Skip to content
SPECIFICTION
Get listed

cfn-nag

github.com

Free plan macOSLinuxSelf-hosted
Visit github.com
Spec score 8.0 #9 of 28 in Infrastructure Testing Tools

What it is

cfn-nag is free, MIT-licensed software that scans AWS CloudFormation templates for patterns that may indicate insecure infrastructure. It checks for overly permissive IAM policies and security-group rules, disabled access logging or encryption, and password literals. The scanner accepts JSON, .template, YAML, and YML files, and recursively processes subdirectories when given a directory. Results print to standard output, with JSON output available; failures return a non-zero exit code while warnings return success. Installation is documented through RubyGems and Homebrew, with Ruby 2.5 or later required for gem installation. A Dockerfile and Docker Hub image are provided. cfn-nag can run in GitHub Actions and AWS CodePipeline. Profiles, deny lists, per-resource suppressions, and custom rules support policy tailoring. Static analysis needs supplied parameter values to assess them and does not inspect false Fn::If outcomes by default.

Spec sheet

Purpose
cfn-nag scans CloudFormation templates for patterns that may indicate insecure infrastructure.Read 3 Oct 2026 · github.com
Integrations
The project documents running cfn-nag in GitHub Actions workflows and deploying it in AWS CodePipeline through the AWS Serverless Application Repository.Read 3 Oct 2026 · github.com
Support
The project directs users to submit bug reports and feature requests through its GitHub issue tracker.Read 3 Oct 2026 · github.com
License
The project uses the MIT License, which grants permission to use, copy, modify, merge, publish, distribute, sublicense, and sell the software subject to its terms.Read 3 Oct 2026 · github.com
Checks
The project lists checks for overly permissive IAM and security group rules, disabled access logs or encryption, and password literals.Read 3 Oct 2026 · github.com
Conditional analysis limit
By default, cfn-nag substitutes the true outcome for Fn::If, so rules do not inspect false outcomes unless condition values are provided.Read 3 Oct 2026 · github.com
Docker
A Dockerfile is provided, and the project says its image is published as stelligent/cfn_nag on Docker Hub.Read 3 Oct 2026 · github.com
Install
The project documents installation with RubyGems and Homebrew, and requires Ruby 2.5 or later for gem installation.Read 3 Oct 2026 · github.com
Offline use
The gem specification describes cfn-nag as a static analysis tool that must work without network connectivity, while noting S3 rule retrieval is optional.Read 3 Oct 2026 · github.com
Output
Results go to standard output; JSON output is available, and failures return a non-zero exit code while warnings return success.Read 3 Oct 2026 · github.com
Rule customization
Users can filter checks with profiles and deny lists, suppress rules per resource, and develop custom rules distributed as gems or loaded from S3.Read 3 Oct 2026 · github.com
Template analysis limit
Static analysis cannot see parameter values supplied at deployment unless users provide those values through a JSON file.Read 3 Oct 2026 · github.com
Template inputs
The scanner processes JSON, .template, YAML, and YML files and recursively scans subdirectories when given a directory.Read 3 Oct 2026 · github.com

Plans and prices

cfn-nag Free MIT-licensed software · Ruby >= 2.5 Read 3 Oct 2026 · github.com

Every cfn-nag plan and price →

Strong points and limits

Strong points

  • Free MIT-licensed CloudFormation scanner
  • Checks IAM, network, logging, encryption, and passwords
  • Accepts JSON, YAML, and template files
  • Supports custom rules and policy filtering
  • Integrates with GitHub Actions and AWS CodePipeline

Limits

  • Does not analyze Terraform or Kubernetes
  • Deployment parameter values need a JSON file
  • False Fn::If outcomes need condition values
  • Requires Ruby 2.5+ for gem installation

Who it suits

cfn-nag suits teams reviewing CloudFormation security on Linux, macOS, or self-hosted systems. It fits workflows that need custom policies, CI integrations, or offline static analysis.

Verdict

cfn-nag provides focused CloudFormation static analysis with configurable rules and common CI deployment paths. Its conditional and parameter-analysis limits matter when templates depend heavily on deployment-time values.

Where Specifiction places it

Alternatives to cfn-nagAll alternatives →