cfn-nag vs Terratest

cfn-nag is free, MIT-licensed software that scans AWS CloudFormation templates for patterns that may indicate insecure infrastructure. It checks for overly permissive IAM policies and security-group rules, disabled access logging or encryption, and password literals. The scanner accepts JSON, .template, YAML, and YML files, and recursively processes subdirectories when given a directory. Results print to standard output, with JSON output available; failures return a non-zero exit code while warnings return success. Installation is documented through RubyGems and Homebrew, with Ruby 2.5 or later required for gem installation. A Dockerfile and Docker Hub image are provided. cfn-nag can run in GitHub Actions and AWS CodePipeline. Profiles, deny lists, per-resource suppressions, and custom rules support policy tailoring. Static analysis needs supplied parameter values to assess them and does not inspect false Fn::If outcomes by default.

Terratest is an open-source Go library for writing automated tests for infrastructure code. Its helpers cover Terraform, OpenTofu, Terragrunt, Packer, Helm, Docker, and Kubernetes, as well as AWS, Azure, and GCP APIs. Tests can run infrastructure tools, deploy real resources, validate the resulting environment, and remove resources afterward. Validation can use HTTP requests, API calls, SSH connections, and shell commands. The documentation covers unit, integration, and end-to-end tests, along with parallelism, retries, error handling, and static analysis. Terratest runs locally and supports configuration-compliance checks, provisioning tests, deployed checks, and policy as code. The project is free under the Apache 2.0 License. The quick start requires Go 1.26 or later and OpenTofu or Terraform for its examples. The documentation recommends cleaning up after tests because they may create resources in real environments. General questions and issue reports go through GitHub Discussions and Issues; Gruntwork offers commercial support to companies using Terratest in production. The v1 line receives security fixes only while v2 is in development.