Tools/Cloud_Custodian
Cloud Custodian
Open-source policy-as-code engine (YAML-defined policies) for cloud resource compliance and automated remediation — evaluates and can act on resource state across AWS, Azure, and GCP in one tool. Closest open-source equivalent to AWS_Config, but cloud-agnostic rather than AWS-only, and includes remediation actions rather than just alerting. Steampipe (SQL-based resource querying) and Prowler (CIS benchmark auditing) cover overlapping ground with a different query model, and are commonly used alongside Cloud Custodian for AWS_Firewall_Manager/AWS_Trusted_Advisor-style org-wide policy enforcement.