Cloud Custodian Files

What's Changed

AWS

• aws - bedrock add tagging, marked for op and stop by @KodyMullins in https://github.com/cloud-custodian/cloud-custodian/pull/10611
• aws - vpc-endpoint - add delete action by @Hari-Xpress in https://github.com/cloud-custodian/cloud-custodian/pull/10813
• fix(account): use get_support_region() in service-limit filter for GovCloud support by @patryktomaszewski in https://github.com/cloud-custodian/cloud-custodian/pull/10805
• fix: handle IAM ResourveNotFoundException correctly by @Shreyas0047 in https://github.com/cloud-custodian/cloud-custodian/pull/10812
• aws - security-hub resource with master filter by @PratMis in https://github.com/cloud-custodian/cloud-custodian/pull/10826
• aws - cloudfront - Add Cloudfront Functions and KeyValue Store Resources by @algobarb in https://github.com/cloud-custodian/cloud-custodian/pull/10831
• aws - resource: kms-key - Added last-usage filter for KMS Keys by @Benco351 in https://github.com/cloud-custodian/cloud-custodian/pull/10822
• aws - bedrock agent - metrics filter by @kapilt in https://github.com/cloud-custodian/cloud-custodian/pull/10823
• aws - workspaces-bundle - pull tags via universal augment by @ajkerrigan in https://github.com/cloud-custodian/cloud-custodian/pull/10866
• Wafv2 Refactor Scope Region Logic by @mattheidelbaugh in https://github.com/cloud-custodian/cloud-custodian/pull/10827
• [Cleanrooms]: adding Clean Rooms and Clean Rooms ML resources by @rondodev in https://github.com/cloud-custodian/cloud-custodian/pull/10830
• aws - lambda - trim-versions - fix retain-latest schema default by @anxkhn in https://github.com/cloud-custodian/cloud-custodian/pull/10885
• [Account] adding payment-cryptography-replication-regions filter by @rondodev in https://github.com/cloud-custodian/cloud-custodian/pull/10868
• aws - Payment Cryptography - cross-account filter implementation by @rondodev in https://github.com/cloud-custodian/cloud-custodian/pull/10892
• aws - waf/waf-regional - add delete action for WAF Classic Web ACLs by @SriLakshmi556 in https://github.com/cloud-custodian/cloud-custodian/pull/10849
• aws - sns - resolve topics directly by arn in event mode by @sontek in https://github.com/cloud-custodian/cloud-custodian/pull/10922
• aws - Quicksight Account Subscription and Custom Permissions by @mattheidelbaugh in https://github.com/cloud-custodian/cloud-custodian/pull/10921
• Cross account whitelist org unit by @mattheidelbaugh in https://github.com/cloud-custodian/cloud-custodian/pull/10838
• aws - paymentcrypto - Update Augment to add get_key details by @algobarb in https://github.com/cloud-custodian/cloud-custodian/pull/10925
• aws - dsql implementation by @mattheidelbaugh in https://github.com/cloud-custodian/cloud-custodian/pull/10887
• aws - kafka - fix UnboundLocalError by @jerryhxu in https://github.com/cloud-custodian/cloud-custodian/pull/10924
• aws - bedrock inference profile - total tokens metric by @calebsyring in https://github.com/cloud-custodian/cloud-custodian/pull/10898
• feat: Added Services & DefaultServiceQuotas to quota.py. by @toastdriven in https://github.com/cloud-custodian/cloud-custodian/pull/10475
• aws - tags - allow resource lookups in tag values by @ajkerrigan in https://github.com/cloud-custodian/cloud-custodian/pull/10942
• aws - Add termination-policy filter for EMR clusters by @mrinalpravi in https://github.com/cloud-custodian/cloud-custodian/pull/10848
• aws - memorydb - Adding db-parameter filter and parameter-group resource by @rondodev in https://github.com/cloud-custodian/cloud-custodian/pull/10946
• aws - iam-policy - detect list-form Action/Resource in has-allow-all by @naohito-intuit in https://github.com/cloud-custodian/cloud-custodian/pull/10952
• feat: 8653 aws ec2 compute optimizer feature by @calebsyring in https://github.com/cloud-custodian/cloud-custodian/pull/10512
• fix(athena): skip AWS-managed AwsDataCatalog in universal tag/untag action by @bishtashish708 in https://github.com/cloud-custodian/cloud-custodian/pull/10967
• aws - cfn - add mark-for-op support (#7240) by @scott-sixfeetup in https://github.com/cloud-custodian/cloud-custodian/pull/10463
• aws - wafv2 - fix set-wafv2 on CloudFront ignoring CLOUDFRONT scope by @SriLakshmi556 in https://github.com/cloud-custodian/cloud-custodian/pull/10975
• feat: 9978 aws es update domain config action by @calebsyring in https://github.com/cloud-custodian/cloud-custodian/pull/10505
• aws - vpc-endpoint - service-details filter for cross-region endpoints by @jerryhxu in https://github.com/cloud-custodian/cloud-custodian/pull/10918
• directconnect tag fix by @jismail3000 in https://github.com/cloud-custodian/cloud-custodian/pull/10985
• aws - glue - add database tag support by @Mukeshkr-19 in https://github.com/cloud-custodian/cloud-custodian/pull/10986
• aws - bedrock evaluation jobs by @calebsyring in https://github.com/cloud-custodian/cloud-custodian/pull/10923
• aws - mu - strip read-only fields from ConfigRule before PutConfigRule update by @naohito-intuit in https://github.com/cloud-custodian/cloud-custodian/pull/10951
• aws - iam-user - avoid quadratic dedup in policy filter by @anxkhn in https://github.com/cloud-custodian/cloud-custodian/pull/10901
• [Bedrock] adding bedrock-mantle-project resource by @rondodev in https://github.com/cloud-custodian/cloud-custodian/pull/10937
• aws.s3: don't abort augment() on a single bucket's connection error by @jimfulton in https://github.com/cloud-custodian/cloud-custodian/pull/11016
• aws - security lake by @mattheidelbaugh in https://github.com/cloud-custodian/cloud-custodian/pull/10948
• aws - iam - retry concurrent tag updates by @1fanwang in https://github.com/cloud-custodian/cloud-custodian/pull/11044
• aws - wafv2 - fix wafv2-enabled filter ignoring CLOUDFRONT scope by @bdwyertech in https://github.com/cloud-custodian/cloud-custodian/pull/11039
• aws - cleanrooms - Add members filter to collaboration resource by @algobarb in https://github.com/cloud-custodian/cloud-custodian/pull/11032
• aws - c7n-org - accounts change retiring Status to State by @jordanst3wart in https://github.com/cloud-custodian/cloud-custodian/pull/11043
• aws - sagemaker studio: app, user-profile, space resources (#10858) by @jimfulton in https://github.com/cloud-custodian/cloud-custodian/pull/10920
• feat: Added VPCLatticeRule resource. by @toastdriven in https://github.com/cloud-custodian/cloud-custodian/pull/10565
• aws - s3 output - configurable server-side encryption for policy logs by @strixthekiet in https://github.com/cloud-custodian/cloud-custodian/pull/10991
• aws - emr-serverless-app - augment with GetApplication detail (autoStopConfiguration) by @jimfulton in https://github.com/cloud-custodian/cloud-custodian/pull/10928
• aws - cross-account filter - ForAnyValue Bugfix by @mattheidelbaugh in https://github.com/cloud-custodian/cloud-custodian/pull/11074
• fix: avoid KeyError in marked-for-op on non-EC2 resources by @anxkhn in https://github.com/cloud-custodian/cloud-custodian/pull/10882
• QueryResourceManager - retry InternalServerException by default by @mattheidelbaugh in https://github.com/cloud-custodian/cloud-custodian/pull/11041

Azure

• azure - Add azure cognitive services deployment resource and actions by @KodyMullins in https://github.com/cloud-custodian/cloud-custodian/pull/10634
• azure - ai foundry agent and application resources by @KodyMullins in https://github.com/cloud-custodian/cloud-custodian/pull/10656
• azure - add machine-learning-job resource by @anxkhn in https://github.com/cloud-custodian/cloud-custodian/pull/10862
• feat: 8673 azure - add matched security rules to NSGs by @calebsyring in https://github.com/cloud-custodian/cloud-custodian/pull/10464
• azure - tags - resolve resource lookups in tag values by @UTKARSH698 in https://github.com/cloud-custodian/cloud-custodian/pull/10961
• Add Azure Machine Learning data container resource by @KodyMullins in https://github.com/cloud-custodian/cloud-custodian/pull/10927
• azure - add machine-learning-online-endpoint resource by @anxkhn in https://github.com/cloud-custodian/cloud-custodian/pull/10861
• azure - add machine-learning-model-version resource by @anxkhn in https://github.com/cloud-custodian/cloud-custodian/pull/10872
• feat: 9971 azure budget resource by @calebsyring in https://github.com/cloud-custodian/cloud-custodian/pull/10495
• azure - add private dns zone and record set resources by @jimfulton in https://github.com/cloud-custodian/cloud-custodian/pull/11053
• azure - add machine learning job archive action by @jimfulton in https://github.com/cloud-custodian/cloud-custodian/pull/11005
• azure - functions - replace SCM basic auth with Entra ID bearer token by @nihalrm in https://github.com/cloud-custodian/cloud-custodian/pull/11008

GCP

• fix(gcp): add get_metric_resource_name for Cloud Run revisions by @ChallaBharadwajReddy in https://github.com/cloud-custodian/cloud-custodian/pull/10807
• gcp - clean up bad tests that caused litter by @kapilt in https://github.com/cloud-custodian/cloud-custodian/pull/10828
• gcp - vertex ai endpoint monitor action by @KodyMullins in https://github.com/cloud-custodian/cloud-custodian/pull/10622
• gcp - api-key - add gcp-audit mode support by @mgogoulos in https://github.com/cloud-custodian/cloud-custodian/pull/10628
• Add gcp test command to make file and update development.md by @KodyMullins in https://github.com/cloud-custodian/cloud-custodian/pull/10589
• gcp - Add update action to dns policy resource by @KodyMullins in https://github.com/cloud-custodian/cloud-custodian/pull/10669
• gcp - Add bigquery data set update action by @KodyMullins in https://github.com/cloud-custodian/cloud-custodian/pull/10670
• gcp - add regional commitment resource. by @KodyMullins in https://github.com/cloud-custodian/cloud-custodian/pull/10668
• feat: gcp - ai endpoint metrics by @calebsyring in https://github.com/cloud-custodian/cloud-custodian/pull/10893
• gcp - v2 notebooks by @calebsyring in https://github.com/cloud-custodian/cloud-custodian/pull/10881
• gcp - vertex-ai-custom-job - add Custom Job resource by @jimfulton in https://github.com/cloud-custodian/cloud-custodian/pull/10891
• gcp - dns-managed-zone - add enable-dnssec action by @mgogoulos in https://github.com/cloud-custodian/cloud-custodian/pull/10620
• fix(10897): gcp - vertex-ai - get_resource() fix by @jimfulton in https://github.com/cloud-custodian/cloud-custodian/pull/10894
• gcp - add compute instance metadata by @mgogoulos in https://github.com/cloud-custodian/cloud-custodian/pull/10636
• gcp vertex ai dataset by @jimfulton in https://github.com/cloud-custodian/cloud-custodian/pull/10926
• fix(gcp): normalize None source results before augment (#10955) by @faan-rubrik in https://github.com/cloud-custodian/cloud-custodian/pull/10969
• Add vertex ai hyper parameter tuning job by @jimfulton in https://github.com/cloud-custodian/cloud-custodian/pull/10889
• gcp - metrics filter - honor missing-value: 0 by @jimfulton in https://github.com/cloud-custodian/cloud-custodian/pull/10929
• gcp - add vertex-ai-model resource by @jimfulton in https://github.com/cloud-custodian/cloud-custodian/pull/10993
• gcp - recommender - fix concatenated usage commitment recommender id by @anxkhn in https://github.com/cloud-custodian/cloud-custodian/pull/10903
• gcp - add Vertex AI evaluation run resource support by @jimfulton in https://github.com/cloud-custodian/cloud-custodian/pull/11013
• gcp - notebook-v2 - add get and update-metadata action (#10919) by @jimfulton in https://github.com/cloud-custodian/cloud-custodian/pull/10994
• gcp - support regional persistent disks for disk actions by @jimfulton in https://github.com/cloud-custodian/cloud-custodian/pull/10995
• gcp - cloud-run - drop non-schema fields from label mutations by @jtroup in https://github.com/cloud-custodian/cloud-custodian/pull/11052
• gcp - fix region-parented resource enumeration when no explicit region is provided by @jimfulton in https://github.com/cloud-custodian/cloud-custodian/pull/11009

Core

• escape spreadsheet formula characters in csv report output by @uwezkhan in https://github.com/cloud-custodian/cloud-custodian/pull/10836
• core - ValueFilter: recalculate value_path per resource (#10521) by @jimfulton in https://github.com/cloud-custodian/cloud-custodian/pull/10934
• core - resolver - skip short rows in value_from CSV column lookup by @anxkhn in https://github.com/cloud-custodian/cloud-custodian/pull/10880
• core - fix get_human_size overflow for exabyte-scale sizes by @anxkhn in https://github.com/cloud-custodian/cloud-custodian/pull/10904
• core - reduce filter - fix discard-percent leaking across groups by @anxkhn in https://github.com/cloud-custodian/cloud-custodian/pull/10907

Tencentcloud

• feat: [#8623] tencentcloud - add action + protocol to ingress filter by @calebsyring in https://github.com/cloud-custodian/cloud-custodian/pull/10468

Tools

• tools/c7n_mailer - escape untrusted uid before building ldap filter by @uwezkhan in https://github.com/cloud-custodian/cloud-custodian/pull/10825

Releng

• :seedling: Bump the github-actions group across 3 directories with 7 updates by @dependabot[bot] in https://github.com/cloud-custodian/cloud-custodian/pull/10810
• releng - bump azure cosmosdb version v6.4.0 --> v9.9.0 by @ajkerrigan in https://github.com/cloud-custodian/cloud-custodian/pull/10811
• :seedling: Bump pyjwt from 2.12.1 to 2.13.0 by @dependabot[bot] in https://github.com/cloud-custodian/cloud-custodian/pull/10839
• :seedling: Bump pydantic-settings from 2.14.0 to 2.14.2 by @dependabot[bot] in https://github.com/cloud-custodian/cloud-custodian/pull/10844
• data update by @mattheidelbaugh in https://github.com/cloud-custodian/cloud-custodian/pull/10888
• releng - prep 0.9.52 release by @ajkerrigan in https://github.com/cloud-custodian/cloud-custodian/pull/10870
• releng - dependency updates 2026-08 by @ajkerrigan in https://github.com/cloud-custodian/cloud-custodian/pull/11045

Docs

• docs - update ADOPTERS.md by @ajkerrigan in https://github.com/cloud-custodian/cloud-custodian/pull/10876
• docs - remove reo.dev integration by @ajkerrigan in https://github.com/cloud-custodian/cloud-custodian/pull/10996

Schema Changes

• aws.bedrock-evaluation-job added
• aws.bedrock-mantle-project added
• aws.cleanrooms-collaboration added
• aws.cleanrooms-collaboration-member added
• aws.cleanrooms-configured-table added
• aws.cleanrooms-membership added
• aws.cloudfront-function added
• aws.cloudfront-key-value-store added
• aws.default-service-quota added
• aws.dsql-cluster added
• aws.dsql-stream added
• aws.memorydb-parameter-group added
• aws.sagemaker-app added
• aws.sagemaker-space added
• aws.sagemaker-user-profile added
• aws.security-hub added
• aws.security-lake added
• aws.security-lake-subscriber added
• aws.service-quota-service added
• aws.vpc-lattice-rule added
• azure.ai-foundry-agent added
• azure.ai-foundry-application added
• azure.ai-foundry-deployment added
• azure.budget (cloudcustodian.io) added
• azure.cognitiveservice-deployment added
• azure.machine-learning-data-container added
• azure.machine-learning-job added
• azure.machine-learning-model-version added
• azure.machine-learning-online-endpoint added
• azure.private-dns-zone added
• azure.private-record-set added
• gcp.notebook-v2 added
• gcp.region-commitment added
• gcp.vertex-ai-custom-job added
• gcp.vertex-ai-dataset added
• gcp.vertex-ai-evaluation-run added
• gcp.vertex-ai-hyperparameter-tuning-job added
• gcp.vertex-ai-model added
• terraform._ added
• aws.account
• added filters: payment-cryptography-replication-regions
• aws.athena-data-catalog
• added actions: mark, unmark, untag
• aws.bedrock-agent
• added filters: metrics
• aws.bedrock-model-invocation-job
• added actions: auto-tag-user, copy-related-tag, mark-for-op, remove-tag, rename-tag, stop, tag
• added filters: marked-for-op
• aws.cfn
• added actions: mark-for-op
• added filters: marked-for-op
• aws.ec2
• added filters: compute-optimizer
• aws.elasticsearch
• added actions: update-domain-config
• aws.emr
• added filters: termination-policy
• aws.glue-database
• added actions: auto-tag-user, copy-related-tag, mark-for-op, remove-tag, rename-tag, tag
• added filters: marked-for-op
• aws.kms-key
• added filters: last-usage
• aws.memorydb
• added filters: db-parameter
• aws.payment-cryptography-key
• added filters: cross-account
• aws.quicksight-account
• added filters: subscription
• aws.quicksight-dashboard
• added actions: auto-tag-user, copy-related-tag, mark-for-op, remove-tag, tag
• added filters: marked-for-op
• aws.quicksight-datasource
• added actions: auto-tag-user, copy-related-tag, mark-for-op, remove-tag, tag
• added filters: marked-for-op
• aws.quicksight-user
• added actions: auto-tag-user, copy-related-tag, mark-for-op, remove-tag, tag
• added filters: marked-for-op, permissions
• aws.vpc-endpoint
• added actions: delete
• aws.waf
• added actions: delete
• aws.waf-regional
• added actions: delete
• gcp.bq-dataset
• added actions: update
• gcp.compute-project
• added actions: set-common-instance-metadata
• gcp.dns-managed-zone
• added actions: enable-dnssec, set-dnssec-key-specs
• gcp.dns-policy
• added actions: update
• gcp.instance
• added actions: set-metadata
• gcp.vertex-ai-endpoint
• added actions: monitor

New Contributors

• @uwezkhan made their first contribution in https://github.com/cloud-custodian/cloud-custodian/pull/10825
• @Hari-Xpress made their first contribution in https://github.com/cloud-custodian/cloud-custodian/pull/10813
• @patryktomaszewski made their first contribution in https://github.com/cloud-custodian/cloud-custodian/pull/10805
• @Shreyas0047 made their first contribution in https://github.com/cloud-custodian/cloud-custodian/pull/10812
• @anxkhn made their first contribution in https://github.com/cloud-custodian/cloud-custodian/pull/10882
• @SriLakshmi556 made their first contribution in https://github.com/cloud-custodian/cloud-custodian/pull/10849
• @jimfulton made their first contribution in https://github.com/cloud-custodian/cloud-custodian/pull/10891
• @mrinalpravi made their first contribution in https://github.com/cloud-custodian/cloud-custodian/pull/10848
• @UTKARSH698 made their first contribution in https://github.com/cloud-custodian/cloud-custodian/pull/10961
• @faan-rubrik made their first contribution in https://github.com/cloud-custodian/cloud-custodian/pull/10969
• @bishtashish708 made their first contribution in https://github.com/cloud-custodian/cloud-custodian/pull/10967
• @scott-sixfeetup made their first contribution in https://github.com/cloud-custodian/cloud-custodian/pull/10463
• @Mukeshkr-19 made their first contribution in https://github.com/cloud-custodian/cloud-custodian/pull/10986
• @1fanwang made their first contribution in https://github.com/cloud-custodian/cloud-custodian/pull/11044
• @jtroup made their first contribution in https://github.com/cloud-custodian/cloud-custodian/pull/11052
• @nihalrm made their first contribution in https://github.com/cloud-custodian/cloud-custodian/pull/11008

Full Changelog: https://github.com/cloud-custodian/cloud-custodian/compare/0.9.51.0...0.9.52.0