License & Deployment Mix: 30 tools – 18 OSS, 6 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)
What Is Configuration Management?
Configuration Management (CM) is the practice of defining and enforcing the desired state of servers, workstations, and network devices through automated tooling. Instead of manually configuring systems via SSH sessions and ad-hoc scripts, CM tools let operators declare what a system should look like – installed packages, file contents, service states, user accounts, firewall rules – and then automatically converge the system to that state.
Key concepts in configuration management:
- Desired-state enforcement – operators declare the target configuration and the CM tool determines what changes are needed to reach it
- Agent-based vs agentless – agent-based tools (Puppet, Chef, Salt) run a daemon on each managed node; agentless tools (Ansible, Pyinfra) connect over SSH or WinRM on demand
- Push vs pull – push tools (Ansible) execute from a central control node; pull tools (Puppet, Chef) have agents periodically fetch and apply configuration from a server
- Idempotent convergence – running the same configuration multiple times produces the same result; the tool only makes changes when the current state differs from the desired state
- Why CM matters – without CM, server configurations drift over time, creating inconsistencies that cause outages, security gaps, and compliance failures. CM provides reproducibility (rebuild any server from code), drift prevention (detect and correct unauthorized changes), compliance enforcement (prove servers match policy), and auditability (track who changed what and when)
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
This evaluation covers the full configuration management and Infrastructure-as-Code landscape, from CLI engines to enterprise and SaaS platforms.
SSO / OIDC Comparison
OIDC is the preferred SSO protocol.
Only enterprise platforms and SaaS tools with web UIs are listed here. CLI tools (Ansible CLI, OpenTofu CLI, Pulumi CLI, etc.) have no web UI and no SSO.
| Tool | OIDC | SAML | SCIM | Authentik Notes |
|---|---|---|---|---|
| AWX | Yes | No | No | Native OIDC via social auth; Authentik as IdP; team mapping via claims |
| AAP | Yes | Yes | No | OIDC and SAML via Red Hat SSO; Authentik federation possible |
| Puppet Enterprise | No | Yes | No | SAML via PE console; Authentik as SAML IdP; LDAP/AD integration |
| Chef Automate | Yes | Yes | No | OIDC and SAML via Automate config; Authentik as IdP |
| Aria Config | No | Yes | No | SAML via VMware identity; Authentik as SAML IdP; vIDM integration |
| Rudder | Yes | No | No | OIDC plugin; Authentik as IdP; LDAP integration |
| CFEngine Enterprise | No | No | No | LDAP/AD only; no native OIDC/SAML; reverse proxy auth possible |
| HCP Terraform | Yes | Yes | Yes | OIDC and SAML SSO; SCIM provisioning; Authentik federation possible |
| Pulumi Cloud | Yes | Yes | Yes | OIDC and SAML SSO; SCIM provisioning; Authentik federation possible |
| Spacelift | Yes | Yes | Yes | OIDC and SAML SSO; SCIM provisioning; Authentik as IdP |
| env0 | Yes | Yes | Yes | OIDC and SAML SSO; SCIM provisioning; Authentik as IdP |
| Scalr | Yes | Yes | Yes | OIDC and SAML SSO; SCIM provisioning; Authentik as IdP |
Best SSO support: HCP Terraform, Pulumi Cloud, Spacelift, env0, Scalr (all support OIDC, SAML, SCIM)
No SSO: CFEngine Enterprise (LDAP only), CLI tools (Ansible, OpenTofu, Terraform, Pulumi CLI, Pyinfra, Terragrunt, etc.)
API Comparison
| Tool | API Type | Auth | Webhooks | SDKs |
|---|---|---|---|---|
| AWX | REST (Swagger) | Token, OAuth2 | Yes (notifications) | Python (awxkit), Go (community) |
| AAP | REST | Token, OAuth2 | Yes (notifications) | Python (ansible-runner) |
| Puppet Enterprise | REST (PuppetDB, Orchestrator) | Token, certificate | Yes (webhooks) | Ruby (official), Python (pypuppetdb) |
| Chef Automate | REST + gRPC | Token, certificate | Yes | Ruby (knife), Python (community) |
| Aria Config | REST | Token, SSO | Yes | Python (VMware SDK) |
| Rudder | REST | Token | Yes (change hooks) | Python (community) |
| CFEngine Enterprise | REST | Basic, token | No | None official |
| HCP Terraform | REST (JSON:API) | Token, OAuth2 | Yes (notifications) | Go (go-tfe), Python (terrasnek) |
| Pulumi Cloud | REST | Token | Yes (webhooks) | Go, Python, TypeScript (official) |
| Spacelift | GraphQL | Token, API key | Yes (webhooks) | Go (spacectl), Python (community) |
| env0 | REST | API key | Yes (webhooks) | Python (community) |
| Scalr | REST (JSON:API) | Token | Yes (webhooks) | Python (community) |
Configuration Management Comparison
| Tool | License | Agent Model | Push/Pull | Config Language | Linux | Windows | Network | Secret Integration | Web UI (OSS) |
|---|---|---|---|---|---|---|---|---|---|
| Ansible | GPL-3.0 | Agentless (SSH) | Push | YAML | Yes | Yes (WinRM) | Yes | Vault + others | AWX |
| Salt | Apache-2.0 | Agent + agentless | Both | YAML/Jinja | Yes | Yes | Yes (proxy) | Pillar + Vault | salt-api |
| Puppet | Apache-2.0* | Agent | Pull | Puppet DSL | Yes | Enterprise | Limited | Hiera + eyaml | Basic dashboard |
| Chef | Apache-2.0 | Agent | Pull | Ruby DSL | Yes | Yes | Limited | Data bags + Vault | Deprecated |
| CFEngine | GPL-3.0 | Agent | Pull | CFEngine DSL | Yes | Enterprise | No | N/A | N/A |
| mgmt | GPL-3.0+ | Agent (distributed) | Reactive | MCL DSL | Yes | No | No | N/A | N/A |
| Pyinfra | MIT | Agentless (SSH) | Push | Python | Yes | Limited | No | Vault + AWS | N/A |
| Rudder | GPL-3.0 | Agent (CFEngine) | Pull | Visual + DSL | Yes | Enterprise | No | Vault plugin | Yes (built-in) |
* Puppet source is Apache-2.0 but OSS binaries are now restricted beyond 25 nodes (Perforce changed distribution terms in 2023).
Infrastructure as Code Comparison
| Tool | License | Approach | Config Language | State Mgmt | Provider Ecosystem | Drift Detection | Module Registry | Testing |
|---|---|---|---|---|---|---|---|---|
| OpenTofu | MPL-2.0 | Declarative | HCL | .tfstate (client-side encryption) | 3,000+ (TF-compatible) | Via plan | OpenTofu Registry | Terratest |
| Terraform | BSL-1.1 | Declarative | HCL | .tfstate | 3,000+ | Via plan | Terraform Registry | Terratest |
| Pulumi | Apache-2.0 | Declarative + imperative | TS/Python/Go/C#/Java | Pulumi state | TF bridge + native | Refresh/preview | Pulumi Registry | Native unit tests |
| Crossplane | Apache-2.0 | Declarative (K8s CRDs) | YAML | K8s etcd (continuous) | 200+ Upjet | Continuous reconciliation | Upbound Marketplace | K8s testing |
| AWS CDK | Apache-2.0 | Imperative to CFN | TS/Python/Java/C#/Go | CFN stacks | AWS only | Limited | Construct Hub | CDK assertions |
| Azure Bicep | MIT (compiler) | Declarative | Bicep DSL | ARM deployments | Azure only | What-if | Bicep modules | ARM TTK |
| Terragrunt | MIT | HCL wrapper | HCL | Delegates to TF/OT | Same as TF/OT | Via plan | Same as TF/OT | Same as TF/OT |
| NixOps | MIT | Declarative (Nix) | Nix | SQLite | AWS/GCE/Azure/VBox | N/A | N/A | N/A |
Enterprise Platform Features
| Tool | Base OSS | SSO | RBAC | Audit Log | Multi-Tenant | Credential Mgmt | Workflow/Pipeline | Pricing |
|---|---|---|---|---|---|---|---|---|
| AWX | Ansible | OIDC | Yes (orgs, teams, roles) | Yes | Yes (organizations) | Yes (vault, cloud) | Yes (workflow templates) | Free (OSS) |
| AAP | Ansible | OIDC, SAML | Yes (advanced) | Yes (full) | Yes (organizations) | Yes (advanced) | Yes (advanced workflows) | Per-node subscription |
| Puppet Enterprise | Puppet | SAML | Yes (roles, permissions) | Yes | Yes (environments) | Yes (Hiera eyaml) | Yes (Orchestrator) | Per-node license |
| Chef Automate | Chef Infra | OIDC, SAML | Yes (policies) | Yes | No | Yes (data bags, Vault) | Yes (Effortless) | Per-node license |
| Aria Config | Salt | SAML | Yes (VMware roles) | Yes | Yes (VMware tenants) | Yes (integrated) | Yes (VMware Aria) | VMware suite license |
| Rudder Enterprise | Rudder | OIDC | Yes (fine-grained) | Yes | Yes (multi-tenant) | Yes (Vault plugin) | Yes (campaigns) | Per-node license |
| CFEngine Enterprise | CFEngine | LDAP only | Yes (Mission Portal) | Yes | No | Limited | Yes (sketches) | Per-node license |
IaC SaaS Platform Features
| Tool | IaC Engines | SSO | Policy-as-Code | Drift Detection | Cost Estimation | Self-Hosted Agents | Pricing |
|---|---|---|---|---|---|---|---|
| HCP Terraform | Terraform, OpenTofu | OIDC, SAML, SCIM | Sentinel, OPA | Yes (scheduled) | Yes (native) | Yes (agents) | Free tier; Team $20/user/mo; Business custom |
| Pulumi Cloud | Pulumi | OIDC, SAML, SCIM | CrossGuard (OPA) | Yes (refresh) | No native | Yes (self-hosted) | Free tier; Team $50/user/mo; Enterprise custom |
| Spacelift | TF, OT, Pulumi, CFN, Ansible, K8s | OIDC, SAML, SCIM | OPA (built-in) | Yes (scheduled) | Yes (Infracost) | Yes (workers) | Free tier; Cloud from $40/user/mo |
| env0 | TF, OT, Pulumi, CFN, Terragrunt | OIDC, SAML, SCIM | OPA, custom | Yes (scheduled) | Yes (Infracost) | Yes (agents) | Free tier; Pro from $35/user/mo |
| Scalr | Terraform, OpenTofu | OIDC, SAML, SCIM | OPA (built-in) | Yes (scheduled) | Yes (native) | Yes (agents) | Free tier; per-run pricing |
Deployment and Licensing
| Tool | License | Self-Hosted | Language | Pricing Model |
|---|---|---|---|---|
| Ansible | GPL-3.0 | Yes (CLI) | Python | Free |
| Salt | Apache-2.0 | Yes | Python | Free |
| Puppet | Apache-2.0* | Yes | Ruby, Clojure | Free (25-node limit) |
| Chef | Apache-2.0 | Yes | Ruby, Go | Free |
| CFEngine | GPL-3.0 | Yes | C | Free |
| mgmt | GPL-3.0+ | Yes | Go | Free |
| Pyinfra | MIT | Yes (CLI) | Python | Free |
| Rudder | GPL-3.0 | Yes | Scala, Rust | Free |
| AWX | Apache-2.0 | Yes | Python, JS | Free |
| AAP | Proprietary | Yes | Python | Per-node subscription |
| Puppet Enterprise | Proprietary | Yes | Ruby, Clojure | Per-node license |
| Chef Automate | Proprietary | Yes | Ruby, Go | Per-node license |
| Aria Config | Proprietary | Yes | Python | VMware suite license |
| Rudder Enterprise | Proprietary | Yes | Scala, Rust | Per-node license |
| CFEngine Enterprise | Proprietary | Yes | C | Per-node license |
| OpenTofu | MPL-2.0 | Yes (CLI) | Go | Free |
| Terraform | BSL-1.1 | Yes (CLI) | Go | Free (CLI); BSL restricts competition |
| Pulumi | Apache-2.0 | Yes (CLI) | Go, TypeScript | Free (CLI) |
| Crossplane | Apache-2.0 | Yes (K8s) | Go | Free |
| AWS CDK | Apache-2.0 | Yes (CLI) | TypeScript | Free (AWS charges apply) |
| Azure Bicep | MIT | Yes (CLI) | .NET | Free (Azure charges apply) |
| Terragrunt | MIT | Yes (CLI) | Go | Free |
| Atlantis | Apache-2.0 | Yes | Go | Free |
| NixOps | MIT | Yes (CLI) | Python, Nix | Free |
| AWS CloudFormation | Proprietary | No (AWS) | N/A | Free (AWS charges apply) |
| HCP Terraform | Proprietary | No (SaaS) | N/A | Free tier; paid plans |
| Pulumi Cloud | Proprietary | No (SaaS) | N/A | Free tier; paid plans |
| Spacelift | Proprietary | No (SaaS) | N/A | Free tier; paid plans |
| env0 | Proprietary | No (SaaS) | N/A | Free tier; paid plans |
| Scalr | Proprietary | No (SaaS) | N/A | Free tier; per-run pricing |
* Puppet Apache-2.0 source with restricted OSS binary distribution beyond 25 nodes.
Tools
30 tools.
Ansible
Ansible is the most widely adopted open-source configuration management and automation tool, developed by Red Hat.
License: GPL-3.0-only (OSS) · Kind: web · Deploy: saas, docker, k8s, package · SSO: none
Ansible Automation Platform (AAP)
Ansible Automation Platform (AAP) is Red Hat’s commercial automation platform built on the Ansible open-source project.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: OIDC
Ansible AWX
Ansible AWX is the open-source upstream project for Red Hat Ansible Automation Platform (AAP) Tower.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: OIDC
Atlantis
Atlantis is an open-source, self-hosted application that automates Terraform and OpenTofu through pull requests, running plans on PRs and applying changes on approval for a GitOps IaC workflow.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none
AWS CDK
AWS Cloud Development Kit (CDK) is an open-source framework for defining AWS cloud infrastructure using general-purpose programming languages.
License: Apache-2.0 (OSS) · Kind: web · Deploy: saas, docker, package · SSO: none
AWS CloudFormation
AWS CloudFormation is Amazon Web Services’ native infrastructure as code service for provisioning and managing AWS resources.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Azure Bicep
Azure Bicep is a domain-specific language for declaratively deploying Azure resources, compiling to ARM templates with cleaner syntax, type safety, and modules; the compiler is MIT-licensed.
License: MIT (OSS) · Kind: web · Deploy: saas · SSO: none
CFEngine
CFEngine is the original configuration management tool, created by Mark Burgess in 1993. It pioneered the concept of desired-state configuration and promise theory, where system components make “promises” about their behavior.
License: GPL-3.0-only (OSS) · Kind: web · Deploy: native · SSO: none
CFEngine Enterprise
CFEngine Enterprise is the commercial edition of CFEngine (Northern.tech), adding the Mission Portal web console, centralized compliance reporting, and RBAC to its lightweight, high-performance agent.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
Chef Automate
Chef Automate is Progress Software’s commercial platform that unifies Chef Infra (configuration management), Chef InSpec (compliance automation), and Chef Habitat (application automation) under a single management console.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: OIDC
Chef Infra
Chef Infra is a configuration management tool that uses an imperative, code-driven approach to infrastructure automation.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none
Crossplane
Crossplane is a Kubernetes-native infrastructure as code platform that extends the Kubernetes API to manage external cloud resources.
License: Apache-2.0 (OSS) · Kind: web · Deploy: k8s · SSO: none
env0
env0 is a SaaS platform for automating and governing infrastructure-as-code deployments across Terraform, OpenTofu, Pulumi, and more, with cost tracking, drift detection, and policy-as-code governance.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
HCP Terraform
HCP Terraform (formerly Terraform Cloud) is HashiCorp’s managed platform for Terraform and OpenTofu workflows.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
mgmt
mgmt (pronounced “management”) is a next- generation configuration management tool designed to address fundamental limitations of existing CM tools.
License: AGPL-3.0-only (OSS) · Kind: web · Deploy: native · SSO: none
NixOps
NixOps is a deployment tool for NixOS machines, built on the Nix package manager’s declarative configuration model.
License: LGPL-3.0-only (OSS) · Kind: web · Deploy: saas, package · SSO: none
OpenTofu
OpenTofu is an open-source fork of Terraform, created in 2023 after HashiCorp changed Terraform’s license from MPL-2.0 to BSL 1.1.
License: MPL-2.0 (OSS) · Kind: web · Deploy: saas, docker, native, k8s, package · SSO: none
Pulumi
Pulumi is an infrastructure as code platform that enables defining cloud infrastructure using general-purpose programming languages instead of domain-specific languages like HCL.
License: Apache-2.0 (OSS) · Kind: web · Deploy: saas, docker, k8s, package · SSO: none
Pulumi Cloud
Pulumi Cloud is Pulumi’s managed platform for infrastructure as code, providing state management, secrets encryption, team collaboration, and deployment automation for Pulumi programs.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
Puppet
Puppet is one of the oldest and most mature configuration management tools, originally released in 2005. Now maintained by Perforce (acquired from Puppet Inc.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none
Puppet Enterprise
Puppet Enterprise (PE) is the commercial version of Puppet, maintained by Perforce (acquired from Puppet Inc. in 2022).
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
Pyinfra
Pyinfra is a lightweight, agentless infrastructure automation tool written in Python. Like Ansible, it connects to targets over SSH and requires no agent installation.
License: MIT (OSS) · Kind: web · Deploy: saas, docker, package · SSO: none
Rudder
Rudder is a continuous auditing and configuration management platform designed for operations teams who need compliance visibility alongside infrastructure automation.
License: GPL-3.0-only (OSS) · Kind: web · Deploy: native · SSO: none
Rudder Enterprise
Rudder Enterprise is the commercial version of the Rudder open-source configuration management and compliance platform, maintained by Normation (the company behind Rudder).
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
Salt (SaltStack)
Salt (formerly SaltStack) is a high-speed, event-driven configuration management and remote execution framework.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none
Scalr
Scalr is a remote operations backend for Terraform and OpenTofu that provides a hierarchical management model designed for organizations with multiple teams and environments.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
Semaphore UI
Semaphore UI is an open-source, web-based interface for managing and running Ansible playbooks, positioned as a lightweight alternative to AWX with task scheduling, inventory, and credential management.
License: MIT (OSS) · Kind: web · Deploy: native, docker · SSO: OIDC
Spacelift
Spacelift is a CI/CD platform purpose-built for infrastructure as code. It supports Terraform, OpenTofu, Pulumi, CloudFormation, Ansible, and Kubernetes, providing a unified management layer across multiple IaC tools with advanced policy en…
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
Terragrunt
Terragrunt is a thin wrapper around Terraform and OpenTofu that provides extra tools for working with multiple modules, managing remote state, and keeping configurations DRY (Don’t Repeat Yourself).
License: MIT (OSS) · Kind: web · Deploy: saas, package · SSO: none
VMware Aria Automation Config
VMware Aria Automation Config (formerly VMware vRealize Automation SaltStack Config, and before that SaltStack Enterprise) is the commercial version of Salt, integrated into VMware’s Aria automation suite.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: SAML
