Automation Policies - Technical Overview
Last updated: October 22, 2026
Overview
Automation Policies are a new feature to the Kion platform starting with version 3.16.x. This feature allows you to take clear action in your cloud environment on cloud resources based on a scheduled frequency or on-demand. This document provides an overview of this feature for Kion Administrators and those charged with making use of this feature in their cloud environment.
Prerequisites
You must be running Kion v3.16.x or newer in order to use Automation Policies.
Your Kion environment must have the appropriate network access to reach the underlying Cloud Provider APIs. Restricted environments such as those that must proxy or may block access to Cloud Provider APIs may experience resource availability issues and should perform sufficient testing prior to relying on this feature in production. See the list of supported resources below for specific resources (and associated APIs).
Terminology and Concepts
Automation Policies introduces some new terminology for the Kion Platform:
Automation Policy - A policy object that is created by the system or by a user that defines one or more policy bodies, resource scopes, filters, and actions to be taken within a cloud environment.
Automation Policy Body - Within an Automation Policy, the set of filters and actions that apply to a single Cloud Service Provider. You define a separate Body for each provider you want the policy to act on.
Essentially, what actions should take place on one Cloud Service Provider versus another as there may be slight differences in what is desired or needed.
Automation Policy Template - A ready-to-use Automation Policy provided by Kion that is downloaded to your system automatically.
Templates are not executable and are for reference only. You must instantiate an Automation Policy based on a template in order to use it.
Targeted Resource Types - The types of resources in the cloud, by service, that are subject to the filters and actions defined in an Automation Policy Body.
This selection is made in the UI directly above each Automation Policy Body.
Impacted Resources - A record of the most recent action attempted on each resource by this policy, including both successful changes and failures, within the last 30 days.
This table only stores the last impact to a resource, not every impact within the last 30 days.
Feature Support
This section provides information about the support of this feature within the Kion Platform.
Installation Environment Support
Automation Policies has been tested in the following installation environments for Kion:
AWS (Commercial and GovCloud)
Azure (Commercial and MAG/AzureGov)
We are currently exploring feedback on Automation Policies within the Secret and Top Secret environments for Kion, including:
AWS Secret and Top Secret
Azure Top Secret
General Cloud Provider Support
Automation Policies can scan resources across the following Cloud Service Providers in the Kion platform:
AWS (Commercial and GovCloud)
Azure (Commercial and MAG/AzureGov)
GCP
Supported Resources
In the tables below, you will find the resources currently supported by Automation Policies. We are continuing to expand and review capabilities in this area. If you have feedback on resources you would like to see available, please reach out to support@kion.io or discuss with your TAM.
AWS Resources
Resource Name | Resource Type | Actions | Filter Functions | Version |
|---|---|---|---|---|
AMI | aws.ami | tag, bulk_tag, deregister | isAvailable, isDeprecated, isPublic, isUnused | 3.16.0 |
Auto Scaling Group | aws.autoscaling_group | tag, bulk_tag, start, stop | isStopped | 3.16.0 |
Bedrock Custom Model | aws.bedrock_custom_model | tag, bulk_tag | 3.16.0 | |
Classic Load Balancer | aws.elb | tag, bulk_tag, delete | hasActiveInstances, isInternal | 3.16.0 |
CloudTrail | aws.cloudtrail | tag, bulk_tag | 3.16.0 | |
DynamoDB Table | aws.dynamodb_table | tag, bulk_tag | 3.16.0 | |
EBS Snapshot | aws.ebs_snapshot | tag, bulk_tag, delete | isCompleted, isEncrypted | 3.16.0 |
EBS Volume | aws.ebs_volume | tag, bulk_tag, delete, snapshot | isAttached, isAvailable, isEncrypted | 3.16.0 |
EC2 Instance | aws.ec2 | tag, bulk_tag, start, stop | isRunning | 3.16.0 |
ECR Repository | aws.ecr_repository | tag, bulk_tag | 3.16.0 | |
EFS File System | aws.efs_file_system | tag, bulk_tag | 3.16.0 | |
EKS Node Group | aws.eks_node_group | tag, bulk_tag, stop | 3.16.0 | |
Elastic IP | aws.elastic_ip | tag, bulk_tag, delete | isAssociated, isUnassociated | 3.16.0 |
Elastic Network Interface (ENI) | aws.eni | tag, bulk_tag, delete | hasPublicIP, isAttached, isAvailable, getAttachmentID, getInstanceID | 3.16.0 |
IAM Role | aws.iam_role | tag, bulk_tag | isServiceLinked | 3.16.0 |
IAM User | aws.iam_user | tag, bulk_tag | 3.16.0 | |
Internet Gateway | aws.igw | tag, bulk_tag, delete | isAttached | 3.16.0 |
KMS Key | aws.kms_key | tag, bulk_tag | isEnabled, isPendingDeletion | 3.16.0 |
Lambda Function | aws.lambda | tag, bulk_tag, delete | isActive | 3.16.0 |
Load Balancer (v2) | aws.elbv2 | tag, bulk_tag, delete | hasActiveTargets, isALB, isInternal, isNLB | 3.16.0 |
NAT Gateway | aws.nat_gateway | tag, bulk_tag, delete | isAvailable, isPrivate, isPublic | 3.16.0 |
RDS Cluster | aws.rdscluster | tag, bulk_tag, start, stop | 3.16.0 | |
RDS Instance | aws.rdsinstance | tag, bulk_tag, start, stop | 3.16.0 | |
Redshift Cluster | aws.redshift_cluster | tag, bulk_tag, start, stop | 3.16.0 | |
S3 Bucket | aws.s3 | tag, bulk_tag | hasPublicAccessBlocked, isEncrypted, isInRegion, isVersioningEnabled, getBucketRegion | 3.16.0 |
SageMaker Notebook Instance | aws.sagemaker_notebook | tag, bulk_tag, stop | 3.16.0 | |
Security Group | aws.security_group | tag, bulk_tag | hasPublicAccess, isInVPC, allowsSSH, allowsRDP, allowsHTTP, allowsHTTPS, getIngressRuleCount, getEgressRuleCount, getVPCID | 3.16.0 |
Target Group | aws.target_group | tag, bulk_tag, delete | isHTTPS | 3.16.0 |
VPC | aws.vpc | tag, bulk_tag, delete | hasCidr, hasIpv6, isAvailable, isDefault | 3.16.0 |
Azure Resources
Resource Name | Resource Type | Actions | Filter Functions | Version |
|---|---|---|---|---|
App Service Plan | azure.app_service_plan | tag, bulk_tag, stop | hasApps, isElasticScale, isLinux | 3.16.0 |
Compute Disk | azure.compute_disk | tag, bulk_tag, delete | isAttached, isEncrypted, isOSDisk, isUnattached | 3.16.0 |
Function App | azure.function_app | tag, bulk_tag | isLinux, isRunning, isStopped | 3.16.0 |
Key Vault | azure.key_vault | tag, bulk_tag | hasNetworkRestrictions, isPublicAccessEnabled, isPurgeProtectionEnabled, isSoftDeleteEnabled, usesRbacAuthorization, getSku | 3.16.0 |
Load Balancer | azure.load_balancer | tag, bulk_tag, delete | hasActiveTargets, isPublic, isStandard | 3.16.0 |
Azure ML Online Deployment | azure.ml_online_deployment | tag, bulk_tag, delete | isReceivingTraffic, isRunning, isStopped | 3.16.0 |
MySQL Flexible Server | azure.mysql_flexible_server | tag, bulk_tag, start, stop | isHighlyAvailable, isPubliclyAccessible, isReady, isStopped | 3.16.0 |
NAT Gateway | azure.nat_gateway | tag, bulk_tag | isAttached, isUnattached, getSku | 3.16.0 |
Network Interface | azure.network_interface | tag, bulk_tag, delete | hasNSG, hasPublicIP, isAttached, isPrimary | 3.16.0 |
Public IP Address | azure.public_ip | tag, bulk_tag, delete | isAttached, isStaticAllocation, isUnattached, getSku | 3.16.0 |
Resource Group | azure.resource_group | tag, bulk_tag | isProvisioned | 3.16.0 |
SQL Database | azure.sql_database | tag, bulk_tag, pause, resume, start, stop | isElasticPool, isOnline, isPaused, isServerless, isSystemDatabase, getSkuTier | 3.16.0 |
Storage Account | azure.storage_account | tag, bulk_tag | hasNetworkRestrictions, isEncryptionEnabled, isHttpsOnly, isPublicAccessEnabled, getMinimumTlsVersion, getStorageType | 3.16.0 |
Virtual Machine | azure.virtual_machine | tag, bulk_tag, delete, start, stop | isDeallocated, isRunning, getOsType | 3.16.0 |
Virtual Machine Scale Set | azure.vmss | tag, bulk_tag, start, stop | isFlexible, isOverprovisioned, getCapacity | 3.16.0 |
Virtual Network | azure.virtual_network | tag, bulk_tag | hasSubnets, isUnused, getAddressPrefixes | 3.16.0 |
GCP Resources
Resource Name | Resource Type | Actions | Filter Functions | Version |
|---|---|---|---|---|
Cloud Storage Bucket | gcp.storage | label, bulk_label, tag, bulk_tag | hasLabel, hasRetentionPolicy, hasUniformBucketLevelAccess, isAutoclassEnabled, isEncrypted, isInLocation, isPubliclyAccessible, isVersioningEnabled, getStorageClass, getLocation | 3.16.0 |
Compute Disk | gcp.compute_disk | label, bulk_label, tag, bulk_tag, delete, snapshot | hasLabel | 3.16.0 |
Compute Instance | gcp.compute | label, bulk_label, tag, bulk_tag, start, stop, delete | hasLabel | 3.16.0 |
GKE Node Pool | gcp.gke_node_pool | label, bulk_label, tag, bulk_tag, stop | hasResourceLabel | 3.16.0 |
Machine Image | gcp.machine_image | label, bulk_label, tag, bulk_tag, delete | hasLabel | 3.16.0 |
Managed Instance Group | gcp.managed_instance_group | start, stop | isStable, isStateful | 3.16.0 |
Vertex AI Custom Job | gcp.vertex_custom_job | stop | 3.16.0 | |
Vertex AI Workbench Instance | gcp.vertex_workbench | label, bulk_label, tag, bulk_tag, stop | hasLabel | 3.16.0 |
Scheduling Policy Executions
Automation Policies can be configured to execute regularly two ways:
Run at Intervals - Run every X hours.
Run on a Schedule - Specify a scheduled time (with repeat) for this policy.
NOTE: Under normal performance conditions, scheduled tasks are expected to complete within 1 hour of the originally scheduled time.
This configuration is located in the Frequency block when editing an Automation Policy.
Run Once Capability
Automation Policies can be run as a single instance without requiring a schedule. This allows you to use these policies as ad-hoc maintenance instruments in your cloud environment. The Run Once menu is available in these places:
On the Automation Policies listing page (Automation > Automation Policies) in the more options menu for each policy.
On the Automation Policies overview page in the more options menu.
If assigned by a Cloud Rule to a Project or OU, on that object’s page under the Automation > Automation Policies > Scheduled Runs tab in the more options menu for each policy.
You must have one of the following permissions to use this capability:
Global Ad Hoc Run Automation Policies
Ad Hoc Run Project Automation Policies on a given Project
Ad Hoc Run OU Automation Policies on a given OU
Implementation Guidance
This section provides implementation guidance on using Automation Policies.
Out-of-the-Box Policies
Kion ships with out-of-the-box policies that we recommend using during the initial phase of Automation Policies introduction. You can find the specific instructions for making use of these policies in the Automation Policy Templates section.
Testing
Automation Policies make changes to your cloud resources. We highly recommend that you test all Automation Policies in a set of test accounts where you run no critical workloads to evaluate the impact of the policies in your environments prior to any assignment of Automation Policies to your sandbox or production environments.
You can use the dry-run option in the policy body in order to have the policy perform the discovery of the resources that would be impacted but not actually make those changes. This is done by adding this block:
options:
dry_run: true
User Permissions
Automation Policies introduces several new permissions into the Kion Platform to allow for flexibility in assigning accessibility of this feature to platform users. Read more about Kion Permissions in general here.
The permissions for Automation Policies are automatically included in the system managed roles that ship with Kion. If you are using system managed roles for your permissions, you do not need to adjust these permissions unless you would like to make changes. We recommend the use of the system managed roles as an easy way to ensure that you have permissions available for new features.
Generally speaking, you will need the following permissions as an administrator to use this feature:
Global Browse Automation Policies
Global Manage Automation Policies
Global Browse OU / Project Automation Policies
Global Create Automation Policies
Global Manage Automation Policy Labels
Global Ad Hoc Run Automation Policies (optional but recommended)
To view the list of Automation Policies permissions that are available in Kion (which may change over time), we recommend you view these directly in the platform using these steps:
Navigate to Settings > Permissions.
Select the permissions scheme where you’d like to review permissions:
Global Permissions Scheme is for permissions that can be granted globally in Kion.
OU Permissions Scheme is for permissions that can be granted on an OU.
Project Permissions Scheme is for permissions that can be granted on a Project.
On the permission scheme’s page, type “automation polic” (intentionally missing the ending) into the By Permission Name field above all of the permissions that are listed. This will filter the list of permissions down to those that contain this word.
The name of the permission is listed with a description of the permission below.
Some permissions imply other permissions and these are noted in the expandable Implied Permissions link on each permission if applicable.
After making permission changes, ensure that you test the roles that you’ve updated to ensure that they provide the user experience you desire.
Templates and Policy Maintenance
Automation Policies Templates are ready-to-use policies provided by Kion. These templates have been specifically crafted to help you get started. This section will focus on general information you need to know about templates and maintaining policies in your system. For more information on the specific templates, see the Automation Policy Templates section.
Templates are distributed in Kion using the Kion Managed Resources bundle. This is the same bundle that provides Kion’s Savings Opportunities and Compliance Checks. For most users, no special action is required to ensure that you get these items they are downloaded automatically. If you are in an environment that cannot reach out to Kion’s public AWS S3 buckets to download these items, see this article for instructions on how to configure them in your own S3 bucket.
Templates and Policies
When a template is first introduced to your system, a linked Policy is also created. While the template is system-managed and is not adjustable, the linked Policies are fully editable by those with the correct permissions. This linkage simply allows you to see what, if any, template was used to create a given Policy.
Template Updates
When template updates are available, these updates are shown in various places within the platform. Automation Policies that are linked to a given template will also show a notification that an update is available if those policies haven’t been modified since the update was downloaded into your system.
Update notifications will display for 30 days in dismissable banners. If you no longer wish to see these notifications, you can simply click the X on the banner. Otherwise, the notifications will automatically disappear.
To update an Automation Policy that is based on a template, simply review the changes in the template and determine if those changes should be brought over into your policy. You will need to perform a manual comparison of the policy changes and integrate the changes as you desire.
Before making changes to policies that are applied broadly, we recommend that you clone your existing policy, update it as you intend, and test it on a small scale in a non-critical way. Once you’ve confirmed that it works properly, you can either use your cloned policy and trade it out on your Cloud Rule or carry the changes over to your original rule to make them take affect.
See the Testing section of this document for more information.
Frequently Asked Questions
Does the Kion Automation Policies feature make use of Cloud Custodian?
At this time, the Kion Automation Policies feature does not make use of Cloud Custodian.
Can I create my own Automation Policies?
Yes. Automation Policies are powered by the Kion Policy Engine. See this page for more information.
Can I create my own Automation Policies templates?
At this time, we do not support user-created Automation Policies templates. This feature is intended to distribute templates provided by Kion.
Can I create a single Automation Policy that targets multiple cloud providers at once?
Yes. Within each Automation Policy are multiple Automation Policy Bodies (one for each cloud provider). Because the syntax and needs of each cloud provider are different, you can specify the needs for each provider separately but within the same Automation Policy.
How do I tell what resources were changed by Kion as the result of an Automation Policy?
Each Automation Policy page has an Impacted Resources tab. This Impacted Resources report contains the most recent change to a resource made by this policy. You can search this list using the By Keyword field to locate results.
Additionally, all changes made by Automation Policies are logged in the application logs for the automation-policy service.