AWS Controllers for Kubernetes vs Terraform

AWS Controllers for Kubernetes (ACK) lets Kubernetes users define AWS resources with Kubernetes custom resources. It periodically compares desired and actual AWS state and corrects drift. Documentation lists 74 service controllers, including S3, RDS, Lambda and DynamoDB. ACK supports declarative, version-controlled infrastructure alongside applications, across AWS accounts and regions. Read-only resources and read-only adoption support migration from other infrastructure-as-code tools. EKS users can install managed EKS Capabilities, where AWS handles controller installation and upgrades with automatic updates, auto-scaling and auto-tuning. Self-managed Helm installation runs on EKS, GKE, AKS, on-premises clusters and local environments, providing version and configuration control. AWS IAM authorizes controller access. Self-managed ACK costs nothing for Helm installation on Kubernetes 1.20+ on any Kubernetes cluster. EKS Capability pricing is hourly, with a base rate per enabled capability plus usage charges for each ACK resource managed.

Terraform is an infrastructure-as-code tool for defining, provisioning, and managing cloud and on-premises resources through human-readable configuration files. Its core process is to write a configuration, review an execution plan, then apply approved changes. Providers connect Terraform to services through APIs, and the Terraform Registry lists providers for AWS, Azure, Google Cloud, Kubernetes, GitHub, and Splunk. Modules package reusable infrastructure configurations that users can find or publish in the Registry. The free Community Edition is a downloadable command-line tool. HCP Terraform adds remote execution, repository connections to GitHub, GitLab, and Bitbucket that can trigger plans after changes, and an API. It stores state remotely with encryption at rest and offers workspaces, single sign-on, and role-based access controls. HCP Terraform and Terraform Enterprise support Sentinel policies. HashiCorp cautions that policy-as-code is a guardrail, not a security boundary, and trusted providers and modules matter because they can access workspace variables and state. Downloads are available for Windows, macOS, and Linux.