours.
AI-written summary · about
chapters (31)
- 0:00Introduction
- 0:42Agenda
- 4:28Cloud Journey
- 5:13Public Cloud
- 7:33Cloud Custodian
- 8:05What is Cloud Custodian
- 9:48Cloud Custodian DSL
- 10:55Adding filters
- 12:32Actions
- 13:51Challenges
- 15:08Backups
- 15:37Cost Control
- 16:36Tagging
- 17:16Invalid Resources
- 18:07Service Limits
- 18:46Cloud Custodians
- 20:21IAM Role Separation
- 21:04Enterprise Policies
- 23:19Support Tickets
- 23:34Tag Validation
- 23:51Resource Owner Updates
- 24:26Resource Lookups
- 25:03Application Development
- 26:03Shift Left Concept
- 27:15Single Enterprise Pipeline
- 27:44Terraform Enterprise
- 28:01Direct Ticket Integration
- 28:25Automated Rebuilds
- 28:58Questions
- 29:47Conversations with regulators
- 29:59Respected by regulators
related talks
49mapproach for secure and resilient applications
26mContinuous Chaos in DevOps
14mPlatform engineering
49mCloud operations: A catalyst for innovation
57mBest practices for cloud governance at scale
21mSecuring hundreds of AWS accounts for streamlined governance
42mHow Citi advanced their containment capabilities through automation
21mBest Practices for Optimizing Your Cloud Spend with AI