AWS Systems Manager State Manager vs CFEngine

AWS Systems Manager State Manager automates keeping managed nodes and other AWS resources in a state that customers define. Its associations specify the configuration to maintain, when to apply it and which resources to target. Targets can be selected by tags, AWS Resource Groups, individual node IDs or all managed nodes in the current Region and account. Associations can run immediately or later and accept most standard cron and rate expressions, but association cron expressions cannot specify months. On Linux, macOS and Windows Server managed nodes, State Manager can bootstrap software, schedule agent updates, configure network settings, join nodes to a Microsoft Active Directory domain and run scripts. Association run output can be stored in Amazon S3, and State Manager is supported as an event type and target type in Amazon EventBridge rules. It has no additional charge, although limits may apply. State Manager runs as a cloud service with an agent-based model. AWS Systems Manager follows a shared responsibility model: AWS protects cloud infrastructure, while customer responsibilities depend on the service, data and requirements. Third-party auditors assess Systems Manager under assurance programs including SOC, PCI, FedRAMP and HIPAA.

CFEngine automates infrastructure, security, and compliance by moving managed systems toward a state defined in policy. Users describe desired infrastructure states in CFEngine’s domain-specific language, and lightweight agents work to bring each device into compliance. By default, an agent contacts the CFEngine hub every five minutes. The system runs on embedded devices, servers, cloud systems, and mainframes, and is designed for tens or hundreds of thousands of nodes. Enterprise adds the Mission Portal web interface, reporting backed by an SQL database, REST APIs, compliance reports, policy analysis, alerts, inventory and change reporting, file-integrity monitoring, and performance monitoring. Dashboards provide compliance and performance views, alerts, and customizable sharing. Secure bootstrap uses mutual authentication, key exchange, and encrypted TLS communication. Community Edition is free under GNU GPL, supports Linux, and includes community support. Enterprise is free for up to 25 hosts; pricing beyond that is available on request. The supported operating systems listed include Linux distributions and Windows.