Cloud Custodian

0.9.49.0Security

Jan 16, 2026

Cloud Custodian 0.9.49.0 adds AWS and Azure resource support and expands policy filtering. It also changes behavior for several AWS resources, updates dependencies, and changes how c7n-left handles HCL errors. No security advisories or security-specific fixes are disclosed.

All 27 other recorded changesadditions 19 · value changes 7 · constraints 1

additions (19)

aws - add 'resolver-rule' resource
aws.resolver-rule
azure.entraid-group
azure.entraid-organization
aws.app-elb - added filters: [listener-rule
aws.app-elb-target-group - added filters: [json-diff
aws.artifact-domain - added filters: [json-diff
aws.datasync-agent - added filters: [json-diff
aws.glue-database - added filters: [json-diff
aws.sagemaker-data-quality-job-definition - added filters: [json-diff
aws.sagemaker-model-explainability-job-definition - added filters: [json-diff
aws.sagemaker-model-quality-job-definition - added filters: [json-diff
aws.transfer-server - added filters: [json-diff
config-compliance×3
json-diff×3

value changes (7)

aws - cloudfront/shield - gracefully handle pricing plan distributions
aws - quicksight - gracefully handle missing or standard edition configurations
aws - quicksight - handle exception in list tags
aws - rds - skip cluster members in start/stop action
skip regional NAT Gateways in cross-az-nat-gateway-route filter
update dependencies
c7n-left - allow HCL errors to fail runs

constraints (1)

extend the dhcp-options filter to support an 'amazon' synthetic value

Add Cloud Custodian to your stack

A weekly email arrives when a release needs action. Weeks with nothing to act on, like this one, send no email.

Add to stack →

Official release note ↗All Cloud Custodian releases →