Cloud Custodian
Cloud Custodian is a free rules engine used to define and enforce cloud resource policies across AWS, Azure, and GCP for cloud security and platform teams.
0 upvotes · 0 downvotes
No ratings yet
- Category
- Cloud Security
- Pricing
- Free
- Platforms
- LinuxWindowsmacOS
- License
- Open source
- Reviewed
- Last reviewed 25 October 2026
What it is
A Python tool that runs YAML policies against cloud APIs. Policies can filter resources by tags, age, or configuration and then notify, tag, stop, or delete them on a schedule or in response to events.
What it helps with
- Enforcing tag and encryption standards across accounts
- Stopping or deleting unused expensive resources
- Responding to config drift with automated remediation
- Writing one policy style for AWS, Azure, and GCP
Who it's for
Cloud security engineers, FinOps teams, and platform operators who manage multi-account cloud estates.
Worth knowing
Policies are plain YAML, so they are easy to review in pull requests. It can run as a periodic job or react to cloud events such as AWS CloudWatch Events and Azure Event Grid.
Does it only report problems?
No, policies can also remediate by tagging, stopping, or deleting resources when you configure them to.
How does it compare with Prowler?
In our view Prowler suits ready-made security checks, while Cloud Custodian suits custom YAML policies that also take action.
Discussion & reviews
0 comments
No contributions yet. Be the first to review or comment.