cfn-nag vs Serverspec

cfn-nag is free, MIT-licensed software that scans AWS CloudFormation templates for patterns that may indicate insecure infrastructure. It checks for overly permissive IAM policies and security-group rules, disabled access logging or encryption, and password literals. The scanner accepts JSON, .template, YAML, and YML files, and recursively processes subdirectories when given a directory. Results print to standard output, with JSON output available; failures return a non-zero exit code while warnings return success. Installation is documented through RubyGems and Homebrew, with Ruby 2.5 or later required for gem installation. A Dockerfile and Docker Hub image are provided. cfn-nag can run in GitHub Actions and AWS CodePipeline. Profiles, deny lists, per-resource suppressions, and custom rules support policy tailoring. Static analysis needs supplied parameter values to assess them and does not inspect false Fn::If outcomes by default.

Serverspec is an open-source Ruby gem for writing RSpec tests that verify server configuration. It examines actual machine state by executing commands locally or through SSH, WinRM, and the Docker API, without requiring agent software on target servers. Checks cover packages, services, files, ports, users, Docker containers and images, Windows features, and X.509 certificates and private keys. Both RSpec should and expect syntax are supported. Serverspec can accompany Puppet, Ansible, CFEngine, Itamae, and Chef, with infrastructure-code refactoring stated as its central aim. The tutorial names Linux distributions, macOS, Windows, BSD systems, Solaris, SmartOS, and others, while noting incomplete support for some. Each suite targets one machine or Docker container, so separate RSpec commands are advised for separate targets. Install through Bundler or gem install serverspec. It is MIT licensed and maintained by Gosuke Miyashita.