cfn-lint vs cfn-nag
cfn-lint
github.comcfn-nag
github.comSide by side
| Figure | cfn-lint | cfn-nag |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | — |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Infrastructure Testing Tools | 8.1 (#8) | 8.0 (#9) |
| Integrations | The project lists editor integrations for Atom, Emacs, NeoVim/Vim, Sublime, Visual Studio Code, and IntelliJ IDEA, plus a GitHub Action and pre-commit hook. | The project documents running cfn-nag in GitHub Actions workflows and deploying it in AWS CodePipeline through the AWS Serverless Application Repository. |
| License | The repository identifies its license as MIT No Attribution, which grants use, copying, modification, distribution, sublicensing, and sale without restriction. | The project uses the MIT License, which grants permission to use, copy, modify, merge, publish, distribute, sublicense, and sell the software subject to its terms. |
| Output | Supported output formats include quiet, parseable, JSON, JUnit, pretty, and SARIF. | Results go to standard output; JSON output is available, and failures return a non-zero exit code while warnings return success. |
| Purpose | cfn-lint validates AWS CloudFormation YAML and JSON templates against resource provider schemas and additional checks, including valid property values and best practices. | cfn-nag scans CloudFormation templates for patterns that may indicate insecure infrastructure. |
| Support | The project invites users to join its Discord community to discuss cfn-lint and get help. | The project directs users to submit bug reports and feature requests through its GitHub issue tracker. |
Plans
In their own words
cfn-lint
cfn-lint is a free, open-source validator for AWS CloudFormation YAML and JSON templates. It checks templates against resource provider schemas and applies additional rules, including validation of property values and best practices. AWS Serverless Application Model templates are processed after transformation with AWS SAM. Users can configure built-in checks through command-line options, configuration files, or CloudFormation template metadata, and can add custom rules. Results can be emitted as quiet, parseable, JSON, JUnit, pretty, or SARIF output. Installation options documented by the project include pip, Homebrew for macOS, and Docker; supported Python versions are 3.10 through 3.14. Listed integrations include Atom, Emacs, NeoVim/Vim, Sublime, Visual Studio Code, IntelliJ IDEA, GitHub Actions, and pre-commit. The project treats complex template-value validation as best effort and does not fail merely because it cannot interpret or translate a value. The repository identifies its license as MIT No Attribution, and the plan costs nothing.
cfn-nag
cfn-nag is free, MIT-licensed software that scans AWS CloudFormation templates for patterns that may indicate insecure infrastructure. It checks for overly permissive IAM policies and security-group rules, disabled access logging or encryption, and password literals. The scanner accepts JSON, .template, YAML, and YML files, and recursively processes subdirectories when given a directory. Results print to standard output, with JSON output available; failures return a non-zero exit code while warnings return success. Installation is documented through RubyGems and Homebrew, with Ruby 2.5 or later required for gem installation. A Dockerfile and Docker Hub image are provided. cfn-nag can run in GitHub Actions and AWS CodePipeline. Profiles, deny lists, per-resource suppressions, and custom rules support policy tailoring. Static analysis needs supplied parameter values to assess them and does not inspect false Fn::If outcomes by default.