unused-sgroup-audit.yml

policies:
  - name: unused-sgroups-audit
    resource: security-group
    description: |
       Cloud Custodian Unused Security Group Audit
    comments: |
      Retrieve unused security groups using regex and delete.
      Notify using Simple Email Service (SES).
      To get a complete list, use value of .*
      To get a subset, use a regex pattern. 
    mode:
      type: periodic
      role: arn:aws:iam::1234567890:role/CloudCustodian
      schedule: "rate(1 day)"
    filters:
      - unused 
      - type: value
        key: GroupName
        op: regex
        value: ".*wizard"
    actions:
      - delete
      - type: notify
        template: unused-sgroup-audit.html
        slack_template: slack-unused-sgroup-audit
        template_format: 'html'
        priority_header: '5'
        subject: 'Security Audit: Unused Security Groups'
        to:
          - <your-aws-verified-email-address> 
          - slack://#<your-channel-name>
        owner_absent_contact:
          - <your-aws-verified-email-address> 
        transport:
          type: sqs
          queue: https://sqs.us-east-1.amazonaws.com/1234567890/cloud-cloudcustodian