Cloud Custodian vs Google Cloud Terraform Policy Validation

Cloud Custodian manages cloud resources through policies written in YAML. Each policy names a resource type, filters for selecting resources, and actions to apply to matches. It supports security policy enforcement, compliance, tag policies, cleanup of unused resources, and cost management for AWS, Azure, and Google Cloud Platform resources. Policies can respond to provider events through serverless features or run on a cron schedule. Users can validate policies and preview matching resources in dry-run mode before actions execute. Runs can produce policy metrics, structured resource records, and logs for cloud metrics, storage, and logging services. Documented event connections include AWS CloudWatch Events and Config Rules, Azure EventGrid, and GCP AuditLog and Pub/Sub. Installation is documented for Linux, macOS, and Windows, with Docker and Kubernetes operation also described. Kubernetes, Tencent Cloud, and OpenStack support are in beta; Terraform integration is in alpha. Cloud Custodian is free at free and open source under Apache 2.0. An AWS constraint is that event-triggered policies run only in the same region and account, while periodic policies may run elsewhere.

Google Cloud Terraform Policy Validation checks Terraform plans against organizational security and governance constraints before infrastructure changes are applied. The `gcloud beta terraform vet` command evaluates Terraform plan JSON, retrieving project data through Google Cloud APIs. It can flag violations, issue warnings, or halt a deployment before production; it returns exit code 0 when no violations are found and 2 when they are. Platform teams can place validation between plan and apply in CI/CD workflows using Cloud Build, Jenkins, or GitHub Actions. The command accepts Terraform 0.12 or later plan JSON and requires a policy library and the Google Cloud CLI `terraform-tools` component. Policies can cover supported resources from Terraform's google and google-beta providers, and constraints can be reused with other tools that support the framework. The command is free and client-side. The feature is in Preview under Pre-GA terms, where support may be limited. Security Command Center IaC validation has separate requirements: Premium or Enterprise activation at the organization level and a specified role. That workflow also requires Terraform Google provider version 5.5 or later.