c7n-left

Spec sheet

Purpose

c7n-left evaluates Cloud Custodian policies directly against infrastructure-as-code source assets.Read 3 Oct 2026 · cloudcustodian.io

Intended users

The documentation says c7n-left is typically run in CI systems.Read 3 Oct 2026 · cloudcustodian.io

CI integration

Its GitHub output mode reports annotations directly into pull requests.Read 3 Oct 2026 · cloudcustodian.io

CLI stability

The documentation warns that the command-line interface is subject to change.Read 3 Oct 2026 · cloudcustodian.io

Container security

The project provides signed Docker images built on Chainguard's Wolfi Linux and documents verification with cosign.Read 3 Oct 2026 · cloudcustodian.io

Default failure behavior

Policy matches cause the run to exit with code 1 by default, while `--warn-on` can make selected matches log as warnings instead.Read 3 Oct 2026 · cloudcustodian.io

Docker security

The project provides signed Docker images based on Chainguard’s Wolfi Linux, and documents signature verification with cosign.Read 3 Oct 2026 · cloudcustodian.io

IaC input

c7n-left evaluates Terraform root modules, and remote module dependencies must be fetched with Terraform before running it.Read 3 Oct 2026 · cloudcustodian.io

Install

The package can be installed with `pip install c7n-left`.Read 3 Oct 2026 · cloudcustodian.io

Install platforms

The package supports Python above 3.10 on macOS and Linux, and recommends Docker images for Windows.Read 3 Oct 2026 · cloudcustodian.io

Known limitation

Remote Terraform module dependencies must be fetched with Terraform before c7n-left runs.Read 3 Oct 2026 · cloudcustodian.io

License and price

Cloud Custodian is open source, free for everyone to use, and distributed under the Apache 2.0 license.Read 3 Oct 2026 · cloudcustodian.io

Policy checks

Policies can check Terraform resources using Custodian filters, including tag checks and multi-hop resource traversal.Read 3 Oct 2026 · cloudcustodian.io

Policy controls

Command-line filters can select policies and resources by name, category, minimum severity, resource type, or ID.Read 3 Oct 2026 · cloudcustodian.io

Policy language

Policies support standard Custodian filters, multiple resource types, taggable-resource filtering, and multi-hop resource graph traversal.Read 3 Oct 2026 · cloudcustodian.io

Policy testing

c7n-left supports tests that match policy findings against assertions in plan files.Read 3 Oct 2026 · cloudcustodian.io

Policy tests

c7n-left supports policy tests using Terraform files and YAML or JSON assertion plans.Read 3 Oct 2026 · cloudcustodian.io

Project and audience

Cloud Custodian is an open-source rules engine for managing public cloud accounts and resources, with policies for security, compliance, tagging, and cost management.Read 3 Oct 2026 · cloudcustodian.io

Project scope

Cloud Custodian supports AWS, Azure, and GCP, with Kubernetes, Tencent Cloud, and OpenStack support described as beta on its homepage.Read 3 Oct 2026 · cloudcustodian.io

Provider coverage

The taggable filter supports Terraform resources from AWS, Azure, GCP, OCI, and Tencent Cloud providers.Read 3 Oct 2026 · cloudcustodian.io

Supported environments

The package supports Python versions above 3.10 on macOS and Linux; the documentation recommends Docker images for Windows.Read 3 Oct 2026 · cloudcustodian.io

Where Specifiction places it

• Infrastructure as Code Security Software#17 of 227.7