What is Cloud Custodian, and should you use it?

The short answer

Cloud Custodian is an open-source policy-as-code engine, originally built at Capital One, that lets you define governance rules in YAML — which resources to match, what to check, and what action to take. It runs on a schedule or in response to live cloud events, and supports AWS, Azure and GCP.

Cloud Custodian is a rules engine for your cloud account. You describe the resources you care about and what should happen to them, in YAML, and it evaluates that description against reality — either on a schedule or the moment something changes.

What a policy looks like

policies:
  - name: ec2-stop-untagged-nonprod
    resource: aws.ec2
    filters:
      - "tag:Environment": nonprod
      - "tag:Owner": absent
    actions:
      - type: notify
        to: ["platform@example.com"]

That is the whole idea. A resource type, filters that narrow it down, and actions to take. Actions range from notify through tag to stop and delete — which is why the mode a policy runs in matters more than the policy itself.

Where it fits

Against AWS Config: Config tells you whether a resource is compliant. Custodian can tell you that and then do something about it, across accounts, with the rule itself living in your repository.

Against commercial FinOps platforms: those give you dashboards, forecasting and recommendations, generally without changing anything in your account. Custodian changes things. In practice the two are complementary rather than competing — one tells you what your spend is doing, the other stops it doing that again.

TODO — expand this comparison with the specific tools your clients already run, and be fair about where Custodian is the wrong choice.

Should you use it?

If you have the engineering time to write and maintain the policies, yes — it is free, well established, and the rules are yours. What it does not come with is the library. A working set of policies, tuned to your estate and rolled out in an order that does not frighten anyone, is most of the actual work.

TODO — link to the policy library section on the homepage once the real policy names are in.