AWS Controllers for Kubernetes

AWS Controllers for Kubernetes (ACK) lets teams define and manage AWS resources from Kubernetes through Kubernetes custom resources. It periodically checks whether resources in AWS match the desired state and corrects drift. The documentation lists 74 service controllers, including S3, RDS, Lambda, and DynamoDB. ACK supports declarative, version-controlled infrastructure alongside applications, across AWS accounts and regions. Read-only resources and read-only adoption can support migration from other infrastructure-as-code tools.

Amazon EKS users can choose EKS Capabilities, where AWS manages controller installation and upgrades and provides automatic updates, auto-scaling, and auto-tuning. Alternatively, self-managed Helm installation works on EKS, GKE, AKS, on-premises clusters, and local development environments. ACK uses AWS IAM permissions for controller access to AWS resources. Self-managed ACK is free for Helm installation on Kubernetes 1.20+ on any Kubernetes cluster. EKS Capability charges are hourly, with a base rate for each enabled capability plus charges per ACK resource managed.

ACK brings AWS resource management into Kubernetes workflows, with support for drift correction and version-controlled infrastructure. Its two installation paths accommodate managed EKS use and self-managed clusters, with different operational control and billing arrangements.

ACK suits teams managing AWS infrastructure through Kubernetes. EKS users seeking managed operations can choose EKS Capabilities, while teams needing version and configuration control or using other Kubernetes environments can use the self-managed installation.

AWS Controllers for Kubernetes (ACK) brings AWS resource definitions into Kubernetes manifests, making it a natural fit for teams already operating applications and infrastructure through Kubernetes. Its strongest case is a declarative workflow with ongoing drift correction; teams that do not want Kubernetes to be their infrastructure control plane should look elsewhere.

Overview

ACK periodically reconciles the desired state declared in Kubernetes with the state of AWS resources and corrects drift. That makes it more than a way to create resources: it helps keep them aligned with version-controlled configuration over time. The trade-off is that teams must be comfortable managing infrastructure through Kubernetes custom resources.

The documentation covers 74 AWS service controllers, including S3, RDS, Lambda, and DynamoDB. ACK also supports management across AWS accounts and regions. Read-only resources and read-only adoption can help teams bring existing infrastructure into a migration while limiting the risk of changing it during the transition.

Key features

Declarative control and reconciliation

Definitions use YAML or JSON and can live alongside application configuration in version control. This suits teams that want infrastructure changes to follow familiar Kubernetes and GitOps workflows. Periodic reconciliation helps correct drift, though ACK is a poor fit if the team does not want Kubernetes to serve as the source of desired infrastructure state.

IAM permissions and resource adoption

ACK uses AWS IAM permissions to authorize controller access to AWS resources. Read-only support and adoption provide a cautious path for migration from other infrastructure-as-code tools, rather than requiring every existing resource to become writable under ACK immediately.

Pricing

The self-managed ACK plan costs free. It includes Helm installation, supports Kubernetes 1.20+, and can run on any Kubernetes cluster. This is the straightforward choice for teams willing to handle controller installation and upgrades themselves.

The ACK EKS Capability has custom pricing. Charges are hourly for each enabled capability, with additional usage charges based on each ACK resource managed. It requires Amazon EKS and has no minimum commitment or upfront fees. This avoids operating the controllers directly, but usage-based charges mean the cost depends on both enabled capabilities and managed resources.

ACK is open source and has a free plan. The self-managed option carries no listed charge; the managed EKS route is not a flat-price substitute, so teams should weigh its operational convenience against hourly and per-resource billing.

Platforms

ACK supports AWS and offers two deployment paths. The managed EKS Capabilities installation is for Amazon EKS. Self-managed Helm installation works on EKS, GKE, AKS, on-premises Kubernetes, and local development environments. EKS Capabilities puts controller installation and upgrades in AWS’s hands, with automatic updates, auto-scaling, and auto-tuning. Self-management instead gives teams version and configuration control across a wider range of Kubernetes environments.

State management is self-hosted, and ACK supports self-hosted execution. Its documented community channels include Slack and GitHub Discussions.

Who it's for

ACK is best for Kubernetes operators who want AWS resources represented as Kubernetes custom resources, managed alongside applications and reconciled against version-controlled declarations. EKS users who prefer AWS to manage controller operations should consider EKS Capabilities; teams that need control over versions and configuration, or run Kubernetes outside EKS, are better suited to the Helm installation.

Pros and cons

Pros

• Drift correction: periodic reconciliation helps keep actual AWS state aligned with declared Kubernetes resources.
• Broad AWS coverage: 74 documented service controllers include commonly used services such as S3, RDS, Lambda, and DynamoDB.
• Flexible deployment: managed EKS operations and self-managed installation address different needs, with the latter supporting multiple Kubernetes environments.
• Migration support: read-only resources and adoption can ease transitions from other infrastructure-as-code tools.

Cons

• Kubernetes is central to the workflow: teams that do not manage infrastructure through Kubernetes will get less from ACK’s declarative model.
• Managed billing varies with use: EKS Capability charges include hourly capability rates and per-resource usage charges, rather than one fixed price.
• Self-management requires operational ownership: teams choosing Helm retain control over versions and configuration, but also take on controller installation and upgrades.

Alternatives

Infrastructure as Code Tools is a useful starting point for comparing options beyond Kubernetes-native AWS management.

Choose Terraform instead if you want a freemium infrastructure-as-code option with a free tier that includes 500 managed resources, one concurrent remote run, and one concurrent agent run. AWS CloudFormation is another AWS-focused choice, with a free service whose underlying AWS resources are billed separately. For an open-source infrastructure-as-code tool, consider OpenTofu.

Cloudify, env0, Pulumi, Scalr, and Spacelift are also alternatives to compare.

Verdict

Choose ACK if your team already treats Kubernetes manifests as the control point for AWS infrastructure and wants ongoing reconciliation, broad service coverage, and a free self-managed path. EKS Capabilities suits teams that prefer AWS-managed controller operations, while teams that do not want infrastructure coupled to Kubernetes should choose another approach.