cfn-nag vs Chef InSpec

cfn-nag is free, MIT-licensed software that scans AWS CloudFormation templates for patterns that may indicate insecure infrastructure. It checks for overly permissive IAM policies and security-group rules, disabled access logging or encryption, and password literals. The scanner accepts JSON, .template, YAML, and YML files, and recursively processes subdirectories when given a directory. Results print to standard output, with JSON output available; failures return a non-zero exit code while warnings return success. Installation is documented through RubyGems and Homebrew, with Ruby 2.5 or later required for gem installation. A Dockerfile and Docker Hub image are provided. cfn-nag can run in GitHub Actions and AWS CodePipeline. Profiles, deny lists, per-resource suppressions, and custom rules support policy tailoring. Static analysis needs supplied parameter values to assess them and does not inspect false Fn::If outcomes by default.

Chef InSpec tests and audits applications and infrastructure against a desired state described in InSpec code. Its runtime framework and rule language express compliance, security and policy requirements. Reusable profiles group controls and can include versioning, platform requirements and dependencies. Resources support testing AWS, Azure, AliCloud and GCP infrastructure, and users can create custom resources. Tests can run locally or against cloud services and infrastructure such as Linux in Docker containers. Results can be exported as JSON, HTML or plain text, or sent to Chef Automate. The kitchen-inspec verifier also runs profiles through Test Kitchen. Chef offers premium CIS- and STIG-based profiles for compliance scanning. The free tier is for non-production workloads and personal, non-commercial use; the 30-day trial is for product evaluation under non-production conditions. Commercial licensing covers production and non-production workloads, with entitlements based on purchase order. Chef InSpec 7 requires EULA acceptance, and license-key requirements depend on the distribution source. Telemetry is enabled for free and trial tiers, but not commercial users.