Cloud Custodian

What Cloud Custodian does

Cloud Custodian is an open-source cloud resource management platform that enables DevOps and cloud engineering teams to manage infrastructure through policy-as-code. The core engine (c7n) is a Python-based tool using a YAML Domain Specific Language to define rules that filter, tag, and apply actions to cloud resources. It supports AWS, Azure, and GCP as generally available, with Kubernetes, Tencent Cloud, and OpenStack in beta, and integrates natively with each cloud provider's control plane to enable real-time compliance enforcement and remediation.

The platform is distributed as a suite of modular sub-projects: c7n-org for multi-account and multi-region execution, c7n-mailer for notifications across email, Slack, Splunk, DataDog, SendGrid, and Microsoft Graph, c7n-kube for Kubernetes controller and admission webhook support, c7n-left for Terraform Infrastructure-as-Code policy validation, and utility tools for GuardDuty automation, retroactive CloudTrail-based tagging, policy change tracking, distributed S3 processing, and Docker-based deployment. Use cases include security policy enforcement, off-hours resource scheduling, garbage collection of unused resources, tag compliance, and shift-left governance.

Cloud Custodian operates under the Apache 2.0 license as a CNCF Incubating Project maintained by 'The Cloud Custodian Community.' It has no direct revenue model and no commercial entity behind it; adoption flows through community-led go-to-market via GitHub, PyPI, Docker Hub, a Slack community, and the CNCF ecosystem. There is no disclosed funding, parent company, headcount, leadership team, or named enterprise customer base in the available data.

Name

Cloud Custodian

Legal name

The Cloud Custodian Community

Website

https://cloudcustodian.io

Company type

Private

Operating status

Operating

Short description

Cloud Custodian is an open-source policy-as-code engine that lets DevOps and cloud engineering teams manage AWS, Azure, and GCP resources through YAML-defined rules for compliance, cost optimization, and security remediation, distributed as a CNCF Incubating Project under Apache 2.0.

Ownership category

akta.pro rank

Product category

Cloud Infrastructure Governance

NAICS

Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services (51821), Computer Facilities Management Services (541513)

SIC

Services-Prepackaged Software (7372)

akta.pro primary industry

Policy, Governance & Compliance Management for Private Cloud (HDABABAI)

akta.pro secondary industries

Cloud Compliance, Audit & Continuous Controls Monitoring (CCM/GRC) (HDABAHAI), Cloud Managed Services (Operations, Monitoring, Patching) (BPAEACAF)

Keywords

• Cloud governance
• Policy as code
• Multi-cloud management
• Cloud security compliance
• Cloud cost optimization

GTM type

B2B

Offering type

Software

Cost components

Personnel, Infrastructure, Operations

Revenue model

1. Open Source Free Distribution: Cloud Custodian is open source software available free of charge under Apache 2.0 license. There is no direct revenue model; the project is community-driven with contributions from individuals and organizations who use the software.

Pricing tiers

Go-to-market motion1 record

Distribution channels4 records

Marketing channels4 records

Core offering

Cloud Custodian is an open-source cloud resource management platform that enables users to manage AWS, Azure, and GCP environments (with Kubernetes, Tencent Cloud, and OpenStack in beta) by filtering, tagging, and applying actions to cloud resources through a YAML-based Domain Specific Language (DSL). It provides real-time compliance enforcement, cost management via off-hours scheduling and garbage collection, and shift-left governance through Terraform integration. The software is freely distributed under the Apache 2.0 license as a CNCF Incubating Project.

Product overview

Cloud Custodian is an open-source cloud resource management platform designed to manage AWS, Azure, and GCP public cloud environments (with Kubernetes, Tencent Cloud, and OpenStack support in beta). The core Cloud Custodian engine (c7n) uses a YAML-based DSL to enable users to define policies for filtering, tagging, and applying actions to cloud resources. The platform is built around a unified architecture where policies are written once and can be executed across multiple cloud providers. Key modules include c7n-org for multi-account execution, c7n-mailer for notifications (email, Slack, Splunk, DataDog, SendGrid, Microsoft Graph), c7n-kube for Kubernetes support, c7n-left for Terraform IaC policy validation, and several utility tools for logging, retroactive tagging, policy change tracking, GuardDuty management, and S3 processing. Cloud Custodian is a CNCF Incubating Project released under the Apache 2.0 license.

Differentiator

Problem solved

Functional benefit

Products and services

• Cloud Custodian (c7n) Cloud Custodian (c7n) is an open-source cloud resource management platform that enables DevOps and Cloud Engineering teams to filter, tag, and apply actions to cloud resources across AWS, Azure, and GCP using a YAML DSL. It supports real-time compliance enforcement, cost management, and shift-left governance via Terraform integration.
• c7n-org Multi-account Custodian execution tool that runs policies across multiple cloud accounts and regions simultaneously for enterprise-scale cloud governance.
• c7n-mailer Custodian Mailer tool for sending notifications via email, Slack, Splunk HTTP Event Collector (HEC), DataDog, SendGrid, and Microsoft Graph.
• c7n-kube Custodian Kubernetes support tool providing Kubernetes controller mode and MutatingWebhookConfiguration generation for cluster governance.
• c7n-left Custodian policies for Infrastructure as Code (IaC), enabling policy enforcement on Terraform configurations for shift-left governance and compliance.

Quantifiable outcome

• Replace complex ad-hoc scripts with simpler YAML syntax

Segments1 record

Ideal customer profiles1 record

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration1 record

Feature6 records

Partnerships

One partnership is on record.

• Cloud Native Computing Foundation (CNCF)coreStrategic or Co-development PartnerCloud Custodian is a CNCF Incubating Project, meaning it has achieved significant community adoption and is recognized within the cloud native ecosystem. The foundation provides governance, marketing, and community support while the project maintains its independent open-source development model.

Scale indicators1 record

Recent moves6 records

Expansion highlights4 records

Broad incumbents

• Aqua Security: Cloud-native security platform covering container, Kubernetes, and cloud workload protection with policy enforcement capabilities. Adjacent incumbent with overlapping policy/governance functionality in the cloud-native ecosystem where Cloud Custodian also operates.
• Wiz: Leading commercial cloud security posture management platform covering compliance, vulnerability, and identity risks across AWS, Azure, GCP, and Kubernetes. A broader incumbent that overlaps with Cloud Custodian's compliance and policy enforcement use cases but as part of a much wider security portfolio.

Direct peers

• Open Policy Agent: CNCF Graduated project offering a general-purpose policy engine with Rego DSL for cloud-native policy enforcement. Directly comparable as the leading policy-as-code framework that Cloud Custodian overlaps with, particularly for Kubernetes governance.
• CloudQuery: Open-source high-performance cloud asset inventory and ETL platform syncing cloud configurations into databases for compliance, security, and FinOps use cases. Comparable multi-cloud resource visibility approach overlapping with Cloud Custodian's tagging and reporting use cases.
• Bridgecrew / Checkov: Static analysis for infrastructure-as-code with a large policy library across Terraform, CloudFormation, and Kubernetes (Checkov), now part of Palo Alto's Prisma Cloud. Closest commercial competitor to c7n-left for IaC scanning and policy enforcement.
• HashiCorp Sentinel: Policy-as-code framework embedded in HashiCorp Terraform and Nomad for enforcing infrastructure policy at provisioning time. Comparable to Cloud Custodian's shift-left governance ambitions and frequently evaluated alongside it for IaC policy.
• KICS: Keeping Infrastructure as Code Secure by SpectralOps — open-source static analysis for Terraform, CloudFormation, Kubernetes, and ARM templates. Directly comparable to Cloud Custodian's c7n-left module for pre-deployment IaC compliance.
• Pulumi CrossGuard: Policy-as-code engine for Pulumi infrastructure-as-code programs, enabling guardrails on cloud resources at deployment time. Competes directly with c7n-left in the multi-cloud IaC policy enforcement category.
• Steampipe: Open-source SQL-based query engine for cloud APIs that enables compliance checks and asset inventory across AWS, Azure, GCP, and Kubernetes. Comparable as a community-driven multi-cloud compliance and asset visibility tool with overlapping use cases.
• Prowler: Open-source cloud security posture management tool with extensive AWS, Azure, GCP, and Kubernetes checks. Comparable community-driven CSPM offering that competes for the same DevSecOps and compliance personas.

Market position

Strengths4 records

Weaknesses5 records

Competitive moat3 records

Key risks6 records

Key highlights6 records

Customer concentration

• GitHubgithub.com/cloud-custodian/cloud-custodian

Revenue estimate

Valuation estimate

Number of profiles

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Cloud Custodian