cfn-nag vs Checkov
cfn-nag
github.comCheckov
checkov.ioSide by side
| Figure | cfn-nag | Checkov |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Self-hosted | Yes | — |
| Plans published | 1 | 1 |
| Spec score · Infrastructure Testing Tools | 8.0 (#9) | 8.0 (#10) |
| Spec score · IaC Security Scanners | 8.0 (#7) | 7.9 (#8) |
| Spec score · Infrastructure as Code Security Software | 7.9 (#14) | 7.8 (#15) |
| License | The project uses the MIT License, which grants permission to use, copy, modify, merge, publish, distribute, sublicense, and sell the software subject to its terms. | The Checkov GitHub repository identifies its license as Apache-2.0. |
| Purpose | cfn-nag scans CloudFormation templates for patterns that may indicate insecure infrastructure. | Checkov scans infrastructure-as-code files for misconfigurations that can cause security or compliance problems. |
| Support | The project directs users to submit bug reports and feature requests through its GitHub issue tracker. | The project directs users to its documentation for tutorials and examples and identifies Prisma Cloud as the maintainer. |
Plans
In their own words
cfn-nag
cfn-nag is free, MIT-licensed software that scans AWS CloudFormation templates for patterns that may indicate insecure infrastructure. It checks for overly permissive IAM policies and security-group rules, disabled access logging or encryption, and password literals. The scanner accepts JSON, .template, YAML, and YML files, and recursively processes subdirectories when given a directory. Results print to standard output, with JSON output available; failures return a non-zero exit code while warnings return success. Installation is documented through RubyGems and Homebrew, with Ruby 2.5 or later required for gem installation. A Dockerfile and Docker Hub image are provided. cfn-nag can run in GitHub Actions and AWS CodePipeline. Profiles, deny lists, per-resource suppressions, and custom rules support policy tailoring. Static analysis needs supplied parameter values to assess them and does not inspect false Fn::If outcomes by default.
Checkov
Checkov is a free tool for scanning infrastructure-as-code files for configuration problems that could affect security or compliance. Its documented targets include Terraform, CloudFormation, ARM, Serverless, Helm, Kubernetes, and Docker. The policy library contains more than 750 predefined checks, including checks for standards such as CIS and the AWS Foundations Benchmark. Checkov can also identify common credentials in IaC files, including AWS access keys, Azure service credentials, and private keys. Teams can create custom attribute policies in Python or YAML and composite policies in YAML. Documented continuous-integration integrations include Jenkins, Bitbucket Cloud Pipelines, GitHub Actions, and GitLab CI. Add-ons for Visual Studio Code and JetBrains provide real-time scanning and inline fixes. Installation is documented through pip and Homebrew, with Homebrew specified for macOS or Linux. The project supports Python 3.9 through 3.13 and is distributed under the Apache-2.0 license. Prisma Cloud extends Checkov with runtime scanning, visibility, native VCS integrations, drift detection, and pull request annotations. Alpine is not officially tested or supported; it requires Python 3.11 or later.