- Home
- Cloud Governance Software
- Cloud Custodian
Cloud Custodian
What it is
Cloud Custodian is a free, open-source project for managing cloud resources with policies written in YAML. A policy names a resource type, uses filters to select matching resources, and specifies actions to take. The project supports security enforcement, compliance, tagging, cleanup of unused resources, and cost management for AWS, Azure, and Google Cloud Platform resources. Policies can run in response to provider events through serverless features or on a cron schedule. Users can validate policies and preview matches in dry-run mode before actions are applied. Runs can produce policy metrics, structured resource records, and logs for cloud metrics, storage, and logging services. Documented event connections include AWS CloudWatch Events and Config Rules, Azure EventGrid, and GCP AuditLog and Pub/Sub. Installation is documented for Linux, macOS, and Windows, with Docker and Kubernetes operation also covered. Kubernetes, Tencent Cloud, and OpenStack support are in beta; Terraform integration is in alpha. One AWS limitation is that event-triggered policies run only within the same region and account, while periodic policies may run elsewhere.
For and against
For
- Supports AWS, Azure, and Google Cloud Platform resources.
- Dry-run mode previews matches before actions execute.
- Policies can run on events or schedules.
- Free and open source under Apache 2.0.
Against
- Kubernetes, Tencent Cloud, and OpenStack support are in beta.
- Terraform integration is in alpha.
- AWS event policies are limited to one region and account.
The verdict
Cloud Custodian gives cloud teams a policy-based way to filter resources and apply actions. Note the maturity labels for some integrations and the AWS event-policy scope limit.
Who it suits
Cloud Custodian may suit teams managing cloud resources who want policy-based filtering, enforcement, or cleanup. It is for users comfortable working with YAML policies and cloud environments.
Plans and prices
Cloud Custodian
Open source · Apache 2.0 license
Read 29 Sep 2026 · cloudcustodian.io
On the record
- Beta and alpha support
- The homepage says Kubernetes, Tencent Cloud, and OpenStack support is in beta, while Terraform integration is currently in alpha.cloudcustodian.io · read 29 Sep 2026
- Cloud providers
- The documentation describes policy support for AWS, Azure, and Google Cloud Platform resources.cloudcustodian.io · read 29 Sep 2026
- Community support
- The project points users to Slack, a mailing list, GitHub discussions, and community meetings that are open to users and developers of every skill level.cloudcustodian.io · read 29 Sep 2026
- Deployment options
- The project documents installation on Linux, macOS, and Windows, and running through Docker or Kubernetes; its homepage also describes local, instance, and AWS Lambda execution.cloudcustodian.io · read 29 Sep 2026
- Enforcement
- Cloud Custodian integrates with provider serverless features to enforce policies in response to events, and can also run as a cron job on a server.cloudcustodian.io · read 29 Sep 2026
- Integration examples
- Documented event integrations include AWS CloudWatch Events and Config Rules, Azure EventGrid, and GCP AuditLog and Pub/Sub.cloudcustodian.io · read 29 Sep 2026
- Maker and history
- The site identifies the project as a community project and states that it was accepted to CNCF on June 25, 2020; it does not state a headquarters or founding date.cncf.io · read 29 Sep 2026
- Metrics and records
- Runs can produce policy metrics, structured resource records, and logs for cloud provider metrics, storage, and logging services.cloudcustodian.io · read 29 Sep 2026
- Notable execution limit
- The AWS documentation says event-triggered policies can run only in the same region and account, while periodic policies may run in a different region and account.cloudcustodian.io · read 29 Sep 2026
- Policy controls
- Policies specify a resource type, filters to narrow resources, and actions to apply to matching resources.cloudcustodian.io · read 29 Sep 2026
- Policy preview
- Users can validate policies and run them in dry-run mode to see matching resources without executing actions.cloudcustodian.io · read 29 Sep 2026
- Purpose
- Cloud Custodian manages cloud resources by filtering and tagging them, then applying actions through policies written in a YAML domain specific language.cloudcustodian.io · read 29 Sep 2026
- Security and cost
- It supports security policy enforcement, compliance, tag policies, cleanup of unused resources, and cost management.cloudcustodian.io · read 29 Sep 2026
- Security reporting
- The project asks people to report security vulnerabilities to its security team at [email protected] and says it will acknowledge reports by email.github.com · read 29 Sep 2026
