cfn-nag vs terraform-plugin-testing

cfn-nag is free, MIT-licensed software that scans AWS CloudFormation templates for patterns that may indicate insecure infrastructure. It checks for overly permissive IAM policies and security-group rules, disabled access logging or encryption, and password literals. The scanner accepts JSON, .template, YAML, and YML files, and recursively processes subdirectories when given a directory. Results print to standard output, with JSON output available; failures return a non-zero exit code while warnings return success. Installation is documented through RubyGems and Homebrew, with Ruby 2.5 or later required for gem installation. A Dockerfile and Docker Hub image are provided. cfn-nag can run in GitHub Actions and AWS CodePipeline. Profiles, deny lists, per-resource suppressions, and custom rules support policy tailoring. Static analysis needs supplied parameter values to assess them and does not inspect false Fn::If outcomes by default.

terraform-plugin-testing is a free Go helper module for testing Terraform providers on Linux and macOS. It supports unit tests that exercise plugin code in isolation without network connections, and acceptance tests that run real Terraform plan, apply, refresh, and destroy operations. Acceptance testing includes Lifecycle, Import, Refresh, and Query modes. The plancheck package can inspect empty or non-empty plans, resource and data source values, and actions. The statecheck package checks known values, sensitive values, and comparisons between resource or data source attributes. The framework uses a local Terraform binary with standard Go testing tools, including go test and the testing package, so tests can run in continuous integration environments such as GitHub Actions. Acceptance runs may create and destroy infrastructure, which can consume quotas and incur expenses. Prerequisites include a recent stable Go release, Terraform CLI 0.12.26 or later, provider and resource access, and TF_ACC set to a value. The project uses Mozilla Public License v2.0.