cfn-lint vs Checkov
cfn-lint
github.comCheckov
checkov.ioSide by side
| Figure | cfn-lint | Checkov |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | — |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Self-hosted | Yes | — |
| Plans published | 1 | 1 |
| Spec score · Infrastructure Testing Tools | 8.1 (#8) | 8.0 (#10) |
| Installation | The project documents installation with pip, Homebrew for macOS, or Docker. | The project documents installation through pip and Homebrew; Homebrew is specified for macOS or Linux. |
| License | The repository identifies its license as MIT No Attribution, which grants use, copying, modification, distribution, sublicensing, and sale without restriction. | The Checkov GitHub repository identifies its license as Apache-2.0. |
| Purpose | cfn-lint validates AWS CloudFormation YAML and JSON templates against resource provider schemas and additional checks, including valid property values and best practices. | Checkov scans infrastructure-as-code files for misconfigurations that can cause security or compliance problems. |
| Support | The project invites users to join its Discord community to discuss cfn-lint and get help. | The project directs users to its documentation for tutorials and examples and identifies Prisma Cloud as the maintainer. |
Plans
In their own words
cfn-lint
cfn-lint is a free, open-source validator for AWS CloudFormation YAML and JSON templates. It checks templates against resource provider schemas and applies additional rules, including validation of property values and best practices. AWS Serverless Application Model templates are processed after transformation with AWS SAM. Users can configure built-in checks through command-line options, configuration files, or CloudFormation template metadata, and can add custom rules. Results can be emitted as quiet, parseable, JSON, JUnit, pretty, or SARIF output. Installation options documented by the project include pip, Homebrew for macOS, and Docker; supported Python versions are 3.10 through 3.14. Listed integrations include Atom, Emacs, NeoVim/Vim, Sublime, Visual Studio Code, IntelliJ IDEA, GitHub Actions, and pre-commit. The project treats complex template-value validation as best effort and does not fail merely because it cannot interpret or translate a value. The repository identifies its license as MIT No Attribution, and the plan costs nothing.
Checkov
Checkov is a free tool for scanning infrastructure-as-code files for configuration problems that could affect security or compliance. Its documented targets include Terraform, CloudFormation, ARM, Serverless, Helm, Kubernetes, and Docker. The policy library contains more than 750 predefined checks, including checks for standards such as CIS and the AWS Foundations Benchmark. Checkov can also identify common credentials in IaC files, including AWS access keys, Azure service credentials, and private keys. Teams can create custom attribute policies in Python or YAML and composite policies in YAML. Documented continuous-integration integrations include Jenkins, Bitbucket Cloud Pipelines, GitHub Actions, and GitLab CI. Add-ons for Visual Studio Code and JetBrains provide real-time scanning and inline fixes. Installation is documented through pip and Homebrew, with Homebrew specified for macOS or Linux. The project supports Python 3.9 through 3.13 and is distributed under the Apache-2.0 license. Prisma Cloud extends Checkov with runtime scanning, visibility, native VCS integrations, drift detection, and pull request annotations. Alpine is not officially tested or supported; it requires Python 3.11 or later.