Skip to content
SPECIFICTION
Get listed

CFRipper

github.com

Free plan Open source WebWindowsmacOSLinuxSelf-hosted
Visit github.com
Spec score 8.9 #4 of 22 in Infrastructure as Code Security Software

What it is

CFRipper is a free, open-source Python library and command-line security analyzer for AWS CloudFormation templates. It examines template files to help keep vulnerable infrastructure from reaching production. The CLI accepts templates as arguments and can return text or JSON findings, with an option to save results in an output folder. Example findings include wildcard principals and IAM role policies that grant excessive permissions. Rules can be configured with a rules file and filters folder, and users can add plugins for their own compliance checks. Documented exit codes distinguish successful scans, scanning errors, invalid templates, and unhandled exceptions. CFRipper runs on Linux, macOS, Windows, or as self-hosted software. The project uses uv for dependencies, provides installation instructions for those operating systems, and is distributed under the Apache License 2.0. Its analysis scope is CloudFormation; Terraform and Kubernetes are not supported.

Spec sheet

What it does
CFRipper analyzes AWS CloudFormation templates for security and compliance problems before deployment.Read 21 Oct 2026 · github.com
Purpose
CFRipper is a library and CLI security analyzer for AWS CloudFormation templates that aims to prevent vulnerable infrastructure from reaching production.Read 8 Oct 2026 · github.com
License
The package and repository use the OSI-approved Apache License 2.0.Read 21 Oct 2026 · pypi.org
Attribution
The documentation says some CFRipper rules were inspired by cfn-nag and its example scripts are used in test cases.Read 8 Oct 2026 · cfripper.readthedocs.io
Built-in security checks
Documented examples include detection of wildcard principals and overprivileged IAM role permissions.Read 21 Oct 2026 · github.com
Changelog compatibility
The changelog records Python 3.14 support in version 1.19 and removal of Python 3.9 support in version 1.18.Read 21 Oct 2026 · github.com
Custom checks
Users can add their own compliance checks through custom plugins.Read 21 Oct 2026 · github.com
Development checks
The documentation lists commands for linting, coverage, tests, and installing runtime or development dependencies.Read 8 Oct 2026 · cfripper.readthedocs.io
Documentation
The README links to a dedicated Read the Docs documentation site.Read 21 Oct 2026 · github.com
Dynamic extensibility
The changelog says version 1.0 introduced pluggy-based dynamic rule loading and external filter files.Read 21 Oct 2026 · github.com
Exit codes
The CLI documents separate codes for successful scans, scan errors, invalid templates, and unhandled exceptions.Read 21 Oct 2026 · pypi.org
Findings
Example findings include wildcard principals and overly permissive IAM role policies.Read 8 Oct 2026 · github.com
Homebrew dependencies
The Homebrew formula depends on libyaml, pydantic, and Python 3.14.Read 21 Oct 2026 · formulae.brew.sh
Homebrew installation
Homebrew provides installation through the command brew install cfripper.Read 21 Oct 2026 · formulae.brew.sh
Homebrew platforms
Homebrew supplies bottles for supported macOS Apple Silicon and Intel systems plus ARM64 and x86_64 Linux.Read 21 Oct 2026 · formulae.brew.sh
Independent description
CybersecTools describes CFRipper as a security analyzer for CloudFormation vulnerabilities and configuration errors before deployment.Read 21 Oct 2026 · cybersectools.com
Independent extensibility praise
CybersecTools highlights the plugin system, Python-library form, multiple output formats, and template resolution as capabilities.Read 21 Oct 2026 · cybersectools.com
Independent listing price
CybersecTools labels CFRipper as a free tool and says it is suitable for cost-conscious teams.Read 21 Oct 2026 · cybersectools.com
Input
The CLI accepts CloudFormation template files as arguments for analysis.Read 8 Oct 2026 · github.com
Install and development
The repository says it uses uv for dependency management and shows installation instructions for macOS, Linux, and Windows.Read 8 Oct 2026 · github.com
Language
The documentation describes CFRipper as a Python tool.Read 8 Oct 2026 · cfripper.readthedocs.io
Limit: independent reviews
CybersecTools reports that CFRipper has no reviews yet.Read 21 Oct 2026 · cybersectools.com
Limit: integrations
CybersecTools does not name any integrations and displays the integration list as unavailable without sign-in.Read 21 Oct 2026 · cybersectools.com
Limit: scope
Independent CloudSecDocs catalogues CFRipper specifically in its CloudFormation security-tool section, while listing broader multi-framework coverage for alternatives.Read 21 Oct 2026 · cloudsecdocs.com
Maintainers
PyPI lists six verified maintainers, including the Skyscanner security group and individual contributors.Read 21 Oct 2026 · pypi.org
Maker company size
LinkedIn lists Skyscanner as privately held with 1,001–5,000 employees.Read 21 Oct 2026 · linkedin.com
Maker founding year
LinkedIn lists Skyscanner as founded in 2003.Read 21 Oct 2026 · linkedin.com
Maker headquarters
LinkedIn lists Skyscanner headquarters in Edinburgh.Read 21 Oct 2026 · linkedin.com
Maker identity
GitHub identifies Skyscanner as the verified organization controlling the skyscanner.net domain.Read 21 Oct 2026 · github.com
Nix package
MyNixOS lists CFRipper as an Apache-2.0 package with a cfripper executable and Windows, Linux, macOS, and other Nix platforms.Read 21 Oct 2026 · mynixos.com
Output files
JSON results can be written into a chosen output directory.Read 21 Oct 2026 · pypi.org
Output formats
The CLI can emit text or JSON findings.Read 21 Oct 2026 · pypi.org
Product form
The project is available as both a Python library and a command-line tool.Read 21 Oct 2026 · github.com
Project status
PyPI classifies CFRipper as production/stable software.Read 21 Oct 2026 · pypi.org
Python requirement
PyPI lists Python 3.10 or newer as the runtime requirement.Read 21 Oct 2026 · pypi.org
Recent rule additions
Version 1.15 added public load-balancer, stack-name regular-expression, and storage-encryption rules.Read 21 Oct 2026 · github.com
Release
PyPI records version 1.20.1 as released on March 18, 2026.Read 21 Oct 2026 · pypi.org
Repository activity
GitHub shows the public repository with 414 stars, 59 forks, four open issues, and one open pull request.Read 21 Oct 2026 · github.com
Rule configuration
Rules can be customized with a rules configuration file and a filters directory.Read 21 Oct 2026 · pypi.org
Supported Python versions
PyPI classifies the package for Python 3.10 through 3.14.Read 21 Oct 2026 · pypi.org
Template resolution
A resolve option lets scans evaluate additional CloudFormation references and expose further findings.Read 21 Oct 2026 · pypi.org

Plans and prices

CFRipper Free Apache-2.0 licensed software · CloudFormation templates Read 8 Oct 2026 · github.com
Free Free AWS CloudFormation templates · CLI and Python library · custom compliance plugins Read 21 Oct 2026 · cybersectools.com

Every CFRipper plan and price →

Strong points and limits

Strong points

  • Free and Apache-2.0 licensed
  • Text and JSON scan output
  • Custom compliance plugins
  • Configurable rules and filters
  • Runs on Linux, macOS, Windows

Limits

  • Terraform analysis is not supported
  • Kubernetes analysis is not supported
  • No free trial is listed

Who it suits

CFRipper suits teams working with AWS CloudFormation that need configurable template checks and command-line output. It is also relevant to users wanting a free, self-hosted Python tool with custom plugins.

Verdict

CFRipper focuses narrowly on CloudFormation security analysis, with customizable rules and clear scan results. Its free license and multiple operating-system options suit teams comfortable running a Python CLI.

Where Specifiction places it

Alternatives to CFRipperAll alternatives →