cfn-nag vs Cinc Auditor

cfn-nag is free, MIT-licensed software that scans AWS CloudFormation templates for patterns that may indicate insecure infrastructure. It checks for overly permissive IAM policies and security-group rules, disabled access logging or encryption, and password literals. The scanner accepts JSON, .template, YAML, and YML files, and recursively processes subdirectories when given a directory. Results print to standard output, with JSON output available; failures return a non-zero exit code while warnings return success. Installation is documented through RubyGems and Homebrew, with Ruby 2.5 or later required for gem installation. A Dockerfile and Docker Hub image are provided. cfn-nag can run in GitHub Actions and AWS CodePipeline. Profiles, deny lists, per-resource suppressions, and custom rules support policy tailoring. Static analysis needs supplied parameter values to assess them and does not inspect false Fn::If outcomes by default.

Cinc Auditor is a free distribution of Chef InSpec for compliance and audit workflows on Linux, macOS, and Windows. Its profiles are fully compatible with upstream counterparts, and its tools work with InSpec; an InSpec wrapper redirects to Cinc Auditor so existing automation can keep working. Installation options include scripts, Bundler, RubyGems, and plain packages. Cinc also publishes a Docker Hub image as a drop-in replacement for chef/inspec. It can run InSpec-compatible profiles in CI or against containers, with GitLab CI and GitHub Actions named as examples. Auditor is included in Cinc Workstation. Cinc says its binaries use the Apache 2.0 license without additional EULAs or licensing. The project does not provide formal warranties or support, and it does not currently offer repositories for standard package managers such as yum or apt. The free plan costs nothing. Cinc recommends contacting Progress for warranty or support needs.