AWS CloudFormation vs Fairwinds Polaris

AWS CloudFormation models, provisions, and manages related AWS and third-party resources as infrastructure as code. YAML or JSON templates define AWS resources and their properties. StackSets deploy a common set of resources across multiple AWS accounts and Regions; Change Sets preview proposed stack updates, including possible deletion or replacement, and Drift Detection tracks changes made outside the service. For authoring, AWS CDK supports TypeScript, Python, Java, and .NET, while AWS SAM offers shorthand YAML for serverless resources that is converted during deployment. The CloudFormation Registry supports third-party resources and modules, and stacks can be updated from remote Git repositories. The service is available through API, Linux, macOS, web, and Windows, and manages state. CloudFormation itself has a free plan, with no additional charge for AWS and Alexa resource providers, but created AWS resources are billed at their standard rates. Third-party provider and custom hook operations may also incur charges. Access can be managed with IAM, and CloudTrail logs API calls.

Fairwinds Polaris is an open source policy engine for validating and remediating Kubernetes resource configuration. It includes more than 30 built-in policies, and teams can add their own using JSON Schema. Checks cover security practices such as least privilege, privilege escalation, root execution, and host IPC or PID settings, along with resource requests and limits, readiness and liveness probes, and image tags. Polaris can run as a dashboard, an admission controller, or a command-line tool for checking local YAML files in CI/CD. Its validating webhook rejects workloads that trigger danger-level checks; warning-level findings pass and appear in the dashboard or webhook logs. A mutating webhook or command-line run can automatically remediate supported issues, including missing limits and probes and some unsafe security settings. The dashboard can audit local files or connect to a live cluster, and can be installed with kubectl or Helm. The validating webhook requires a valid TLS certificate. Polaris is free and runs on Linux, macOS, Windows, web, and self-hosted environments.