CFRipper vs kube-score

CFRipper is a free, open-source Python library and command-line security analyzer for AWS CloudFormation templates. It examines template files to help keep vulnerable infrastructure from reaching production. The CLI accepts templates as arguments and can return text or JSON findings, with an option to save results in an output folder. Example findings include wildcard principals and IAM role policies that grant excessive permissions. Rules can be configured with a rules file and filters folder, and users can add plugins for their own compliance checks. Documented exit codes distinguish successful scans, scanning errors, invalid templates, and unhandled exceptions. CFRipper runs on Linux, macOS, Windows, or as self-hosted software. The project uses uv for dependencies, provides installation instructions for those operating systems, and is distributed under the Apache License 2.0. Its analysis scope is CloudFormation; Terraform and Kubernetes are not supported.

kube-score statically analyzes Kubernetes object definitions and recommends changes intended to improve application security and resilience. Its checks cover container limits, NetworkPolicy targeting, PodDisruptionBudget, Pod anti-affinity, container probes, security context, and stable APIs. Optional checks include matching resource requests and limits, container ports, and seccomp profile configuration. You can configure tests to be ignored or enabled globally or for individual objects. kube-score works with Helm, Kustomize, static YAML files, Docker, and resources retrieved from a Kubernetes cluster. Its browser demo accepts Kubernetes YAML or JSON and, according to the maker, processes it in the browser without sending data to a server. Local options include prebuilt binaries for Linux, macOS, and Windows, along with Docker, Homebrew, and Kubernetes Krew. Output formats include human-readable, JSON, CI, and SARIF. In CI/CD, critical errors return exit code 1; warnings can also be set as the exit threshold. The free, MIT-licensed project recommends analyzing all applications deployed to the same namespace together. Building from source requires Go 1.21 or later.