Cloud Custodian Tag Enforcement Filters Example

tag-enforce-filters-example

filters:
    - or:
        - "tag:ResourceContact": absent
        - not:
            - type: value
              key: "tag:ResourceContact"
              op: regex
              value: (^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$)
        - type: value
          key: "tag:ResourceContact"
          op: in
          value_from:
             url: s3://s3-bucket/InvalidEmails.csv
             format: csv2dict
        - "tag:BillingCostCenter": absent
        - type: value
          key: "tag:BillingCostCenter"
          op: not-in
          value_from:
             url: s3://s3-bucket/ValidCostCenters.csv
             format: csv2dict
        - "tag:Environment": absent
        - type: value
          key: "tag:Environment"
          op: not-in
          value:
            - tst
            - dev
            - mdl
            - acc
            - prd
            - eat
        - "tag:ResourcePurpose": absent
        - not:
            - type: value
              key: "tag:ResourcePurpose"
              op: regex
              value: ^.{3,}$
        - "tag:Division": absent
        - type: value
          key: "tag:Division"
          op: not-in
          value_from:
             url: s3://s3-bucket/ValidDivisions.csv
             format: csv2dict

This reads as: "If either the ResourceContact tag is absent/missing OR if the ResourceContact tag value doesn't match a email regex format, OR if the ResourceContact tag value is an email which has previously been marked as a bad email address, OR if the BillingCostCenter tag is absent/missing OR the BillingCostCenter tag value is NOT in our csv of approved cost centers OR if the Environment tag is absent/missing OR if the Environment tag value is not one of the following (tst, dev, mdl, acc, prd, eat) OR if the ResourcePurpose tag is absent/missing OR if the ResourcePurpose tag value is less then 3 characters long (not descriptive enough) OR if the Division tag is absent/missing OR if the Division tag value is NOT in our csv of approved Divisions.