# c7n-policystream: Policy Changes from Git
% [comment]: # ( !!! IMPORTANT !!! )
% [comment]: # (This file is moved during document generation.)
% [comment]: # (Only edit the original document at ./tools/c7n_policystream/README.md)
Using custodian in accordance with infrastructure as code principles,
we store policy assets in a versioned control repository. This
provides for an audit log and facilitates code reviews. However this
capability is primarily of use to humans making semantic interpretations
of changes.
This script also provides logical custodian policy changes over a git
repo and allows streaming those changes for machine readable/application
consumption. Its typically used as a basis for CI integrations or indexes
over policies.
Two example use cases:
- Doing dryrun only on changed policies within a pull request
- Constructing a database of policy changes.
Policystream works on individual github repositories, or per Github integration
across an organization's set of repositories.
## Install
policystream can be installed via pypi, provided the require pre-requisites
libraries are available (libgit2 > 0.26)
```
pip install c7n-policystream
```
Docker images available soon, see build for constructing your own.
## Build
Alternatively a docker image can be built as follows
```shell
# Note must be top level directory of checkout
cd cloud-custodian
docker build -t policystream:latest -f tools/c7n_policystream/Dockerfile .
docker run --mount src="$(pwd)",target=/repos,type=bind policystream:latest
```
## Usage
Streaming use case (default stream is to stdout, also supports kinesis, rdbms and sqs)
```
$ c7n-policystream stream -r foo
2018-08-12 12:37:00,567: c7n.policystream:INFO Cloning repository: foo
<policy-add policy:foi provider:aws resource:ec2 date:2018-08-02T15:13:28-07:00 author:Kapil commit:09cb85>
<policy-moved policy:foi provider:aws resource:ec2 date:2018-08-02T15:14:24-07:00 author:Kapil commit:76fce7>
<policy-remove policy:foi provider:aws resource:ec2 date:2018-08-02T15:14:46-07:00 author:Kapil commit:570ca4>
<policy-add policy:ec2-guard-duty provider:aws resource:ec2 date:2018-08-02T15:14:46-07:00 author:Kapil commit:570ca4>
<policy-add policy:ec2-run provider:aws resource:ec2 date:2018-08-02T15:16:00-07:00 author:Kapil commit:d3d8d4>
<policy-remove policy:ec2-run provider:aws resource:ec2 date:2018-08-02T15:18:31-07:00 author:Kapil commit:922c1a>
<policy-modified policy:ec2-guard-duty provider:aws resource:ec2 date:2018-08-12T09:39:43-04:00 author:Kapil commit:189ea1>
2018-08-12 12:37:01,275: c7n.policystream:INFO Streamed 7 policy changes
```
Policy diff between two source and target revision specs. If source
and target are not specified default revision selection is dependent
on current working tree branch. The intent is for two use cases, if on
a non-master branch then show the diff to master. If on master show
the diff to previous commit on master. For repositories not using the
`master` convention, please specify explicit source and target.
```
$ c7n-policystream diff -r foo -v
```
Pull request use, output policies changes between current branch and master.
```
$ c7n-policystream diff -r foo
policies:
- filters:
- {type: cross-account}
name: lambda-access-check
resource: aws.lambda
```
## Options
```
$ c7n-policystream --help
Usage: c7n-policystream [OPTIONS] COMMAND [ARGS]...
Policy changes from git history
Options:
--help Show this message and exit.
Commands:
diff Policy diff between two arbitrary revisions.
org-checkout Checkout repositories from a GitHub organization.
org-stream Stream changes for repos in a GitHub organization.
stream Stream git history policy changes to destination.
```
Raw data
{
"_id": null,
"home_page": "https://cloudcustodian.io",
"name": "c7n-policystream",
"maintainer": null,
"docs_url": null,
"requires_python": "<4.0,>=3.8",
"maintainer_email": null,
"keywords": null,
"author": "Cloud Custodian Project",
"author_email": null,
"download_url": null,
"platform": null,
"description": "# c7n-policystream: Policy Changes from Git\n\n% [comment]: # ( !!! IMPORTANT !!! )\n% [comment]: # (This file is moved during document generation.)\n% [comment]: # (Only edit the original document at ./tools/c7n_policystream/README.md)\n\nUsing custodian in accordance with infrastructure as code principles,\nwe store policy assets in a versioned control repository. This\nprovides for an audit log and facilitates code reviews. However this\ncapability is primarily of use to humans making semantic interpretations\nof changes.\n\nThis script also provides logical custodian policy changes over a git\nrepo and allows streaming those changes for machine readable/application\nconsumption. Its typically used as a basis for CI integrations or indexes\nover policies.\n\nTwo example use cases:\n\n - Doing dryrun only on changed policies within a pull request\n - Constructing a database of policy changes.\n\nPolicystream works on individual github repositories, or per Github integration\nacross an organization's set of repositories.\n\n## Install\n\npolicystream can be installed via pypi, provided the require pre-requisites\nlibraries are available (libgit2 > 0.26)\n\n```\npip install c7n-policystream\n```\n\nDocker images available soon, see build for constructing your own.\n\n## Build\n\nAlternatively a docker image can be built as follows\n\n```shell\n# Note must be top level directory of checkout\ncd cloud-custodian\n\ndocker build -t policystream:latest -f tools/c7n_policystream/Dockerfile .\n\ndocker run --mount src=\"$(pwd)\",target=/repos,type=bind policystream:latest\n```\n\n## Usage\n\nStreaming use case (default stream is to stdout, also supports kinesis, rdbms and sqs)\n\n```\n $ c7n-policystream stream -r foo\n 2018-08-12 12:37:00,567: c7n.policystream:INFO Cloning repository: foo\n <policy-add policy:foi provider:aws resource:ec2 date:2018-08-02T15:13:28-07:00 author:Kapil commit:09cb85>\n <policy-moved policy:foi provider:aws resource:ec2 date:2018-08-02T15:14:24-07:00 author:Kapil commit:76fce7>\n <policy-remove policy:foi provider:aws resource:ec2 date:2018-08-02T15:14:46-07:00 author:Kapil commit:570ca4>\n <policy-add policy:ec2-guard-duty provider:aws resource:ec2 date:2018-08-02T15:14:46-07:00 author:Kapil commit:570ca4>\n <policy-add policy:ec2-run provider:aws resource:ec2 date:2018-08-02T15:16:00-07:00 author:Kapil commit:d3d8d4>\n <policy-remove policy:ec2-run provider:aws resource:ec2 date:2018-08-02T15:18:31-07:00 author:Kapil commit:922c1a>\n <policy-modified policy:ec2-guard-duty provider:aws resource:ec2 date:2018-08-12T09:39:43-04:00 author:Kapil commit:189ea1>\n 2018-08-12 12:37:01,275: c7n.policystream:INFO Streamed 7 policy changes\n```\n\nPolicy diff between two source and target revision specs. If source\nand target are not specified default revision selection is dependent\non current working tree branch. The intent is for two use cases, if on\na non-master branch then show the diff to master. If on master show\nthe diff to previous commit on master. For repositories not using the\n`master` convention, please specify explicit source and target.\n\n\n```\n $ c7n-policystream diff -r foo -v\n```\n\nPull request use, output policies changes between current branch and master.\n\n```\n $ c7n-policystream diff -r foo\n policies:\n - filters:\n - {type: cross-account}\n name: lambda-access-check\n resource: aws.lambda\n```\n\n## Options\n\n```\n$ c7n-policystream --help\nUsage: c7n-policystream [OPTIONS] COMMAND [ARGS]...\n\n Policy changes from git history\n\nOptions:\n --help Show this message and exit.\n\nCommands:\n diff Policy diff between two arbitrary revisions.\n org-checkout Checkout repositories from a GitHub organization.\n org-stream Stream changes for repos in a GitHub organization.\n stream Stream git history policy changes to destination.\n```\n\n",
"bugtrack_url": null,
"license": "Apache-2.0",
"summary": "Cloud Custodian - Git Commits as Logical Policy Changes",
"version": "0.4.34",
"project_urls": {
"Documentation": "https://cloudcustodian.io/docs/",
"Homepage": "https://cloudcustodian.io",
"Repository": "https://github.com/cloud-custodian/cloud-custodian"
},
"split_keywords": [],
"urls": [
{
"comment_text": "",
"digests": {
"blake2b_256": "f01b39cffa54a90ef91f237626e5ab7dea0e2e8115a5b80d299ce4cf0a3ef3bf",
"md5": "8a2f9c6b85155f04be080f0ce713051d",
"sha256": "38d599d91c42fd247721ca7d09a3822a06e25ca9cd39279a1ae6de69dd1aa0ec"
},
"downloads": -1,
"filename": "c7n_policystream-0.4.34-py3-none-any.whl",
"has_sig": false,
"md5_digest": "8a2f9c6b85155f04be080f0ce713051d",
"packagetype": "bdist_wheel",
"python_version": "py3",
"requires_python": "<4.0,>=3.8",
"size": 12453,
"upload_time": "2024-03-26T21:21:33",
"upload_time_iso_8601": "2024-03-26T21:21:33.189139Z",
"url": "https://files.pythonhosted.org/packages/f0/1b/39cffa54a90ef91f237626e5ab7dea0e2e8115a5b80d299ce4cf0a3ef3bf/c7n_policystream-0.4.34-py3-none-any.whl",
"yanked": false,
"yanked_reason": null
}
],
"upload_time": "2024-03-26 21:21:33",
"github": true,
"gitlab": false,
"bitbucket": false,
"codeberg": false,
"github_user": "cloud-custodian",
"github_project": "cloud-custodian",
"travis_ci": false,
"coveralls": true,
"github_actions": true,
"lcname": "c7n-policystream"
}
JSON
