AWS Config vs Open Policy Agent Gatekeeper

AWS Config assesses, audits, and evaluates AWS resource configurations through web and API access. It records configuration changes so teams can inspect earlier states through the console, API, or CLI, and it can cover selected third-party resources such as on-premises servers, SaaS monitoring tools, and version control systems. Prebuilt rules and custom AWS Lambda rules evaluate configurations against policies. Conformance packs combine rules with remediation actions and aggregated compliance reporting. Aggregators centralize configuration metadata and rule compliance across accounts and Regions, while advanced queries use a subset of SQL SELECT syntax to search current state. Integrations described for the service include AWS Organizations, CloudTrail, Security Hub CSPM, Audit Manager, Systems Manager, Firewall Manager, EC2 Dedicated Hosts, and Application Load Balancers. Charges are usage-based for recorded configuration items and rule evaluations; related S3, SNS, and Lambda charges may also apply. Rules report status but do not prevent noncompliant changes.

Open Policy Agent Gatekeeper is a free, open-source Kubernetes policy controller for Linux and self-hosted deployments. It runs as a validating and mutating webhook, enforcing CRD-based policies evaluated by Open Policy Agent. Validation constraints can deny requests, warn, run in dry-run mode or report violations without changing resources. Mutation policies can alter matching resources during admission before validation checks the final object. An audit function periodically evaluates existing cluster resources against constraints to identify pre-existing misconfigurations. The project includes an extensible policy library with parameterized examples, and provider connections to external data such as image registries and directory services. Named integrations or backed services include Azure Policy for Kubernetes, Google Kubernetes Engine Policy Controller, Rancher, AWS EKS Blueprints and Alibaba Cloud. Installation options include prebuilt, development or locally built images and Helm. Gatekeeper requires Kubernetes resources introduced in version 1.16 and cluster-admin permissions for installation. The gator CLI is documented as beta from version 3.11.