Cloud Governance

5 open source tools compared. Sorted by stars. Scroll down for our analysis.

Tool	Stars	Velocity	Language	License	Score
infracost Cloud cost intelligence for engineers, AI coding agents, and CI/CD 💰📉 Shift FinOps Left!	12.4k	-	Go	Apache License 2.0	71
opencost Cost monitoring for Kubernetes workloads and cloud costs	6.6k	-	Go	Apache License 2.0	65
cloud-custodian Rules engine for cloud security, cost optimization, and governance, DSL in yaml for policies to query, filter, and take actions on resources	6.0k	-	Python	Apache License 2.0	69
komiser Open-source cloud-environment inspector. Supporting AWS, GCP, Azure, and more! Your cloud resources will have nowhere to hide!	4.1k	-	Go	Elastic License 2.0	49
cloud-nuke A tool for cleaning up your cloud accounts by nuking (deleting) all resources within it	3.2k	-	Go	MIT License	61

Stay ahead of the category

New tools and momentum shifts, every Wednesday.

Our Analysis

infracost12.4k★

Infracost shows you how much your Terraform will cost before you apply it. Add it to a pull request and it comments with the monthly difference: this change adds $340/mo, that one saves $1,200. The CLI is open source and free, and it pulls current cloud prices for AWS, Azure, and GCP. Running the CLI yourself is straightforward. It parses your Terraform plan and prints a cost breakdown, and the CI integrations drop estimates into GitHub, GitLab, and others. No infrastructure needed, and the free CLI does the actual estimating, which is the part most teams care about. Infracost Cloud is the paid layer: a dashboard, cost policies that can block a PR when it spikes spend, tagging checks, and team-wide reporting. It has a free tier and paid plans above it. Solo and small teams, the CLI in CI is enough. Larger orgs that want guardrails and central visibility across many repos, the cloud tier is the point. The catch: estimates are list-price and usage-agnostic. It prices the resources, not your actual traffic, so a serverless function shows near-zero even if it runs constantly. Treat it as a directional signal on infrastructure cost, not a forecast of your bill.

opencost6.6k★

OpenCost tells you what your Kubernetes workloads actually cost, broken down by namespace, deployment, pod, or label. It's a CNCF project, free and open source, and it turns our cloud bill went up into this team's service is the reason. Real-time cost allocation for anyone running Kubernetes. It runs in your cluster and reads resource usage plus your cloud provider's billing rates to attribute spend. Setup is a Helm chart and, for accurate cloud pricing, provider billing access. You get an API and a basic UI, and many teams pipe the metrics into a Grafana they already run. OpenCost is the free, open specification. Kubecost, from the same team, is the commercial product built on it, adding a richer UI, alerts, savings recommendations, and enterprise features. Solo and small clusters, OpenCost plus Grafana. Larger orgs that want the polish and recommendations without building dashboards, look at Kubecost. The catch: it only sees Kubernetes. Your managed databases, load balancers, and everything outside the cluster don't show up, and those are often the bigger line items. It's a piece of your cost picture, not the whole thing.

cloud-custodian6.0k★

Cloud Custodian enforces rules across your cloud accounts using simple YAML policies. Want to auto-tag untagged resources, stop idle instances at night, or delete unencrypted volumes? You write a policy, it runs, it acts. Open source, originally built at Capital One, now a CNCF project, and free. Policies are YAML files that describe a resource, a filter, and an action, and Custodian executes them against AWS, Azure, or GCP, either on a schedule or in response to events. Running it yourself means wiring up execution, a cron box, a Lambda, or your CI, plus the credentials to act. The engine is powerful, and the setup takes real thought about what you let it change automatically. Stacklet is the commercial platform from Custodian's creators, adding a control plane, policy management, dashboards, and governance-at-scale features. Solo and small teams, the open source engine covers cost cleanup and tagging nicely. Large orgs governing hundreds of accounts, Stacklet is what you graduate to. For most teams the free tool is plenty. The catch: it takes actions on live infrastructure, so a bad filter can stop or delete something you needed. Test policies in dry-run mode religiously before you let them act. The power that makes it useful is the same power that makes a mistake expensive.

komiser4.1k★

Komiser maps your entire cloud footprint in one place: every resource across AWS, GCP, Azure, and more, with the cost attached. It answers what do we actually have running and what is it costing us, which is harder than it should be once you're spread across accounts and clouds. Free to self-host. You run it as a single binary or container with read-only credentials, and it builds a dashboard of resources, regions, and spend. Setup is quick, and it's aimed at giving a solo operator or a small team a clear picture without standing up a heavy platform. One thing to know: Komiser is under the Elastic License 2.0, so it's source-available, not true open source. You can self-host it freely for your own use, you just can't turn around and offer it to others as a hosted service. Solo operators and small teams won't feel that limit at all. Tailwarden, which maintains Komiser, sells the hosted version if you'd rather not run it. The catch: inventory tools live and die by provider coverage, and the newest services or niche resource types may not show up. It's great for the common resources; verify anything critical against the provider console.

cloud-nuke3.2k★

cloud-nuke deletes cloud resources in bulk, fast. Spun up a test environment, a demo account, or a pile of resources from a workshop and want them gone? It finds and destroys them across an AWS account, with growing Azure and GCP support, filtered by age, type, or region. Open source and free from Gruntwork. It's a Go CLI. You run it, it shows you what it found, you confirm, it deletes. There's an inspect mode to preview and filters so you don't wipe production by accident. No infrastructure, just credentials with enough permission to delete, which is exactly why you handle it carefully. This is a fully free, single-purpose tool. Gruntwork sells a much broader infrastructure subscription, but cloud-nuke stands alone at no cost. For anyone burning down ephemeral accounts or cleaning up after tests, it's a huge time saver. The catch: it deletes things. Run it against the wrong account or with too-loose filters and it will happily destroy resources you wanted. Never point it at an account with anything you care about, and always inspect before you confirm. Treat it like a loaded tool, because it is.