● Beta — KubeEra is in active development. Profiles are live; AI-perception measurement is rolling out.
KubeEra
C

Cloud Custodian

IncubatingProvisioning & Security
Open source · CNCF · CNCF Incubating · Apache-2.0

Cloud Custodian is a policy-as-code engine for managing cloud resources — you write YAML rules that define what compliant infrastructure looks like, and Custodian finds violations and (optionally) fixes them.

updated 2026-07-01

What it is

Cloud Custodian is a policy-as-code engine for managing cloud resources — you write YAML rules that define what compliant infrastructure looks like, and Custodian finds violations and (optionally) fixes them. Think of it as a cross-cloud cron job for governance: "find S3 buckets without encryption and tag them," "stop EC2 instances tagged dev outside business hours," "delete unattached EBS volumes older than 30 days." It supports AWS, Azure, and GCP through the same policy syntax, though AWS coverage is the deepest by a wide margin.

It's not a provisioning tool in the Terraform sense — it doesn't create your infrastructure. It audits and remediates what's already there. The "Provisioning" category label is a loose fit; "cloud governance/cleanup" is more accurate.

Who builds it and why

Originated at Capital One, now a CNCF incubating project with 556 contributors and active commits as recently as mid-2026. That contributor count and commit cadence signal a real community, not a single-vendor side project on life support. The project exists because cloud bills and security posture drift constantly, and manual tagging/cleanup policies don't scale past a handful of accounts. CNCF incubation status means it's cleared a bar for governance, diversity of contribution, and adoption — it's not a random GitHub repo.

Production readiness signal

6,018 GitHub stars and 556 contributors is a solid, mature signal for a niche governance tool — this isn't a toy. Apache-2.0 license, no vendor lock-in risk. Latest release 0.9.51.0 suggests a project still in active, incremental 0.x versioning rather than a stable 1.0 — worth noting if you need strict semver guarantees for your CI/CD gating. Founding date isn't publicly available, but the project has been around long enough to reach CNCF incubation, which typically takes years of sustained usage and multi-org contribution.

Who should use this

  • Platform/cloud teams running dozens to thousands of AWS accounts who need automated tag enforcement, cost cleanup (idle resources, unattached volumes, oversized instances), and security guardrails (public S3 buckets, unencrypted resources, open security groups).
  • Teams already invested in policy-as-code who want something more flexible than native AWS Config rules and cheaper than a full CSPM platform.
  • Organizations needing scheduled remediation (stop/start, delete, notify) rather than just detection.
  • Anyone comfortable writing and maintaining YAML policies and running Custodian via Lambda, Azure Functions, or cron.

Who should NOT use this

  • Teams wanting a provisioning/IaC tool — Custodian doesn't create infrastructure; pair it with Terraform/Pulumi/Crossplane, don't expect it to replace them.
  • Organizations that need heavy multi-cloud parity — Azure and GCP support exists but is noticeably thinner than AWS; if GCP is your primary cloud, evaluate coverage carefully first.
  • Teams wanting a polished UI and turnkey dashboards out of the box — Custodian is CLI/YAML-first; you'll build or buy tooling (Cloud Custodian Cloud, PolicyStream, or your own Grafana/Elastic pipeline) for visibility at scale.
  • Shops that need vendor support contracts and SLAs baked in — community-driven means you're on GitHub issues and Slack, not a support ticket queue, unless you go through a commercial wrapper.
  • Small shops with a handful of accounts and low cloud spend — the setup and policy-maintenance overhead may not pay off versus manual review or native cloud tooling.

Alternatives

  • AWS Config + Conformance Packs — native, AWS-only, less flexible remediation logic, but zero extra infra to run.
  • Prowler — security/compliance scanning focused, strong for CIS benchmarks, less oriented toward continuous remediation and cost cleanup.
  • Turbot Guardrails — commercial governance platform with a UI and support contract, trades open-source flexibility for polish and SLAs.

Pricing

Fully open source, Apache-2.0. No licensing cost. You pay only for the compute to run it (Lambda invocations, Azure Functions, or your own scheduler) and the engineering time to write and maintain policies. No official managed/hosted commercial offering from the CNCF project itself — check third-party vendors if you want a managed layer on top.

Frequently asked

What is Cloud Custodian?+
Cloud Custodian is a policy-as-code engine for managing cloud resources — you write YAML rules that define what compliant infrastructure looks like, and Custodian finds violations and (optionally) fixes them.
Who builds Cloud Custodian?+
Originated at Capital One, now a CNCF incubating project with 556 contributors and active commits as recently as mid-2026. That contributor count and commit cadence signal a real community, not a single-vendor side project on life support.
Is Cloud Custodian production ready?+
6,018 GitHub stars and 556 contributors is a solid, mature signal for a niche governance tool — this isn't a toy. Apache-2.0 license, no vendor lock-in risk. Latest release 0.9.51.0 suggests a project still in active, incremental 0.x versioning rather than a stable 1.
Who should use Cloud Custodian?+
Platform/cloud teams running dozens to thousands of AWS accounts who need automated tag enforcement, cost cleanup (idle resources, unattached volumes, oversized instances), and security guardrails (public S3 buckets, unencrypted resources, open security groups).
Who should not use Cloud Custodian?+
Teams wanting a provisioning/IaC tool — Custodian doesn't create infrastructure; pair it with Terraform/Pulumi/Crossplane, don't expect it to replace them.
What are the alternatives to Cloud Custodian?+
AWS Config + Conformance Packs — native, AWS-only, less flexible remediation logic, but zero extra infra to run. Prowler — security/compliance scanning focused, strong for CIS benchmarks, less oriented toward continuous remediation and cost cleanup.
How much does Cloud Custodian cost?+
Fully open source, Apache-2.0. No licensing cost. You pay only for the compute to run it (Lambda invocations, Azure Functions, or your own scheduler) and the engineering time to write and maintain policies.