AWS Open Source Contributions - The Strategic Significance of Bottlerocket, Firecracker, Cedar, and OpenSearch
This article explains the technical features of open source projects led by AWS, including Bottlerocket, Firecracker, Cedar, and OpenSearch, and examines the uniqueness of AWS's OSS strategy.
The Big Picture of AWS's OSS Strategy
AWS pursues a distinctive open source strategy among cloud vendors. While Google creates industry-standard OSS like Kubernetes and TensorFlow, and Microsoft strengthens community relationships through the GitHub acquisition and open-sourcing .NET, AWS takes the approach of releasing the foundational technologies behind its own services as open source. Firecracker (the foundation of Lambda and Fargate), Bottlerocket (a container-optimized OS), Cedar (an authorization policy language), and OpenSearch (a search and analytics engine) all originated from internal AWS needs and were subsequently released to the public. This strategy increases transparency of AWS services while accelerating technology improvement through community feedback.
Firecracker - The Lightweight VM Powering Serverless
Firecracker is a lightweight virtual machine monitor (VMM) developed by AWS, used as the execution foundation for Lambda and Fargate. Compared to traditional VMs, it boasts extremely fast startup times of under 125 milliseconds with minimal memory overhead. Running on KVM (Kernel-based Virtual Machine), it achieves both the lightweight nature of containers and VM-level security isolation. It is implemented in Rust, providing memory safety guarantees at the language level. By open-sourcing Firecracker, the same technology can be used outside AWS, and platforms like Fly.io have adopted it. While often compared to Google's gVisor and Intel's Kata Containers, Firecracker holds advantages in startup speed and resource efficiency.
Bottlerocket - Design Philosophy of a Container-Optimized OS
Bottlerocket is a Linux-based OS developed by AWS specifically for container workloads. Unlike general-purpose operating systems, it eliminates packages and tools unnecessary for running containers, minimizing the attack surface. It has no package manager, and OS updates are performed by replacing the entire image in an immutable design. During updates, A/B partition switching enables immediate rollback if issues arise. An API-driven configuration management model eliminates the need for SSH login and manual configuration, enhancing compatibility with Infrastructure as Code. It is available for both EKS and ECS, making it the OS with the deepest integration with AWS container services. While it belongs to the same category as Google's Container-Optimized OS (COS) and Flatcar Container Linux, Bottlerocket differentiates itself with its API-driven management model.
Cedar - A Declarative Authorization Policy Language
Cedar is an authorization policy language developed by AWS, serving as the foundational technology for Amazon Verified Permissions. Traditional authorization logic tends to be scattered throughout application code, but Cedar separates policies from code, enabling declarative expression. The policy syntax is designed for human readability, clearly expressing who can perform which actions on what resources under which conditions. Cedar's policy engine is implemented in Rust, enabling fast evaluation and formal verification (detecting policy contradictions and redundancies). While compared to Google's Zanzibar (the authorization foundation for Google Drive and YouTube) and Open Policy Agent (OPA), Cedar occupies a unique position with its formal verification capabilities and human-readable policy syntax. For application developers, standardizing and externalizing authorization logic directly improves maintainability.
OpenSearch - From Fork to Independent Evolution
OpenSearch is a project AWS launched in 2021 as a fork of Elasticsearch and Kibana. After Elastic changed its license to SSPL, AWS released OpenSearch under the Apache 2.0 license. Initially maintaining compatibility with Elasticsearch 7.10, it has since undergone independent feature additions, evolving uniquely in areas such as security analytics, observability, and machine learning inference. OpenSearch Dashboards is a fork of Kibana, providing visualization and dashboard capabilities. Amazon OpenSearch Service, the managed offering, simplifies OpenSearch deployment and operations. To deepen your understanding of OSS strategy and cloud-native technology, related books on Amazon can also be helpful.
What AWS's OSS Strategy Means
AWS's OSS strategy increases transparency and trust by releasing the foundational technologies behind its services. Open-sourcing infrastructure technologies like Firecracker and Bottlerocket allows users to understand the inner workings of AWS services and provides the option to use the same technology in their own environments if needed. On the other hand, AWS has also sparked debate with the OSS community, as seen with the Elasticsearch fork (OpenSearch). Google pursues an OSS strategy of creating industry standards like Kubernetes and Istio, while Microsoft builds developer support through open-sourcing developer tools like VS Code and TypeScript. Each cloud vendor takes a different OSS approach, but AWS provides unique value through the release of practical foundational technologies. Leveraging OSS is also important as a means of reducing lock-in to specific vendors, and evaluating each vendor's OSS strategy during cloud selection is recommended.