Declare IAM roles, VPCs, RDS clusters, Lambda functions, KMS keys, ECR repositories, DynamoDB tables — 1,061 resource kinds across 150+ AWS services, in any number of AWS accounts — the same way you deploy applications: in YAML, in Git, with automatic drift correction.
Stop juggling multiple controllers. konfig-konector reconciles your entire AWS footprint from a single, lightweight binary.
246 hand-written kinds plus 815 typed kinds generated from the CloudFormation schema registry and driven through the Cloud Control API — covering IAM, networking, compute, databases, storage, messaging, caching, DNS, EKS, Lambda, ECS, load balancing, ACM, KMS, Secrets Manager, ECR, DynamoDB, EventBridge, Cognito, WAF, SSM, and more — managed by a single pod.
Declare each AWS account as an AWSProvider and pick it per resource, per namespace, or as the default. Cross-account peering, Transit Gateway sharing, RAM invitations, private DNS and PrivateLink are completed on both sides and only report Ready when AWS confirms (WIP: cross-account paths are unit-tested; live second-account verification pending).
815 kinds are generated from the CloudFormation schema registry and reconciled through the AWS Cloud Control API, with typed, validated specs and read-only status. Install them per service bundle; the operator only runs controllers for the CRDs you install. Coverage is measured against the Terraform AWS provider, not hand-counted.
Every resource is re-reconciled every 5 minutes. If someone manually changes an AWS resource, the controller reverts it automatically.
No long-lived keys, no IRSA annotations. The operator authenticates via EKS Pod Identity — temporary credentials rotated automatically.
CRDs are just YAML. Declare your AWS infrastructure alongside your application manifests and manage it with Argo CD or Flux — no separate pipelines. A one-line Argo CD health customization maps every kind's Ready condition to Healthy or Progressing, so AWS errors surface in the UI.
Database passwords are read from Kubernetes Secrets at reconcile time and never written to status fields, logs, or events.
Reference other CRs by name. The controller waits automatically until dependencies are provisioned before proceeding.
All resources use the API group aws.konfig.io/v1alpha1. The grid below is a curated selection — run konfig-export --list for the native kinds. GA = hand-written controller · CLOUD CONTROL = typed kind generated from the CloudFormation schema, installed per service bundle · ⚠ DESTRUCTIVE SCOPE = account-, region- or organization-wide setting, provided for completeness, not for application namespaces. Billing, invoicing and cost-report kinds are deliberately excluded; see the coverage policy.
Creates and manages IAM roles including trust policies, permissions boundaries, and tags.
Manages customer-managed IAM policies and their document versions.
Attaches a managed policy to an IAM role. Supports CR references or direct ARNs.
Inline policy embedded directly on an IAM role.
Links a Kubernetes ServiceAccount to an IAM role via EKS Pod Identity. Optionally annotates the ServiceAccount.
IAM user with path, permissions boundary, and tag sync. Does not manage access keys.
IAM group with path. Membership and policy attachments managed via dedicated CRs.
Attaches a managed policy to an IAM group. Supports CR references or direct ARNs.
Adds an IAM user to an IAM group. Supports CR references or direct names.
SAML identity provider for federated authentication. Metadata drift detection included.
OpenID Connect provider for workload identity federation. Delta sync for thumbprints and client IDs.
VPC with DNS support/hostnames, instance tenancy, Amazon-provided IPv6 CIDR block, and secondary IPv4 CIDR management.
Creates a subnet in a VPC. Supports mapPublicIpOnLaunch and AZ selection.
Creates and attaches an IGW to the referenced VPC. Detaches automatically on delete.
Route table with subnet associations. Reconciles individual routes and disassociates subnets on delete.
Allocates an Elastic IP and creates a NAT Gateway. Async — polls until available.async
Security group with ingress/egress rules supporting IPv4 CIDR, IPv6 CIDR, prefix lists, and SG references — all with per-rule descriptions.
Interface or Gateway VPC endpoints for AWS services (S3, DynamoDB, etc.).
Allocates a VPC Elastic IP address. Stores the AllocationID and public IP in status.
Associates an Elastic IP with an EC2 instance or network interface. References ElasticIP CRs or direct allocation IDs.
Stateless subnet-level firewall with numbered inbound and outbound rules. Fully reconciles rule entries on every sync.
AWS Transit Gateway for hub-and-spoke VPC connectivity at scale.
Attaches a VPC to a Transit Gateway with subnet selection and route table association.
Peering connection between two VPCs with auto-accept support for same-account peers.
IPv6 egress-only internet gateway for private subnets.
VPC Flow Logs capturing network traffic metadata to S3 or CloudWatch Logs.
EC2 key pair. Private key returned only at creation time and not stored in status.
EC2 launch template. Creates new versions on spec change rather than replacing the template.
ASG with LaunchTemplate reference, scaling config, and subnet placement.
Single EC2 instance. Stores instance ID in status and terminates on delete.async
EC2 placement group for cluster, partition, or spread strategies.
Target tracking, step, or simple scaling policy attached to an Auto Scaling Group.
Spot Fleet request maintaining target capacity across instance types and AZs.
EBS volume with type, size, encryption, and optional attachment to an EC2 instance.
Custom AMI registration from a snapshot or existing instance. Manages deregistration lifecycle.
RDS subnet group referencing Subnet CRs or direct subnet IDs.
RDS parameter group for DB instances. Supports apply method per parameter.
RDS cluster-level parameter group for Aurora clusters.
RDS DB instance with full options: storage autoscaling, backup/maintenance windows, Performance Insights, Enhanced Monitoring, CloudWatch log exports, IAM auth, auto minor version upgrades, and IOPS/throughput settings.async
Aurora cluster with full config: backup/maintenance windows, CloudWatch exports, IAM auth, HTTP endpoint, engine mode (including Serverless v2 scaling config), backtrack window, network type, Performance Insights, and storage type.async
RDS option group enabling engine-specific features such as Oracle OEM, SQL Server TDE, and MariaDB audit plugin.
Manual RDS snapshot with cross-region copy and share support.
RDS Proxy for connection pooling and failover management.
S3 bucket with full feature parity: versioning, SSE, block public access, lifecycle rules, CORS, event notifications (Lambda/SQS/SNS/EventBridge), static website hosting, Transfer Acceleration, Object Lock, server access logging, and tagging.
Resource-based IAM policy attached to an S3 bucket. References bucket by CR name or direct name.
Bucket event notifications to SQS, SNS, or Lambda on object create/delete.
CORS configuration for web browser access to S3 bucket objects.
Lifecycle rules for transitioning objects to Glacier or expiring old versions.
Cross-region or same-region replication configuration between S3 buckets.
Elastic File System with performance mode, throughput mode, and KMS encryption.
EFS mount target in a specific subnet and security group.
EFS access point with POSIX user/group and root directory config for application isolation.
Standard or FIFO SQS queue with visibility timeout, retention period, and redrive policy.
SNS topic (standard or FIFO) with optional KMS encryption and resource policy.
Subscribes an endpoint (SQS, Lambda, HTTPS, email) to an SNS topic.
Custom EventBridge event bus for decoupled event routing between services and accounts.
EventBridge rule matching scheduled or pattern-based events. References EventBus CRs and supports cron/rate expressions.
Wires targets (Lambda, SQS, SNS, Kinesis, Step Functions) to an EventBridge rule. Supports input transformation and IAM role ARN.
Pipes connecting event sources to targets with optional filtering and enrichment.
SES domain or email address identity with DKIM and MAIL FROM configuration.
SES configuration set for tracking opens, clicks, bounces, and complaints.
Subnet group for ElastiCache clusters. Cannot be deleted while in use by a replication group.
Redis or Valkey replication group with automatic failover, TLS, and at-rest encryption.async
ElastiCache parameter group for Redis or Memcached engine configuration.
ElastiCache Serverless cache that auto-scales capacity without managing nodes.async
MemoryDB for Redis cluster with multi-AZ durability and strong consistency.async
DynamoDB Accelerator in-memory cache cluster with microsecond latency.
Route 53 hosted zone (public or private). Deletion blocked if non-NS/SOA records exist.
DNS record set. Supports A, AAAA, CNAME, TXT, MX, alias records, and weighted routing.
Route 53 health check (HTTP, HTTPS, TCP) with configurable interval and failure threshold.
Route 53 Resolver forwarding rule for hybrid DNS between on-premises and VPC.
Inbound or outbound resolver endpoint with ENIs in specified subnets.
DNSSEC delegation signer records for child hosted zones.
EKS control plane with VPC config, logging, encryption, access config, Kubernetes network config (serviceIPv4CIDR, IP family), upgrade support policy, and bootstrap add-ons control.async 10–15m
Managed node group with scaling config, instance types, AMI type, capacity type, disk size, labels, taints, update config, launch template, remote access, and node repair config.async 3–5m
EKS cluster addon (vpc-cni, kube-proxy, coredns, ebs-csi, etc.). Adopts pre-existing addons.
Fargate profile with namespace + label selectors for serverless pods.async ~2m
Maps an IAM principal to Kubernetes RBAC groups or cluster-access policies. Requires API auth mode.
OIDC identity provider configuration for Kubernetes authentication.
Lambda function from S3 or container image with full config: runtime, handler, memory, timeout, VPC, layers, DLQ, X-Ray tracing, CloudWatch logging config, EFS mounts, SnapStart, container image config, and reserved concurrency.
Wires an SQS queue, DynamoDB stream, or Kinesis stream to trigger a Lambda function.
Resource-based policy statement allowing a service or account to invoke a Lambda function.
Lambda function alias pointing to a specific version with optional weighted traffic splitting.
Lambda layer version for shared dependencies, runtimes, and configuration.
Code signing configuration ensuring only trusted code is deployed to Lambda.
Lambda function URL providing a dedicated HTTPS endpoint without API Gateway.
ECS cluster with capacity providers (FARGATE, FARGATE_SPOT, EC2).
Task definition with container definitions, CPU/memory, execution role, and log groups. Registers new revision on change.
Long-running ECS service with desired count, load balancer config, and deployment circuit breaker.
Capacity provider linking an Auto Scaling Group to an ECS cluster with managed scaling.
Scheduled ECS task backed by EventBridge with cron or rate expression.
Application, Network, or Gateway Load Balancer with scheme, subnets, security groups, and attribute config.async
Target group for routing to instances, IPs, Lambda, or ALB with health check config and stickiness.
Load balancer listener with protocol, port, default forward/redirect/fixed-response actions, and SSL certificates.
Routing rule on an ALB listener based on host, path, header, or query conditions. References Listener CRs.
ACM TLS certificate with DNS or email validation. Stores ARN and CertificateStatus in status.async
Polls an ACM Certificate until it reaches ISSUED state. Useful as a dependency gate for Listener CRs.
CloudFront distribution with origins, cache behaviors, and SSL certificate.async ~15m
OAC for granting CloudFront access to S3 origins without public bucket policies.
Reusable cache policy controlling TTLs and cache key components.
Lightweight JavaScript function running at the edge for URL rewrites and header manipulation.
Secrets Manager secret with optional KMS key, tags, and configurable recovery window. Value sourced from Kubernetes Secret.
Automatic rotation schedule for a Secrets Manager secret using a Lambda rotation function. References Secret CRs.
Systems Manager Parameter Store value (String, StringList, SecureString) with KMS encryption and tier selection.
SSM automation or command document for fleet operations and instance configuration.
Customer-managed KMS key with key policy, optional automatic rotation, multi-region support, and scheduled deletion.
Human-readable alias pointing to a KMS key for easier key reference. References KMSKey CRs.
Sets the key policy document for a KMS key. References KMSKey CRs or direct key IDs.
Grants specific KMS operations to a grantee principal on a per-key basis.
CloudFormation stack from S3 template URL with parameters and rollback config.async
StackSet for deploying CloudFormation stacks across multiple accounts and regions.
CloudWatch Logs group with configurable retention period and optional KMS encryption.
Extracts metric values from log events and publishes them as custom CloudWatch metrics. References LogGroup CRs.
Subscription filter streaming log events to Lambda, Kinesis, or Firehose. References LogGroup CRs.
Metric alarm triggering SNS notifications or Auto Scaling actions on threshold breach.
CloudWatch dashboard with widgets defined as JSON body.
Composite alarm combining multiple alarms with AND/OR logic.
ECR private repository with image scanning, tag mutability, and KMS encryption. Stores ARN and repository URI in status.
Resource-based policy granting cross-account pull access to an ECR repository. References ECRRepository CRs.
Lifecycle policy expiring old or untagged images to control storage costs. References ECRRepository CRs.
Pull-through cache rule proxying public registries (Docker Hub, ECR Public, GCR) through ECR.
DynamoDB table with partition key, sort key, GSIs, billing mode, SSE, and optional point-in-time recovery.
Multi-region active-active DynamoDB global table with replica region configuration.
On-demand DynamoDB backup with point-in-time recovery support.
Resource-based policy for cross-account access to a DynamoDB table.
Cognito User Pool with password policy, MFA configuration, email/phone auto-verification, and schema attributes.
App client for a Cognito User Pool. Configures OAuth flows, allowed scopes, callback URLs, and token validity. References UserPool CRs.
Federated identity provider (SAML, OIDC, social) attached to a Cognito User Pool. References UserPool CRs.
Kinesis Data Stream with shard count or on-demand capacity mode and KMS encryption.
Enhanced fan-out consumer for a Kinesis stream with dedicated throughput.
Kinesis Firehose delivery stream to S3, Redshift, OpenSearch, or HTTP endpoint.async
Amazon MSK (Managed Kafka) cluster with broker config, storage, and TLS settings.async ~30m
Serverless MSK cluster that scales automatically without managing brokers.async
Reusable MSK configuration with Kafka broker properties.
OpenSearch Service domain with instance type, EBS, encryption, and VPC config.async ~15m
OpenSearch Serverless collection with security policies and auto-scaling.async
Data access policy granting principals permissions on OpenSearch Serverless collections.
WAFv2 Web ACL (REGIONAL or CLOUDFRONT scope) with managed rule groups, custom rules, and default allow/block action. Stores LockToken for safe updates.
WAFv2 IP set of IPv4/IPv6 CIDRs used in WAF rules for allow or block matching. Stores LockToken for safe updates.
Regex pattern set for matching request components in WAF rules.
Reusable rule group that can be referenced from multiple Web ACLs.
AWS Shield Advanced protection for a specific resource ARN.
Step Functions state machine (Standard or Express) with ASL definition and IAM role.
Step Functions activity for worker-based task execution.
CI/CD pipeline with source, build, and deploy stages across AWS and third-party providers.
CodeBuild project with build environment, source, artifacts, and cache config.
CodeDeploy application for EC2, Lambda, or ECS blue/green deployments.
Deployment group with traffic routing config, alarms, and rollback settings.
CodeCommit Git repository with triggers and approval rule templates.
Bootstrap the operator IAM role with Terraform, install with Helm, then start declaring resources. Or try everything locally first with one script.
# terraform/accounts/dev/terraform.tfvars account_id = "123456789012" cluster_name = "dev-eks" environment = "dev" allowed_iam_resource_paths = "/" $ terraform init \ -backend-config=accounts/dev/backend.conf $ terraform apply \ -var-file=accounts/dev/terraform.tfvars
$ git clone https://github.com/\ konfig-io/konfig-konector.git $ helm install konfig-konector \ ./konfig-konector/helm/konfig-konector \ --namespace konfig-system \ --create-namespace \ --set image.repository=<your-registry>/konfig-konector \ --set aws.region=us-east-1 \ --set operatorRoleArn=\ arn:aws:iam::123456789012:\ role/dev-konfig-konector-operator # Verify $ kubectl get pods -n konfig-system NAME READY konfig-konector-xxx-yyy 1/1
apiVersion: aws.konfig.io/v1alpha1 kind: IAMRole metadata: name: my-app-role namespace: my-team spec: roleName: Prod-my-app-role assumeRolePolicyDocument: | {"Version":"2012-10-17", "Statement":[{"Effect":"Allow", "Principal":{"Service": "pods.eks.amazonaws.com"}, "Action":["sts:AssumeRole", "sts:TagSession"]}]} tags: team: my-team $ kubectl apply -f role.yaml $ kubectl get iamrole my-app-role \ -n my-team -o yaml
# k3d cluster, in-cluster registry, Argo CD, operator — nothing pushed anywhere $ AWS_PROFILE=scratch ./scripts/local-dev.sh up # 93 free-tier resources as an Argo Application (IAM, VPC, SQS, DynamoDB, # Logs, generated Cloud Control kinds...) — watch them turn green $ ./scripts/local-dev.sh smoke $ ./scripts/local-dev.sh argo-ui # install more generated kinds, then clean up (deletes the AWS resources) $ ./scripts/local-dev.sh bundles ec2 logs iam $ ./scripts/local-dev.sh unsmoke
Every controller follows the same 5-step loop. You can read any controller in the codebase and immediately understand it.
Read the current CR from the Kubernetes API. If it's gone, return immediately — nothing to do.
If deletionTimestamp is set, call the AWS delete API and remove the finalizer. The CR stays visible in Kubernetes until AWS confirms deletion.
Add aws.konfig.io/finalizer if not present. This prevents the CR from being garbage-collected before the AWS resource is deleted.
Fetch the live AWS resource. If it doesn't exist, create it. If it does, compare spec against current state and apply only the delta — gated on observedGeneration to avoid expensive no-op API calls.
Write ARN/ID, Ready: True, and lastSyncTime to the CR status. Requeue after 5 minutes for drift detection.
| Feature | konfig-konector | AWS Controllers (ACK) | Crossplane |
|---|---|---|---|
| Single binary for all services | ✓ | ✗ one pod per service | partial providers |
| Multi-account from one instance | ✓ AWSProvider per resource, namespace, or default | ✗ | ProviderConfig |
| Two-sided cross-account handshakes (peering, TGW, RAM, Route 53, PrivateLink) | WIP implemented, second-account verification pending | ✗ | ✗ |
| Long-tail coverage | ✓ 815 typed kinds from CloudFormation via Cloud Control | per-service controllers | upjet from Terraform |
| EKS Pod Identity native auth | ✓ | IRSA only | IRSA only |
| IAM role & policy management | ✓ full | ✓ limited | ✓ |
| EKS Pod Identity associations | ✓ | ✗ | ✗ |
| Route53 + health checks | ✓ | ✗ | community |
| Automatic drift correction | ✓ 5-min cycle | ✓ | ✓ |
| Generation-gated updates | ✓ | ✗ | ✗ |
| Cross-resource CR references | ✓ | some | ✓ Compositions |
| GitOps / ArgoCD compatible | ✓ | ✓ | ✓ |
Full API reference for every CRD — spec fields, status fields, deletion behavior, and examples.