cfn-nag vs Test Kitchen
cfn-nag
github.comTest Kitchen
kitchen.ciSide by side
| Figure | cfn-nag | Test Kitchen |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Windows | — | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Infrastructure Testing Tools | 8.0 (#9) | 8.2 (#7) |
| License | The project uses the MIT License, which grants permission to use, copy, modify, merge, publish, distribute, sublicense, and sell the software subject to its terms. | The project is released under the Apache License 2.0. |
| Purpose | cfn-nag scans CloudFormation templates for patterns that may indicate insecure infrastructure. | Test Kitchen is a test harness for executing infrastructure code on one or more platforms in isolation. |
| Support | The project directs users to submit bug reports and feature requests through its GitHub issue tracker. | The documentation directs users to the #test-kitchen channel on Chef Community Slack for assistance from community members. |
Plans
In their own words
cfn-nag
cfn-nag is free, MIT-licensed software that scans AWS CloudFormation templates for patterns that may indicate insecure infrastructure. It checks for overly permissive IAM policies and security-group rules, disabled access logging or encryption, and password literals. The scanner accepts JSON, .template, YAML, and YML files, and recursively processes subdirectories when given a directory. Results print to standard output, with JSON output available; failures return a non-zero exit code while warnings return success. Installation is documented through RubyGems and Homebrew, with Ruby 2.5 or later required for gem installation. A Dockerfile and Docker Hub image are provided. cfn-nag can run in GitHub Actions and AWS CodePipeline. Profiles, deny lists, per-resource suppressions, and custom rules support policy tailoring. Static analysis needs supplied parameter values to assess them and does not inspect false Fn::If outcomes by default.
Test Kitchen
Test Kitchen is a free test harness for running infrastructure code in isolation on one or more platforms. Its workflow uses create, converge, setup, verify, and destroy commands to provision environments and test infrastructure code. Documented drivers cover Amazon EC2, Apache CloudStack, DigitalOcean, Docker through Dokken, Google Cloud Platform, Hetzner Cloud, Vagrant, Azure, Hyper-V, OpenStack, and VMware products. Which drivers are available depends on the driver gems installed in the Ruby environment. Provisioning options include Chef Infra, Cinc Client, Habitat, PowerShell DSC, and shell scripts; listed verification integrations include Cinc Auditor, Chef InSpec, and Serverspec. Community plugins add Ansible, Puppet, and Salt provisioners. Installation is available through RubyGems, system packages, or Cinc Workstation, but Test Kitchen itself does not bundle Cinc or Chef tooling. Requirements include a 64-bit operating system and enabled CPU virtualization. The project uses Apache License 2.0 and points users to Chef Community Slack for community assistance. The documentation notes known issues and no current maintainer for kitchen-docker, recommending kitchen-dokken instead.