Multi-Cloud Governance -- Reference
Look-up tables for multi-cloud governance: tool and standard versions, interconnect and DNS services, IaC providers, identity mechanisms, CIS benchmarks and compliance frameworks, CSPM and policy-as-code tools, landing-zone accelerators, FinOps and FOCUS facts, and OpenTelemetry conventions. For the reasoning behind these choices, see Explanation. For step-by-step tasks, see How-to Guides.
Versions move fast
Versions and dates below were checked on 2026-09-25 against upstream changelogs, the Go module proxy, PyPI, and vendor announcements (linked in each row or in Sources). Re-check before you pin anything.
| Item |
Latest (date) |
License |
Governance / status |
Source |
| Open Policy Agent (OPA) |
1.21.0 (2026-09-24) |
Apache-2.0 |
CNCF Graduated (2021-02). Founding maintainers joined Apple in 2025-08; the project stays under CNCF, and Styra's commercial products (EOPA, OPA Control Plane, Regal) were open-sourced |
CHANGELOG, OPA blog |
| OPA Gatekeeper |
3.23.1 (2026-08-27); 3.24.0-beta.0 in testing |
Apache-2.0 |
OPA sub-project (CNCF) |
Gatekeeper docs |
| Kyverno |
1.19.1 (2026-09-10) |
Apache-2.0 |
CNCF Graduated (2026-03-16, announced 2026-03-24). 1.17 (2026-02) promoted CEL policy types to v1 and deprecated ClusterPolicy |
CNCF announcement, Kyverno 1.17 |
| Crossplane |
2.4.2 (2026-09-22) |
Apache-2.0 |
CNCF Graduated (announced 2025-11-06). v2.0.0 tagged 2025-08-08 |
CNCF announcement, README release table |
Cloud Custodian (c7n) |
0.9.52 (2026-09-03) |
Apache-2.0 |
CNCF Incubating |
PyPI, repo |
| Prowler |
5.43.0 (2026-09-21) |
Apache-2.0 |
Prowler (company-backed open source) |
PyPI |
| Checkov |
3.3.19 (2026-09-17) |
Apache-2.0 |
Palo Alto Networks (Bridgecrew) |
PyPI |
| Terraform |
1.16.4 (2026-09-23) |
BSL 1.1 |
HashiCorp, an IBM company |
Terraform topic |
| OpenTofu |
1.12.6 (2026-08-19) |
MPL-2.0 |
Linux Foundation, CNCF Sandbox (2025-04) |
OpenTofu topic |
| Pulumi CLI |
3.264.0 (2026-09-23) |
Apache-2.0 |
Pulumi Corp. |
Pulumi topic |
| FOCUS specification |
1.4 (ratified 2026-06-04); next release targeted for 2026-12 |
Community specification (FinOps Foundation) |
FinOps Foundation (Linux Foundation) |
FOCUS spec |
| Landing Zone Accelerator on AWS |
1.15.5 (2026-06-02) |
Apache-2.0 |
AWS Solutions |
CHANGELOG |
| CIS AWS Foundations Benchmark |
v7.0.0 (2026-04) |
CIS terms (free PDF for non-commercial use) |
Center for Internet Security |
CIS April 2026 update |
Crossplane Release Support Window
Crossplane ships a minor release about every quarter and supports each one for about nine months. The v1.20 line is the last v1 release and reaches end of life when v2.5 ships.
| Release |
Release date |
EOL |
| v1.20 |
2025-05-21 |
2026-11 |
| v2.2 |
2026-02-18 |
2026-11 |
| v2.3 |
2026-05-21 |
2027-02 |
| v2.4 |
2026-08-20 |
2027-05 |
| v2.5 (planned) |
2026-11 |
2027-08 |
Source: Crossplane README.
Networking Reference
Key Interconnect Services Reference
| Service |
Cloud |
Bandwidth |
Protocol / notes |
| AWS Direct Connect |
AWS |
1/10/100 Gbps dedicated ports (hosted connections from 50 Mbps) |
802.1Q VLAN, BGP |
| AWS Transit Gateway Connect |
AWS |
Per GRE Connect peer, with several peers per attachment (check current AWS quotas) |
GRE/BGP to SD-WAN appliances |
| AWS Interconnect -- multicloud |
AWS + Google Cloud (GA 2026-04); Azure and OCI announced as later additions |
1-100 Gbps, adjustable without reprovisioning |
Managed private L3 link. AWS provisions redundant connections, BGP, MACsec. 99.99% SLA (InfoQ) |
| GCP Dedicated Interconnect |
GCP |
10/100 Gbps per link |
802.1Q, BGP4 |
| GCP Partner Interconnect |
GCP |
50 Mbps -- 50 Gbps |
Varies by partner |
| GCP Cross-Cloud Interconnect |
GCP |
10/100 Gbps |
Dedicated physical links from Google Cloud to AWS, Azure, OCI, and Alibaba Cloud |
| Alibaba Cloud Express Connect |
Alibaba |
1/10/100 Gbps (not re-verified 2026-09) |
Physical dedicated line, BGP |
| Alibaba Cloud CEN |
Alibaba |
Bandwidth packages |
Transit routing |
| Tencent Cloud Direct Connect |
Tencent |
1/10/100 Gbps (not re-verified 2026-09) |
Physical dedicated line, BGP |
| Tencent Cloud CCN |
Tencent |
Bandwidth limits per instance |
Transit routing |
| Equinix Fabric |
Vendor-neutral |
50 Mbps -- 100 Gbps |
Software-defined L2/L3 |
| Megaport |
Vendor-neutral |
1 Mbps -- 100 Gbps |
Software-defined L2 |
Provider DNS Services
| Service |
Cloud |
Key Routing Policies |
| Amazon Route 53 |
AWS |
Latency, geolocation, geoproximity, weighted, failover, multivalue, IP-based |
| Google Cloud DNS |
GCP |
Weighted round robin, geolocation, and primary-backup failover routing policies with health checks |
| Google Cloud global load balancers |
GCP |
Anycast L7/L4 with cross-region failover |
| Alibaba Cloud DNS (Alidns) |
Alibaba |
Geolocation, weighted, ISP-line routing (telecom/unicom/mobile) |
| Tencent DNSPod |
Tencent |
Geolocation, weighted, ISP-line routing, search-engine lines |
| Cloudflare DNS + Load Balancing |
Vendor-neutral |
Geolocation, weighted, failover, health-checked pools |
| IBM NS1 Connect |
Vendor-neutral |
Filter chains, regional targeting, Pulsar active telemetry |
| Tool |
Layer |
Multi-Cloud |
| Istio |
L7 (service mesh) |
Cross-cluster multi-primary on different clouds |
| Cilium |
L3-L7 (CNI + service mesh) |
Cluster mesh across clouds via tunnel or direct routing |
| Google Cloud Service Mesh (formerly Traffic Director) |
L7 |
Managed Istio/Envoy control plane; can manage proxies outside Google Cloud |
| AWS App Mesh |
L7 |
End of support 2026-09-30. No new customers since 2024-09-24. AWS points ECS users to ECS Service Connect (AWS docs) |
| Kong Gateway / Traefik |
L7 API Gateway |
Cloud-agnostic. Deploy anywhere |
Infrastructure-as-Code Reference
| Tool |
Paradigm |
Multi-Cloud |
State |
License |
| Terraform |
Declarative HCL |
Broadest provider coverage |
Remote backend (S3, GCS, OSS, COS, HCP Terraform) |
BSL 1.1 (1.6.0+) |
| OpenTofu |
Declarative HCL (Terraform-compatible) |
Same provider ecosystem |
Same backends; optional client-side state encryption |
MPL-2.0 |
| Pulumi |
General-purpose languages (TS, Python, Go, .NET, Java, YAML) |
Bridged Terraform providers plus native providers |
Pulumi Cloud or self-managed backend |
Apache-2.0 (engine/SDKs) |
| Crossplane |
Kubernetes CRDs and composition functions |
AWS strongest; GCP/Azure; Alibaba/Tencent via community providers |
Kubernetes API (etcd) plus the cloud itself |
Apache-2.0 |
| Provider |
Registry source |
Latest (2026-09) |
Source |
| AWS |
hashicorp/aws |
6.66.0 (2026-09-21) |
CHANGELOG |
| Google Cloud |
hashicorp/google |
8.3.0 (2026-09-15) |
CHANGELOG |
| Alibaba Cloud |
aliyun/alicloud |
1.293.0 (2026-09-17) |
CHANGELOG |
| Tencent Cloud |
tencentcloudstack/tencentcloud |
1.83.33 (2026-09-21) |
CHANGELOG |
Crossplane Provider Ecosystem
| Provider |
Package home |
Notes |
provider-upjet-aws (family, for example provider-aws-s3) |
xpkg.crossplane.io/crossplane-contrib/... |
First provider with full namespaced (v2-style) managed resources |
| provider-upjet-gcp |
crossplane-contrib |
Namespaced MR support in progress per the v2 docs |
| provider-upjet-azure |
crossplane-contrib |
Namespaced MR support in progress per the v2 docs |
| provider-upjet-alibabacloud |
crossplane-contrib |
Upjet-based. Supports AssumeRole and AssumeRoleWithOIDC (RRSA) in ProviderConfig |
| provider-alibaba |
crossplane-contrib |
Older hand-written provider; prefer the Upjet provider for new work |
| provider-tencentcloud |
crossplane-contrib |
Upjet-based, maintained with Tencent Cloud |
Maturity is not a number
Maturity of the Alibaba and Tencent providers in production is TBD. Check the resource coverage and release activity of each repository before committing. Crossplane v2 also removed the default package registry, so package references must be fully qualified.
CI/CD and GitOps Reference
| Tool |
Type |
Multi-Cluster |
License |
| Argo CD |
Pull-based GitOps |
ApplicationSets, sync waves |
Apache-2.0 |
| Flux |
Pull-based GitOps |
Remote Kustomization via spec.kubeConfig |
Apache-2.0 |
| Argo Rollouts |
Progressive delivery |
Per-cluster controller |
Apache-2.0 |
| Flagger |
Progressive delivery |
Per-cluster, pairs with Flux |
Apache-2.0 |
| External Secrets Operator |
Secret syncing |
Multi-cloud secret store backends |
Apache-2.0 |
| Sealed Secrets |
In-cluster encryption |
Cloud-agnostic |
Apache-2.0 |
| SOPS |
File-level encryption (CNCF Sandbox, getsops org) |
KMS per cloud (AWS KMS, GCP KMS, Azure Key Vault, age, PGP) |
MPL-2.0 |
Current versions: Argo CD, Flux, External Secrets Operator, SOPS.
Identity Reference
Federation Protocols
| Protocol |
Primary Use |
Token Format |
| SAML 2.0 |
Human user SSO (browser-based) |
XML assertion |
| OIDC (OpenID Connect) |
Workload identity, CI/CD, human SSO |
JWT |
| OAuth 2.0 token exchange |
API authorization, STS-style exchange (GCP STS) |
Bearer token |
Workload Identity Comparison
| Feature |
AWS |
GCP |
Alibaba |
Tencent |
| Human SSO entry point |
IAM Identity Center (SAML/SCIM) |
Workforce Identity Federation or Cloud Identity |
RAM SSO (role-based or user-based SAML, OIDC) |
CAM SAML role SSO |
| Workload OIDC federation |
IAM OIDC provider + AssumeRoleWithWebIdentity |
Workload Identity Federation (STS token exchange) |
RAM OIDC provider + AssumeRoleWithOIDC |
CAM OIDC provider + AssumeRoleWithWebIdentity |
| Kubernetes integration |
IRSA or EKS Pod Identity |
Workload Identity Federation for GKE |
RRSA (RAM Roles for Service Accounts) on ACK |
TKE OIDC-based pod identity (feature name TBD; check TKE docs) |
| CI/CD identity |
OIDC from GitHub/GitLab |
OIDC pool providers |
OIDC provider in RAM |
OIDC provider in CAM |
| Role session lifetime |
900 s up to the role maximum (max 12 h) |
Access tokens 1 h by default (extendable to 12 h by org policy) |
900 s up to the role maximum session duration |
Configurable (limits TBD) |
Security and Compliance Reference
CIS Benchmarks
The Center for Internet Security publishes cloud-specific benchmarks with Level 1 (prescriptive, minimal disruption) and Level 2 (defense in depth, more restrictive) controls. Scanner support lags CIS releases. AWS Security Hub CSPM, for example, supported v5.0.0 as its newest CIS standard as of 2025-10.
| Cloud |
Latest benchmark (2026-09) |
Key Areas |
| AWS |
CIS AWS Foundations v7.0.0 (2026-04) |
IAM (root account, MFA, access keys), logging (CloudTrail, Config), monitoring, networking (default SG, NACLs), storage encryption |
| Azure |
CIS Microsoft Azure Foundations v6.0 (as supported by Prowler; release date TBD) |
Entra ID, Defender for Cloud, storage, logging, networking, Key Vault |
| GCP |
CIS Google Cloud Platform Foundations v5.0 (as supported by Prowler; release date TBD) |
IAM (service account keys, org policies), logging (Audit Logs), networking (VPC flow logs, firewall rules), storage |
| Alibaba Cloud |
CIS Alibaba Cloud Foundations v2.0 (as supported by Prowler) |
RAM (root account, MFA, access keys), ActionTrail, Security Center, VPC flow logs, OSS encryption |
| Tencent Cloud |
No CIS benchmark found as of 2026-09 |
Use China's MLPS 2.0 (Dengbao 2.0) requirements plus Tencent Cloud's own security baselines: CAM, CloudAudit, VPC flow logs, COS encryption |
Compliance Frameworks
| Framework |
Scope |
Multi-Cloud Relevance |
| ISO 27001/27017/27018 |
InfoSec management, cloud security, PII in cloud |
One ISMS covers all providers. Inherit each provider's certification for its layer |
| SOC 2 Type II |
Trust service criteria (security, availability, confidentiality) |
Each provider publishes SOC 2 reports. Inherit controls |
| NIST CSF 2.0 |
Govern, Identify, Protect, Detect, Respond, Recover |
Maps to all providers' compliance offerings |
| PCI DSS v4.0.1 |
Payment card data |
Network segmentation and encryption enforced per cloud |
| HIPAA |
Healthcare data (US) |
BAA required with each cloud provider |
| GDPR / PIPL |
Data privacy (EU / China) |
Data residency and cross-border transfer rules per region |
| CSA CCM v4 |
Cloud-specific controls matrix |
Cross-cloud assessment framework |
| MITRE ATT&CK (cloud matrices) |
Adversary tactics for IaaS, SaaS, Office Suite, Identity Provider |
Threat model across providers. The IaaS matrix is provider-agnostic |
Automated Compliance Scanning (CSPM and CNAPP)
| Tool |
Clouds Covered |
CIS Benchmarks |
License / owner |
| Prowler |
AWS, Azure, GCP, Kubernetes, M365, GitHub, OCI, Alibaba Cloud, and more (no Tencent) |
Yes (AWS v7.0, Azure v6.0, GCP v5.0, Alibaba v2.0) |
Apache-2.0 |
| Cloud Custodian |
AWS, Azure, GCP, Kubernetes, OCI, Tencent Cloud (c7n-tencentcloud) |
Via community policy packs |
Apache-2.0, CNCF Incubating |
| ScoutSuite |
AWS, Azure, GCP, Alibaba (alpha), OCI (alpha) |
Partial |
GPL-2.0. Last PyPI release 5.14.0 (2024-05); low activity |
| Checkov |
IaC: Terraform, CloudFormation, Kubernetes, Helm, and others. Includes Alibaba and Tencent Terraform resources |
Partial (IaC scanning) |
Apache-2.0 |
| Trivy (replaces tfsec) |
IaC misconfiguration, images, Kubernetes |
Partial |
Apache-2.0. Aqua moved tfsec's engine into Trivy and asks users to migrate |
| AWS Security Hub CSPM |
AWS |
Yes (up to v5.0.0 as of 2025-10) |
Managed service |
| Microsoft Defender for Cloud (formerly Azure Security Center) |
Azure, plus AWS and GCP via connectors |
Yes |
Managed service |
| GCP Security Command Center |
GCP (Enterprise tier adds AWS and Azure) |
Yes |
Managed service |
| Alibaba Cloud Security Center |
Alibaba |
Partial (baseline checks) |
Managed service |
| Cortex Cloud (Palo Alto; successor to Prisma Cloud, 2025-02) |
AWS, Azure, GCP, OCI, Alibaba |
Yes |
Commercial |
| Wiz (part of Google Cloud since 2026-03-11) |
AWS, Azure, GCP, OCI, Alibaba, others (Tencent coverage TBD) |
Yes |
Commercial |
| Orca Security |
AWS, Azure, GCP, Alibaba, OCI |
Yes |
Commercial |
Policy-as-Code Enforcement
| Tool |
Scope |
Language |
Integration point |
| OPA (Conftest, OPA in HCP Terraform) |
Any JSON/YAML: Terraform plans, Kubernetes manifests, API requests |
Rego (v1 syntax default since OPA 1.0) |
CI step, HCP Terraform/TFE policy sets, sidecar/library |
| OPA Gatekeeper |
Kubernetes resources |
Rego (ConstraintTemplates), CEL (K8sNativeValidation engine) |
Validating/mutating admission webhook plus audit |
| Kyverno |
Kubernetes resources (and JSON payloads via kyverno-json) |
CEL (ValidatingPolicy, MutatingPolicy, GeneratingPolicy, ImageValidatingPolicy) or legacy YAML ClusterPolicy |
Admission webhook, background scans, CLI in CI |
| Kubernetes ValidatingAdmissionPolicy |
Kubernetes resources |
CEL |
In-process in the API server (GA in Kubernetes 1.30) |
| HashiCorp Sentinel |
Terraform runs |
Sentinel |
HCP Terraform / Terraform Enterprise |
| AWS Organizations SCPs / RCPs / declarative policies |
AWS principals / resources / service configuration |
JSON policy |
AWS Organizations |
| Azure Policy |
Azure resources |
JSON policy definitions (aliases) |
Management group / subscription |
| GCP Organization Policy |
GCP resources |
Predefined constraints plus custom constraints (CEL) |
Organization / folder / project |
| Alibaba Cloud control policies |
Alibaba resources |
JSON policy |
Resource Directory |
| Cloud Custodian |
AWS, Azure, GCP, Kubernetes, OCI, Tencent Cloud |
YAML (filters + actions) |
Pull (scheduled) or event-driven serverless modes |
Multi-Cloud Security Baseline Checklist
This is a minimal cross-cloud baseline. Adapt it to your compliance requirements.
Identity and Access:
Networking:
Data Protection:
Logging and Monitoring:
Policy and Guardrails:
Incident Response:
Landing-Zone Accelerators
| Cloud |
Accelerator |
What it sets up |
Status (2026-09) |
| AWS |
AWS Control Tower + Landing Zone Accelerator on AWS (LZA) |
Multi-account structure, Account Factory, SCP guardrails, centralized logging, networking, security services |
LZA 1.15.5 (2026-06-02); runs on top of Control Tower |
| Azure |
Azure Landing Zones (ALZ) with Terraform Azure Verified Modules (avm-ptn-alz and related pattern modules) or Bicep |
Management groups, Azure Policy assignments, hub networking or Virtual WAN, management resources |
The classic caf-enterprise-scale Terraform module is deprecated; AVM modules are the recommended path (ALZ docs) |
| Google Cloud |
terraform-example-foundation (Enterprise Foundations Blueprint) or Cloud Foundation Fabric FAST |
Org/folder hierarchy, org policies, shared VPC, logging, CI/CD bootstrap |
Fork-and-own examples; Google Cloud Setup for smaller orgs |
| Alibaba Cloud |
Cloud Governance Center (docs now titled "Agentic Cloud Governance Center") |
Resource Directory, core accounts, Account Factory with account baselines, guardrails |
Managed service (docs) |
| Tencent Cloud |
Control Center (landing zone and account factory) |
Tencent Cloud Organization (TCO) for multi-account management; Terraform support since tencentcloud provider 1.82.44 (2025-12-10), per the Tencent Cloud topic |
Tencent Cloud |
FinOps Reference
FOCUS Specification
FOCUS (FinOps Open Cost and Usage Specification) is a common schema for billing data. It defines columns such as BilledCost, EffectiveCost, ChargePeriodStart, ServiceName, RegionId, and SubAccountId, which removes per-provider billing-schema translation.
| Version |
Highlights |
Source |
| 1.0 |
First GA release (2024) |
FOCUS 1.0 |
| 1.3 |
Contract commitment dataset, split cost allocation, recency and completeness dimensions |
Introducing FOCUS 1.3 |
| 1.4 (ratified 2026-06-04) |
Adds 2 datasets (invoice-level charges and billing-period status for reconciliation), 47 columns, 6 attributes |
FOCUS 1.4 |
| Next (targeted 2026-12) |
AI "token economy" usage representation is a priority workstream |
FinOps Foundation (via search summaries; TBD) |
Provider support for FOCUS exports:
| Provider |
FOCUS support |
| AWS |
FOCUS export in Billing and Cost Management Data Exports |
| Microsoft Azure |
FOCUS export in Cost Management exports |
| Google Cloud |
FOCUS view over the BigQuery billing export |
| Oracle Cloud |
FOCUS cost reports |
| Alibaba Cloud |
FOCUS 1.0 export with Alibaba columns, invitational preview, delivered to OSS (docs) |
| Tencent Cloud |
FOCUS 1.0 bill conversion, delivered to COS (docs) |
The FOCUS version that each hyperscaler emits changes over time. Check the provider's export settings. Exact versions per provider are TBD here.
Multi-Cloud Cost Visibility
| Tool |
Clouds |
Key Features |
License / owner |
| Apptio Cloudability (IBM) |
AWS, Azure, GCP, others |
Anomaly detection, commitment management, showback |
Commercial |
| Flexera One |
AWS, Azure, GCP, others |
Cloud cost plus SaaS and license management |
Commercial |
| VMware Tanzu CloudHealth (Broadcom) |
AWS, Azure, GCP |
Policy-driven governance, cost allocation |
Commercial |
| Vantage |
AWS, Azure, GCP, and SaaS sources |
Developer-friendly, API-first, cost reports |
Commercial |
| Kubecost (IBM) |
Any Kubernetes cluster |
Namespace/pod/label-level cost allocation, built on OpenCost |
Commercial with free tier |
| OpenCost |
Any Kubernetes cluster |
Open-source Kubernetes cost monitoring |
Apache-2.0, CNCF project |
| AWS Cost Explorer |
AWS |
Native cost visualization, RI and Savings Plans coverage |
Managed service |
| GCP Cloud Billing reports + BigQuery export |
GCP |
Cost breakdown, committed-use discounts, budgets |
Managed service |
| Alibaba Cloud Billing / Cost Management |
Alibaba |
Subscription and pay-as-you-go analysis, budgets |
Managed service |
Tool-to-cloud coverage (especially Alibaba and Tencent) changes often. Confirm it with each vendor.
Commitment-Based Savings
| Cloud |
Reservation Type |
Term |
Typical Savings (vendor-quoted maximums) |
| AWS |
Reserved Instances (RI) |
1 or 3 years |
Up to 72% vs on-demand |
| AWS |
Savings Plans (Compute, EC2 Instance, SageMaker) |
1 or 3 years |
Up to 72% vs on-demand |
| GCP |
Resource-based committed use discounts |
1 or 3 years |
Up to 57% for most machine types, up to 70% for memory-optimized |
| GCP |
Flexible (spend-based) committed use discounts |
1 or 3 years |
28% (1 year), 46% (3 years) |
| GCP |
Spot VMs |
Preemptible |
60-91% vs on-demand |
| Alibaba |
Reserved Instances |
1, 3, or 5 years |
Up to ~55% vs pay-as-you-go (not re-verified 2026-09) |
| Alibaba |
Savings Plans |
1, 3, or 5 years |
Up to ~40% vs pay-as-you-go (not re-verified 2026-09) |
| Tencent |
Reserved Instances |
1, 3, or 5 years |
Up to ~50% vs pay-as-you-go (not re-verified 2026-09) |
| Tencent |
Spot Instances |
Preemptible |
Up to ~90% vs pay-as-you-go (not re-verified 2026-09) |
Tagging Strategy
A consistent cross-cloud tagging taxonomy is the foundation of cost allocation.
Recommended mandatory tags:
| Tag Key |
Purpose |
Example |
environment |
Environment |
production, staging, development |
team |
Owning team |
billing-team, platform-engineering |
service |
Service name |
payment-service, user-api |
cost-center |
Financial allocation |
cc-1234, engineering |
data-classification |
Data sensitivity |
public, internal, confidential, restricted |
GCP uses labels (lowercase keys and values, max 63 characters) for billing, and separate tags for policy conditions. Plan key names that satisfy the strictest provider.
Per-cloud tag enforcement:
| Cloud |
Enforcement Mechanism |
| AWS |
Tag policies (AWS Organizations), SCP conditions on aws:RequestTag, AWS Config required-tags rule |
| Azure |
Azure Policy Require a tag on resources / inherit-tag built-ins |
| GCP |
Organization Policy custom constraints, label checks in CI |
| Alibaba |
Tag policies in Resource Directory, RAM policies with tag conditions, Cloud Config rules |
| Tencent |
CAM tag-based access control, Cloud Config rules |
Cost Anomaly Detection
| Tool |
Approach |
| AWS Cost Anomaly Detection |
ML-based, integrated with Cost Explorer, SNS alerts |
| GCP Budget Alerts (plus Cost Anomaly Detection in Billing) |
Threshold alerts to Pub/Sub; ML anomaly detection in the Billing console |
| Alibaba Cloud Cost Alerts |
Threshold-based, integrated with Billing and CloudMonitor |
| Third-party (Cloudability, Vantage) |
ML-based across clouds, anomaly scoring, alerting |
Observability Reference
Collector Deployment Modes
| Mode |
Description |
Use Case |
| DaemonSet (agent) |
One collector per node |
Low-latency collection, host metrics and logs |
| Deployment (gateway) |
N replicas as a standalone service |
Centralized processing, tail sampling (with trace-ID-aware load balancing), multi-tenant routing |
| Sidecar |
One collector per pod |
Strong isolation, per-app config |
Per-Cloud OTel Integration
| Cloud |
Managed OTel Offering |
Trace Backend |
Metric Backend |
Log Backend |
| AWS |
AWS Distro for OpenTelemetry (ADOT); X-Ray OTLP endpoint (SigV4) |
X-Ray |
CloudWatch Metrics |
CloudWatch Logs |
| GCP |
Google Cloud exporters; Telemetry (OTLP) API |
Cloud Trace |
Cloud Monitoring |
Cloud Logging |
| Alibaba |
OpenTelemetry ingestion for SLS / ARMS |
Trace Service (SLS) / ARMS |
Metric Store (SLS) |
Log Service (SLS) |
| Tencent |
OTLP to APM and CLS |
Tencent APM |
Cloud Monitor |
Cloud Log Service (CLS) |
OTel Semantic Conventions for Multi-Cloud
Standard attributes make telemetry queryable across clouds in a single backend:
| Attribute |
Example |
Purpose |
cloud.provider |
aws, gcp, azure, alibaba_cloud, tencent_cloud |
Identify which cloud generated the telemetry (well-known values from the semantic conventions) |
cloud.region |
ap-southeast-1, asia-southeast1, cn-hangzhou |
Region-level filtering |
cloud.availability_zone |
ap-southeast-1a |
Zone-level correlation |
k8s.cluster.name |
prod-eks-ap-southeast-1 |
Cluster-level grouping |
service.namespace |
billing, payments |
Cross-cloud service grouping |
deployment.environment.name |
production, staging |
Environment separation (replaces the older deployment.environment) |
Central Backend Options
| Backend |
Traces |
Metrics |
Logs |
Profiling |
License |
| Grafana LGTM (Loki, Grafana, Tempo, Mimir) |
Tempo |
Mimir |
Loki |
Pyroscope (optional) |
AGPL-3.0 / Commercial |
| Datadog |
APM |
Metrics |
Logs |
Continuous Profiler |
Commercial |
| Dynatrace |
PurePath |
Davis AI |
Log Analytics |
Code-level profiling |
Commercial |
| New Relic |
Distributed Tracing |
Metrics |
Logs in Context |
n/a |
Commercial |
| Splunk Observability |
APM |
Infrastructure |
Splunk Log Observer |
n/a |
Commercial |
| Honeycomb |
Events / Traces |
Derived |
n/a |
n/a |
Commercial |
| SigNoz |
Traces (ClickHouse) |
Metrics |
Logs |
n/a |
MIT core / Commercial |
Sources