CFRipper vs DryRun Security IaC Security

CFRipper is a free, open-source Python library and command-line security analyzer for AWS CloudFormation templates. It examines template files to help keep vulnerable infrastructure from reaching production. The CLI accepts templates as arguments and can return text or JSON findings, with an option to save results in an output folder. Example findings include wildcard principals and IAM role policies that grant excessive permissions. Rules can be configured with a rules file and filters folder, and users can add plugins for their own compliance checks. Documented exit codes distinguish successful scans, scanning errors, invalid templates, and unhandled exceptions. CFRipper runs on Linux, macOS, Windows, or as self-hosted software. The project uses uv for dependencies, provides installation instructions for those operating systems, and is distributed under the Apache License 2.0. Its analysis scope is CloudFormation; Terraform and Kubernetes are not supported.

DryRun Security IaC Security scans infrastructure-as-code changes for security risks by analyzing infrastructure and application code together. It covers Terraform, Kubernetes, and other IaC, with checks for overly permissive IAM policies, publicly exposed resources, insecure defaults, and subdomain takeover risks. Scans run in pull requests and provide guidance during infrastructure design. Teams can write natural-language guardrails for public access, permitted cloud regions, approved resource types, and organization-specific requirements; the Custom Policy Agent enforces them on changes. Terraform findings can appear as pull-request comments and Risk Register entries containing the affected resource, risk description, and remediation guidance. Listed integrations include Claude Code, Claude Desktop, Codex, Cursor, GitHub, GitLab, and Slack. The SaaS service supports GitHub.com personal, organization, and Enterprise Cloud repositories, plus GitLab SaaS; custom instances and other source-control systems require contacting DryRun. DryRun says it uses private models, sends no data to public AI systems, stores minimal metadata and findings, and allows code-access revocation through repository permissions. Pricing is on request, aligned with team size, and a free trial is available.