How to Safely Automate AWS EBS Snapshot Cleanup Using Cloud Custodian

Large-scale AWS environments often accumulate thousands of EBS snapshots, making automated cleanup essential to control storage costs. Cloud Custodian offers a three-stage workflow: marking eligible snapshots, copying them as a safety net before deletion, and aging off the safety copies after a retention window. While the pipeline appears straightforward, developers face key pitfalls such as Lambda's 15-minute execution timeout, which can interrupt snapshot copy operations mid-batch, particularly for large or cross-region volumes. Additional risks include wasted polling costs when Lambda idles during copy waits, and misalignment between the three pipeline stages if timing is not carefully managed. Running dry-run tests with c7n-org before executing live policies is recommended to validate behavior across accounts and avoid unintended deletions.