cfn-nag vs Kubetest2
cfn-nag
github.comKubetest2
github.comSide by side
| Figure | cfn-nag | Kubetest2 |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| macOS | Yes | — |
| Linux | Yes | — |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Infrastructure Testing Tools | 8.0 (#9) | 8.2 (#6) |
| Install | The project documents installation with RubyGems and Homebrew, and requires Ruby 2.5 or later for gem installation. | The README provides Go install commands for Kubetest2, reference deployers, and testers. |
| License | The project uses the MIT License, which grants permission to use, copy, modify, merge, publish, distribute, sublicense, and sell the software subject to its terms. | The GitHub repository identifies Apache-2.0 as its license. |
| Purpose | cfn-nag scans CloudFormation templates for patterns that may indicate insecure infrastructure. | Kubetest2 is a framework for deploying Kubernetes clusters and running end-to-end tests against them. |
Plans
In their own words
cfn-nag
cfn-nag is free, MIT-licensed software that scans AWS CloudFormation templates for patterns that may indicate insecure infrastructure. It checks for overly permissive IAM policies and security-group rules, disabled access logging or encryption, and password literals. The scanner accepts JSON, .template, YAML, and YML files, and recursively processes subdirectories when given a directory. Results print to standard output, with JSON output available; failures return a non-zero exit code while warnings return success. Installation is documented through RubyGems and Homebrew, with Ruby 2.5 or later required for gem installation. A Dockerfile and Docker Hub image are provided. cfn-nag can run in GitHub Actions and AWS CodePipeline. Profiles, deny lists, per-resource suppressions, and custom rules support policy tailoring. Static analysis needs supplied parameter values to assess them and does not inspect false Fn::If outcomes by default.