CFRipper vs Conftest

CFRipper is a free, open-source Python library and command-line security analyzer for AWS CloudFormation templates. It examines template files to help keep vulnerable infrastructure from reaching production. The CLI accepts templates as arguments and can return text or JSON findings, with an option to save results in an output folder. Example findings include wildcard principals and IAM role policies that grant excessive permissions. Rules can be configured with a rules file and filters folder, and users can add plugins for their own compliance checks. Documented exit codes distinguish successful scans, scanning errors, invalid templates, and unhandled exceptions. CFRipper runs on Linux, macOS, Windows, or as self-hosted software. The project uses uv for dependencies, provides installation instructions for those operating systems, and is distributed under the Apache License 2.0. Its analysis scope is CloudFormation; Terraform and Kubernetes are not supported.

Conftest is a free utility for testing structured configuration data, designed for use in CI environments. It uses the Open Policy Agent Rego language to express policies, then evaluates deny, violation, and warning rules within namespaces. Configuration can be read from individual files, directories, multiple files, or standard input. Supported inputs include Kubernetes-style YAML, JSON, HCL and HCL2, Dockerfiles, Terraform-related data, JSONnet, TOML, and XML. Results can be output as plaintext, JSON, TAP, table, JUnit, GitHub, Azure DevOps, or SARIF; the GitHub outputter can annotate test results in workflows. The `conftest verify` command runs policy unit tests. Policies can be pulled from HTTPS URLs, Git repositories, and OCI registries, or pushed to compatible OCI registries. Plugins extend the CLI, with downloads available from sources including OCI, Git, HTTP/HTTPS, Mercurial, and cloud storage. Pre-commit hooks support policy workflows, and integrations are documented for CircleCI, GitHub Actions, and Tekton. Conftest is available for Linux, macOS, and Windows.