Cloud Custodian

Overview

Cloud Custodian is a policy-as-code tool for teams managing resources across major cloud providers. It is best suited to operators comfortable defining and running YAML policies; the trade-off is that it offers a flexible toolkit rather than a turnkey governance service.

Key features

Policies with a preview step

A policy names a resource type, filters the resources to target, and specifies actions for matches. That pattern can cover security enforcement, compliance, tagging, removal of unused resources, and cost management. Validation and dry-run mode show which resources match before actions execute, a useful safeguard for teams automating consequential changes. Policy testing, admission control, runtime enforcement, CI/CD integration, and reporting are also supported.

Event-driven and scheduled runs

Policies can respond to cloud-provider events through serverless integrations or run periodically as a server cron job. Documented integrations include AWS CloudWatch Events and Config Rules, Azure EventGrid, and GCP AuditLog and Pub/Sub. AWS event-triggered policies must run in the same account and region; periodic policies can run from a different account and region. That distinction matters for teams centralizing scheduled governance across accounts.

Records and deployment

Runs can produce policy metrics, structured resource records, and logs for cloud-provider metrics, storage, and logging services. The project documents installation on Linux, macOS, and Windows, as well as Docker and Kubernetes deployment; execution options include local machines, instances, and AWS Lambda. AWS, Azure, and Google Cloud Platform resources are covered by policy support. Kubernetes, Tencent Cloud, and OpenStack integrations are beta, while Terraform integration is alpha, so teams relying on those should account for their lower maturity.

Pricing

Cloud Custodian is free: its plan costs nothing, billed Free for everyone to use, and is open source under the Apache 2.0 license. There is no free trial because the project is already free. This removes a subscription barrier for teams able to operate the policies themselves; the project does not offer paid tiers with different quotas or seats.

Platforms

Cloud Custodian supports Linux, macOS, Windows, and self-hosted use. Docker and Kubernetes are documented deployment routes, and policies can run locally, on an instance, or through AWS Lambda. The platform options suit teams choosing their own execution environment rather than looking for a single hosted console.

Who it's for

It fits cloud and platform teams that want one policy model for governance tasks across AWS, Azure, and GCP, and that can review YAML and manage execution. Dry runs and reporting help teams control risk and inspect outcomes. It is less suitable for readers seeking a managed product with a graphical workflow, or for teams whose required integration is still in beta or alpha.

Pros and cons

• Pros: Free, Apache 2.0 software with policy support spanning AWS, Azure, and GCP, making it practical for teams standardizing controls across providers.
• Pros: Validation and dry runs expose matching resources before actions run, reducing the risk of unintended automated changes.
• Pros: Event-based and scheduled execution, plus metrics, records, and logs, support both responsive controls and ongoing review.
• Cons: Policies are written in YAML and users manage their own execution, which puts operational responsibility on the adopting team.
• Cons: AWS event-triggered policies are constrained to the same account and region, limiting centralized event response across boundaries.
• Cons: Kubernetes, Tencent Cloud, and OpenStack support is beta, and Terraform integration is alpha, making them less mature choices.

Alternatives

For a broad comparison, see Cloud Governance Software and Infrastructure Policy as Code Tools.

• OmniGCloud is worth considering when a SaaS workspace and connector-based approach are preferable; its free plan includes one connector, one SaaS workspace, basic CSV export, and a basic audit trail.
• Kyverno is another free, Apache-licensed open-source option for teams evaluating policy tools across Linux, macOS, Windows, and self-hosted environments.
• AWS Control Tower may suit teams wanting an AWS service with no additional Control Tower charge, while bearing in mind that underlying AWS services are billed by usage.
• CGPulse offers a free plan with two cloud accounts, ten scans per month, one tracked initiative, five auto-fixes per month, and watermarked PDF reports; its free trial is another option to evaluate.
• Kubewarden is a free option for readers comparing policy tools across Linux, macOS, Windows, and self-hosted platforms.
• Powerpipe is a free, open-source tool from Turbot for teams considering another Linux, macOS, Windows, self-hosted, or web option.
• AWS Config is a paid, usage-based alternative for AWS-focused readers; charges depend on configuration items recorded, active rules, and other usage.
• CoreStack Cloud Governance is a paid option for teams seeking a product or bundle with unlimited CoreStack Assessments and willing to request custom pricing.

Verdict

Choose Cloud Custodian if your team wants free, flexible policy automation across AWS, Azure, and GCP and can own YAML authoring and operations. Its preview workflow and varied execution options are compelling; look elsewhere if you need a managed interface or depend on integrations that remain beta or alpha.