Guide to Writing Custom Templates (Slack) or Filtering of Results to Certain Fields Only

[bostrowski13]

Goal: I want to only show resource names in the "Resources" block of slack message.

Is there a guide to writing custom templates for Slack for policy filter results or just cutting down on the results to only show resource names?

Here's how I have things set up:
I have slack integration working through SQS queue with the mailer sending messages to slack.
I have policies that are set up to notify to slack that deploy as a lambda running on a schedule.
In my slack, i get the messages which contain all of the properties from the json of the affected resources from the filter on the policy doc.

Right now, I use the default slack template, and rather than seeing the list of resources and ALL of its properties, it would be nice to see a simplired view of something like only resource names (and in a perfect world the filters that were not met for that resource).

Is there any way to do this?

[hopkinsnji]

The templates are written in jinja2, see https://jinja.palletsprojects.com/en/2.11.x/. Also, you have to look at how to format messages for slack. A slack message is a json payload and you can find the fields here https://api.slack.com/reference/messaging/payload.
You have to write the json object following slacks documentation, and then use jinja2 to include variables, similar to how f strings work in python. In addition to parsing values out of the json you sent to sqs, you have access to additional variables form cloud custodian mailer, see https://pypi.org/project/c7n-mailer/ (search the page for variable). Below is an example of how you would display only the image ids.

{ "text": "{{policy['name']}}, {{ account }}/{{ region}}\n{{action['violation_desc']}}\n {%- for resource in resources -%} \n{{resource['ImageId']}} {%- endfor -%}" }