LeftSize vs running Cloud Custodian yourself
Cloud Custodian is the open-source rules engine LeftSize uses to scan AWS and Azure. Running it yourself gives full control; LeftSize gives you a maintained rule set, the issue workflow around it, and no policies or infrastructure to look after.
Last checked against Cloud Custodian (DIY)'s documentation in October 2026.
| LeftSize | Cloud Custodian (DIY) | |
|---|---|---|
| Policies | 188 maintained rules (cost, retirements, security, governance), updated as AWS and Azure announce changes | Write and maintain your own YAML policies, or adapt community examples |
| Output | GitHub issues grouped per scope, updated each scan, with remediation steps and @leftsize commands | JSON output per policy; notifications through c7n-mailer or your own tooling |
| Actions on resources | Read-only: LeftSize never changes your resources | Can tag, stop, delete or otherwise change resources automatically |
| Where it runs | Your GitHub Actions runner, with a read-only OIDC identity | Wherever you run it: CI, Lambda/Functions, a server, or c7n-org for many accounts |
| Clouds | AWS and Azure | AWS, Azure, GCP, Kubernetes and more |
| Cost | Free for 77 cost rules; paid plans from $79/month | Free and open source (Apache-2.0); you pay for the time to build and run it |
Where Cloud Custodian (DIY) is the better choice
- Automatic remediation: stop, tag or delete resources as soon as a policy matches.
- Any policy you can express, including organization-specific rules.
- GCP, Kubernetes and other providers that LeftSize does not scan.
- No third party involved at all.
What LeftSize adds
- A rule set that is kept current: new retirements, price changes and fixes to existing rules arrive with each action release.
- Issue templates with explanations, cost context and fix scripts, so findings are understandable for the team that receives them.
- Grouping, deduplication and updating of issues across scans, which you would otherwise build yourself.
- The LeftSize GitHub Action is open source (MIT), so you can see exactly which policies run.
Using them together
If you already run Cloud Custodian for enforcement (for example auto-tagging or stopping non-compliant resources), LeftSize can cover the advisory side: findings that need a human decision, delivered as issues to the owning team.