All posts
AWS Architecture

AWS Managed Service or Open Source on Kubernetes? A Decision Framework for 2026

By

October 25, 2026

8 min read

Redis relicensed and came back, Vault went BSL, MinIO stopped maintaining its community edition, and AWS kept adding managed versions of the open-source tools. How to decide service by service, with the licence changes that matter and twelve head-to-head comparisons.

Open Source
Kubernetes
AWS
Licensing
Platform Engineering

The question every platform team argues about

For almost every managed service on AWS there is an open-source project you could run on Kubernetes instead: S3 or self-hosted object storage, RDS or a Postgres operator, Secrets Manager or Vault, Step Functions or Temporal. The argument usually splits into "managed services are expensive lock-in" against "running it ourselves is a distraction", and both sides are right about something.

Three years of licence changes have added a third consideration: the open-source option is not always as open, or as maintained, as it was when you adopted it.

Want a second opinion on this for your system?

Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.

The licence changes that matter

Project

What changed

Where it stands now

Terraform

Moved to the Business Source License, August 2023

OpenTofu, the community fork, continues the MPL code

HashiCorp Vault

Moved to the BSL, August 2023; IBM completed its acquisition of HashiCorp, February 2025

OpenBao, an MPL fork under the OpenSSF, ships regularly

Redis

Left BSD for source-available licences, March 2024; added AGPLv3 with Redis 8, May 2025

Valkey, the Linux Foundation fork, is what ElastiCache and MemoryDB price lowest

Elasticsearch

Added AGPLv3 as an option, August 2024

OpenSearch, which AWS runs, moved to its own Linux Foundation foundation in September 2024

MinIO

Stopped community binaries and images, October 2025; archived the repository as no longer maintained, April 2026

Commercial AIStor editions; Ceph, Garage and SeaweedFS as open alternatives

From each project's and vendor's own announcements.

The pattern: a project with one commercial owner can change its terms; a project governed by a foundation with several companies behind it rarely does. That is not a reason to avoid single-vendor projects, but it is a reason to know which kind you depend on.

Five questions, in order

  1. Does it hold data you cannot lose? Then the bar for self-hosting is very high: replication, tested restores, upgrades and someone on call who knows the system. Managed wins unless the next questions force otherwise.

  2. Must it run outside AWS — another cloud, on-premises, a customer's environment, the edge? Then open source on Kubernetes is usually the only portable option.

  3. Is it differentiating? If running it better than AWS would make your product better, own it. If not, rent it.

  4. At your scale, does per-use pricing cross the cost of running it yourself — including people? For API gateways, identity and some databases, it eventually does. For most other things, not until you are very large.

  5. Who will own it in two years? A self-hosted system whose expert left is the most expensive kind.

Our defaults, service by service

Need

Default on AWS

When to run open source instead

Object storage

S3

Data must stay on your hardware — Ceph, Garage or SeaweedFS

Cache

ElastiCache for Valkey

Small, non-critical caches next to the service

PostgreSQL

RDS or Aurora

Per-tenant or preview databases, or portability — CloudNativePG

Kafka

MSK Express brokers

Identical Kafka outside AWS — Strimzi

Secrets

Secrets Manager and Parameter Store

Dynamic secrets across clouds — OpenBao or Vault

Identity

Cognito Essentials

Deep customisation or very large user counts — Keycloak

Workflows

Step Functions

Workflows as code — Temporal; container pipelines — Argo Workflows

Metrics and dashboards

CloudWatch, plus Managed Prometheus and Grafana on Kubernetes

Cost or control at large scale — self-hosted Prometheus

Messaging

SQS, SNS, EventBridge

AMQP systems — Amazon MQ; low latency and edge — NATS

Functions

Lambda

Scale-to-zero services on a cluster you run — Knative

API gateway

API Gateway HTTP APIs, or an ALB

High steady volume or plugins — Envoy Gateway or Kong

Deployment

GitHub Actions with OIDC

Kubernetes — Argo CD, as an EKS Capability

Each row has its own detailed comparison on our comparisons page.

hoolco Monthly Review

Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.

As of October 25, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.