Cloud-custodian: Specify Maximum age of a resource in a tag

[danieleb0101]

I need to write a policy where if the age of the resource is bigger than a value specified in a tag that resource is deleted, but I'm not sure how to do it for several reasons.

1. Can I achieve my goal with the policy below?

policies:
  - name: delete-old-stacks
    resource: cfn
    filters:
      - "tag:Retention": present
      - or:
          - type: value
            key: LastUpdatedTime
            op: greater-than
            value_type: age
            value: tag:Retention
          - and:
              - type: value
                key: CreationTime
                op: greater-than
                value_type: age
                value: tag:Retention
              - type: value
                key: LastUpdatedTime
                value: absent

    actions:
      - type: delete

1. Sometimes it may happen that the value of the tag Retention is not a number and I would like that Cloud Custodian doesn't fail, ideally I would like that Cloud Custodian skips that resource without blowing up. How can I achieve it?

[thisisshi]

currently, no but I think we could extend the value_form syntax to support that, something like the following?

policies:
  - name: delete-old-stacks
    resource: cfn
    filters:
      - type: value
        key: CreationTime
        value_from:
          url: self
          format: json
          expr: tag:Retention
        op: greater-than

iirc there have been other requests to support something like this before, where the value comparison is based on another value on the resource json

[danieleb0101]

Ok, so at the minute, if I would like to set the life length of a resource in a tag and let cloud custodian to delete it I cannot do that right?

[anovis]

what exactly is your use case. maybe you can use the mark-for-op action which creates a tag for future actions. so the first time the action is called it creates a tag for a specific op to happen in x future days.

policies:
  - name: delete-old-stacks
    resource: cfn
       filters:
       -   type: value
            key: tag:Retention
            op: greater-than
            value_type: age
            value: 3
    actions:
      - type: mark-for-op
        tag: Retention-Delete
        op: delete
        days: 7

[danieleb0101]

In my use case I would like to have the maximum age of that resource written in a tag. So I can avoid to have hardcoded numbers in my policies. And in this way developers who are responsible for (and create) that resource can choose how many days the resource can stand in AWS.

[kapilt]

you can tag a resource manually with delete@date and then have the marked-for-op filter. its not age of the resource, but effective termination date and allows non policy configuration by end users, I think thats actually a better end user semantic, since in many cases finding the age of a resource is more difficult for a user in the console, versus knowing the actual termination date.

[kapilt]

what's the value for the tags here?