cfn-nag vs CIS-CAT Pro Assessor
cfn-nag
github.com
CIS-CAT Pro Assessor
cisecurity.orgSide by side
| Figure | cfn-nag | CIS-CAT Pro Assessor |
|---|---|---|
| Price from | Free | $200/mo |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | — | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 12 |
| Spec score · Infrastructure Testing Tools | 8.0 (#9) | 9.3 (#2) |
| Purpose | cfn-nag scans CloudFormation templates for patterns that may indicate insecure infrastructure. | CIS-CAT Pro Assessor scans systems and reports their compliance with CIS Benchmarks. |
| Support | The project directs users to submit bug reports and feature requests through its GitHub issue tracker. | CIS SecureSuite membership includes technical product support, and the product page says dedicated Member Success Managers and enhanced technical support are available. |
Plans
CIS-CAT Pro Assessor
- CIS-CAT LiteFree
- CIS SecureSuite End User Membership (up to 99 employees)$2,400 a year
- CIS SecureSuite End User (up to 99 employees)$2,400 a year
- CIS SecureSuite Controls Membership$3,600 a year
- CIS SecureSuite End User (100–499 employees)$5,500 a year
- CIS SecureSuite End User Membership (100–499 employees)$5,500 a year
- CIS SecureSuite End User (500–999 employees)$7,900 a year
- CIS SecureSuite End User Membership (500–999 employees)$7,900 a year
- CIS SecureSuite End User Membership (1,000–4,999 employees)$10,900 a year
- CIS SecureSuite End User Membership (5,000–24,999 employees)$12,800 a year
In their own words
cfn-nag
cfn-nag is free, MIT-licensed software that scans AWS CloudFormation templates for patterns that may indicate insecure infrastructure. It checks for overly permissive IAM policies and security-group rules, disabled access logging or encryption, and password literals. The scanner accepts JSON, .template, YAML, and YML files, and recursively processes subdirectories when given a directory. Results print to standard output, with JSON output available; failures return a non-zero exit code while warnings return success. Installation is documented through RubyGems and Homebrew, with Ruby 2.5 or later required for gem installation. A Dockerfile and Docker Hub image are provided. cfn-nag can run in GitHub Actions and AWS CodePipeline. Profiles, deny lists, per-resource suppressions, and custom rules support policy tailoring. Static analysis needs supplied parameter values to assess them and does not inspect false Fn::If outcomes by default.
CIS-CAT Pro Assessor
CIS-CAT Pro Assessor has no write-up on Specifiction yet; its figures are above.