Cloud governance is the framework of policies, procedures, and controls that keeps the cloud under control. The right framework is the one the team will actually use. The wrong framework is the one the team ignores.
Table of contents
What cloud governance is
Cloud governance is the discipline of managing the cloud with the same rigor the team manages the on-premises data center. The discipline covers four pillars:
- Identity. Who has access to what. The principle of least privilege.
- Network. What can talk to what. The principle of zero trust.
- Data. Where the data lives, who can read it, how it is encrypted. The principle of data classification.
- Cost. What costs what, who pays, how the cost is allocated. The principle of cost transparency.
The four pillars
The four pillars in detail:
- Identity. IAM roles, service accounts, short-lived credentials. The team should know in under a minute who has access to what.
- Network. VPC, subnet, security group, network ACL, service mesh. The team should know in under a minute what can talk to what.
- Data. Encryption at rest, encryption in transit, secrets management, backup encryption, retention. The team should know in under a minute where the data lives and who can read it.
- Cost. Tagging, cost reports, chargeback, showback. The team should know in under a minute what costs what and who pays.
The framework
The framework that works in 2026:
- Start with the four pillars. Each pillar has a policy, a procedure, a control, and a measurement.
- Make the policy explicit. The policy is the rule. The procedure is the implementation. The control is the automation. The measurement is the audit.
- Automate the controls. The team cannot manually enforce the policy at scale. The control has to be automated.
- Measure the gaps. The team should run an audit every quarter and report the gaps.
The tools
The tools in 2026, ordered by adoption:
- AWS Control Tower. The leader. The right answer when the team is on AWS.
- Azure Blueprints. The runner-up. The right answer when the team is on Azure.
- Google Cloud Organization Policy. The third. The right answer when the team is on GCP.
- Terraform Cloud / Spacelift / Atlantis. The IaC governance layer. The right answer when the team wants the governance to be in the IaC, not in the cloud console.
- CloudQuery / Steampipe. The cloud asset inventory. The right answer when the team wants to query the cloud from SQL.
- Open Policy Agent (OPA). The policy engine. The right answer when the team wants a vendor-neutral policy engine.
The trade-offs
The trade-offs the team needs to understand:
- Strict vs. flexible. A strict framework is easier to enforce; a flexible framework is easier to adopt. The team that goes too strict too fast gets shadow IT. The team that goes too flexible too fast gets compliance violations.
- Centralized vs. federated. A centralized framework is easier to govern; a federated framework is easier to scale. The team that goes too centralized gets bottlenecks. The team that goes too federated gets inconsistencies.
- Automated vs. manual. An automated framework is easier to scale; a manual framework is easier to debug. The team that goes too automated too fast gets policy bugs. The team that goes too manual too long gets compliance violations.
How to start
The starting point for most teams:
- Pick the four-pillar framework.
- Pick one tool per pillar (Control Tower for AWS, Terraform Cloud for the IaC, OPA for the policy engine, CloudQuery for the asset inventory).
- Pick one team to enforce the framework (the platform team, the security team, or a dedicated governance team).
- Run an audit every quarter.
- Iterate.
FAQ
What is cloud governance?
The framework of policies, procedures, and controls that keeps the cloud under control. The framework covers four pillars: identity, network, data, and cost.
What is the best cloud governance tool in 2026?
The right answer depends on the team. For AWS: AWS Control Tower. For Azure: Azure Blueprints. For GCP: Google Cloud Organization Policy. For IaC: Terraform Cloud or Spacelift. For asset inventory: CloudQuery.
What is the difference between governance and security?
Governance is the framework. Security is one of the four pillars. The team that has a good governance framework has a good security posture; the team that has a good security posture does not necessarily have a good governance framework.
How do I start with cloud governance?
Pick the four-pillar framework, pick one tool per pillar, pick one team to enforce it, and run an audit every quarter. Iterate from there.
What is the most common cloud governance mistake?
Going too strict too fast. The team that blocks every resource by default gets shadow IT. The team that allows every resource by default gets compliance violations. The right answer is the middle ground.
If you are setting up cloud governance for a new project, the RunxBuild hosting calculator is the place to model the line items. The identity, the network, the data, the cost - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual governance in one place.