Skip to content
    Opafra
    Request access
    Comparison

    AWX without the Kubernetes. AAP without the per-node bill.

    Ansible is a good tool and this page is not going to pretend otherwise. What follows is where the three products genuinely differ, with a source and a date against every claim we make about someone else.

    Claims about other products verified . Each one is sourced on this page.

    Unlimited nodesNo cluster to operateDry run and approval in one flowFlat price, never per node
    The money

    Every Ansible option prices per node. Ours does not.

    200 nodes on AAP (AWS)

    $20K+

    per year, list, before control-plane compute

    200 nodes on AAP (self-managed)

    $35-50K

    per year, typical quoted range

    200 nodes on Opafra

    Flat

    per organisation, unlimited nodes

    AWX itself is free, and the honest version of that comparison is further down: free software plus a Kubernetes cluster plus the person who operates it is not the same as free.

    Day one

    What each one costs before it does anything.

    Free software is not the same as no cost. This is each product's own install guide, reduced to the things you have to stand up before the first command runs.

    AWX
    1. 1A running Kubernetes cluster, or minikube for testing, or OpenShift
    2. 2kubectl with Kustomize support
    3. 3Deploy the AWX Operator into the cluster
    4. 4Apply an AWX instance manifest and wait for it to reconcile
    5. 5Operate Postgres, the web and task pods, and the execution environments after that

    AWX itself is free. The cluster underneath it, and whoever keeps that cluster running, is the part that is not.

    AWX Operator install guide
    Opafra
    1. 1Sign in
    2. 2Add one line to authorized_keys on a host
    3. 3Run something

    Nothing runs on your servers, so there is nothing to patch, monitor or roll back. Removing Opafra is deleting that line.

    Feature by feature
    CapabilityOpafraAWXAAP
    Pricing modelPer organisation, unlimited nodesFree, plus the cluster and whoever runs itPer managed node, quote or AWS list
    What the AI producesA dry-runnable, approval-gated planNoAnswers and draft YAML you still author
    Guided builder with typed parametersYesNoNo
    Dry run and approval as one flowYesCheck mode, separateCheck mode, separate
    Environments as a first-class lifecycleYesInventories and namingInventories and naming
    Time-limited access grantsYesNoVia ServiceNow integration
    Run-to-run diffYesNoNo
    Environment derived from the targetsYesNoNo
    Multi-tenant workspacesYesOne org per deploymentManaged edition only
    Dynamic discovery and git syncYesYesYes
    Scheduler with overlap protectionYesConcurrent by defaultConcurrent by default
    Runs without KubernetesYesNoManaged on AWS only

    Sources: AWX releases · AAP on AWS listing · AAP 2.6 documentation · Last verified September 2026

    AWX specifically

    Free, and the release history is a fact you should check.

    AWX is the upstream of Ansible Automation Platform and it is free. For a team that wants a web UI, a job history and RBAC over playbooks it already has, that is a strong offer and it is why AWX is everywhere.

    One thing to check before you build a year of operations on it: at the time of writing the most recent tagged release is 24.6.1 from July 2024. Red Hat has said publicly that this is a refactoring of how core components connect rather than an abandonment, and has been explicit that they are not changing the Ansible project or its licensing. We are not going to tell you AWX is dead, because Red Hat says it is not and they would know.

    What we will say is that a release gap of that length is a fact worth weighing, and that the way to weigh it is to look at the releases page yourself on the day you decide. That is why the link is there rather than a claim.

    The other cost is the one AWX shares with every self-hosted control plane: it runs on Kubernetes, and somebody operates that. Free software plus a cluster plus the person who keeps the cluster healthy is a different number from free.

    The most recent tagged release is 24.6.1, published 2 July 2024. Check the link rather than taking our word for it, and note the date you are reading this.
    ansible/awx releases on GitHubChecked 14 September 2026
    AAP specifically

    Supported, certified, and priced by the node.

    Ansible Automation Platform is the commercial product: Red Hat support, certified content collections, Private Automation Hub, analytics, Event-Driven Ansible and Automation Mesh for reaching networks a single control plane cannot. If you are already a Red Hat shop with a subscription, much of this is genuinely the path of least resistance and we would not argue otherwise.

    The question worth asking is what it costs as the fleet grows. AAP is licensed per managed node, and that shape has a predictable consequence: teams start leaving hosts out of the tool to keep the number down. The machines that most need governing are usually the ragged edges of the estate, and those are exactly the ones a per-node bill argues against registering.

    We price per organisation by user band, with unlimited hosts on every plan. That is not a better business model in the abstract, it is a different one, and it exists because we think an automation tool that you are incentivised not to point at half your fleet is not doing its job.

    If your estate is a few thousand nodes and the subscription is already signed, AAP is probably the right answer and this page has not argued otherwise. If you are twenty to five hundred hosts and looking at a quote that scales with every machine you add, the arithmetic is worth doing.

    On the AI

    Both products have AI. Ask what it hands you.

    AAP 2.6 ships the Lightspeed assistant, and it is a real product. It answers questions about the platform and helps you generate YAML, which you then author, test, review and operate yourself.

    Opafra's composer is the front door rather than a helper beside it. You describe the change; what comes back is a plan you can read, refine in conversation, dry-run against the real targets, and send through an approval gate. The artefact is the thing that runs, not a draft of it.

    Assistant output

    An answer, and YAML you still have to make correct, safe and reviewable on your own.

    Composer output

    A plan with typed steps and named targets, a dry run showing what would change, an approval recorded against that exact revision, and an audit entry when it runs.

    Governance

    Both products have approvals. Ask what happens to the plan nobody remembered to gate.

    In AWX and AAP, approval is a node you place inside a Workflow Job Template. It works, and it works exactly where somebody put it. The job template written next quarter, by someone who never read the policy, ships without a gate until a reviewer notices.

    In Opafra the gate belongs to the environment. Mark production as requiring approval once, and every run whose targets land in it waits for a person. That includes plans authored later, plans written by people who have never seen the setting, and a plan that names a production host directly rather than the environment, because the environment is derived from the resolved targets rather than chosen in the run dialog.

    The approval records who decided, when, and against which plan revision. If the plan is edited between the request and the decision, the record shows both numbers rather than quietly honouring the newer one.

    Gate on the workflow

    Coverage is whatever the authors remembered. Auditing it means reading every workflow.

    Gate on the environment

    Coverage is a property of the estate. There is one place to check, and no phrasing of a plan opts out of it.

    The other side

    When AWX or AAP is the right choice

    • Your estate is majority Windows. We are SSH-first and our Windows story is thin. This is a straightforward disqualification, not a hedge.
    • You run thousands of nodes with an established platform team. We build for 20 to 500 hosts; at that scale AAP's track record is the safer bet.
    • You depend on specific certified collections. There are thousands of them and we do not match that catalogue.
    • You need deep event-driven automation. Our scheduler covers recurring and triggered work; EDA is not the fight we are picking this year.
    • A Red Hat support contract matters more to you than the difference in price. That is a legitimate way to buy software.
    Facts
    • AWX last shipped 24.6.1 in July 2024. Development is paused for a refactor and no 2026 release is planned. AWX releases
    • AAP Service on AWS lists at about $412.50/month for 50 managed nodes, plus $0.10 per vCPU-hour for the control plane. AWS Marketplace listing
    • AAP 2.6 (June 2026) ships the Lightspeed intelligent assistant GA, with AI-assisted inventory generation and unified RBAC. Red Hat AAP 2.6 release notes
    • AAP self-managed is quote-only. Public estimates put it near $175 to $250 per node per year. vendor quotes, not a list price

    Last verified September 2026

    Questions

    What people ask before switching

    Is AWX actually still maintained?
    AWX last shipped 24.6.1 in July 2024 and development is paused for a refactor, with no 2026 release announced. That is a fact worth knowing rather than a reason to panic: the code works, and Red Hat continues to ship AAP on a normal cadence. If you are running AWX in production today it is not going to stop working. It does mean the free edition is not where the roadmap is.
    Can I keep my Ansible playbooks?
    Not directly, and we would rather say so than imply an import button that does not exist. Opafra runs tools and commands over SSH rather than executing playbooks, so an estate already expressed as roles and collections represents real investment that does not transfer. If that describes you, staying on Ansible is very likely the right call.
    How is the approval gate different from AWX workflow approval?
    AWX approval is a node you place inside a workflow, so a job template written next month ships without a gate unless somebody remembers to add one. Ours is a property of the environment: mark production as requiring approval and every run that touches a host in it is gated, including plans written later by people who never read the policy, and including a plan that names a production host directly instead of the environment.
    Does check mode not already do what your dry run does?
    Partly, and the difference is honesty about confidence. Ansible check mode is per-module: modules that support it predict accurately, and command, shell and raw are skipped rather than predicted. Our dry run reports which of the two you are looking at for every step, per host: a simulated verdict where a read-only check exists, and the exact resolved command text where it does not.
    What happens to my nodes if we stop paying?
    Nothing. There is no agent on them and no configuration of ours on disk. The only trace Opafra leaves on a host is one line in authorized_keys, which you remove. This is the practical half of agentless, and it is worth weighing against any tool that installs software across your fleet.
    Do you support Windows?
    Thinly. We are SSH-first, and if your estate is majority Windows then AAP is the better tool and this is a straightforward disqualification rather than something to work around.

    Connect one server and run something real.

    No cluster to run and nothing to install on the hosts. A person shows you a run on your own kind of estate.

    Request accessSee pricing