Cloud Custodian
Negating a Regex Operation - Help with creating a policy! #8570
-
|
Hi! I made a policy and I wanted to know if this makes sense: This policy is "compiling" with the library, but this not-regex operation doesn't seem to be working in filter. To summarize what I want to do, I want to define a regex for resources that need to be "ignored" by the policy (should not execute the policy). In this case if the I know that my application uses regex in a counterintuitive way, but I haven't found any other way to accomplish this with a single policy (I believe it is possible to use two policies, one to tag the elements having the regex first and a second one to run things only on those without this specific tag), but anyway, is there a simpler way? Thanks! |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 2 replies
-
|
The idea of negating a regex is fine, though regex matches against If you have a specific list of resources you want to exclude, something like this is more common: filters:
- type: value
key: InstanceId
op: not-in
value:
- i-12345
- i-23456
- i-34567
- ...Often using value_from to maintain a skip list outside the policy. If you're matching based on patterns rather than explicit IDs, you can look for regex patterns the way you mentioned. Maybe you want to skip resources with a certain string in their Name tags: filters:
- not:
- type: value
key: tag:Name
op: glob
value: *flag* # or op: regex, value: .*flag.*If things aren't behaving as expected, it might be helpful to include sanitized examples of resources you expect to match and not match your filter. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the quick reply @ajkerrigan. Yes, I do understand that Instances have unreadable IDs, but I was just trying this policy and I used that as an example in my environment. In any case, I tried again after updating c7n to version In any case, thank you so much for the clear explanation! |
Beta Was this translation helpful? Give feedback.
-
|
Cool, that makes sense. "...and it just worked" is always fun! |
Beta Was this translation helpful? Give feedback.
The idea of negating a regex is fine, though regex matches against
InstanceIdseem unlikely to be useful (you have no control over an instance id, andi-abcd12345isn't exactly human-readable).If you have a specific list of resources you want to exclude, something like this is more common:
Often using value_from to maintain a skip list outside the policy.
If you're matching based on patterns rather than explicit IDs, you can look for regex patterns the way you mentioned. Maybe you want to skip resources with a certain string in their Name tags: