cfn-nag
A linter for AWS CloudFormation templates.
Overview
cfn-nag is an open-source command-line tool that performs static analysis on AWS CloudFormation templates to find security vulnerabilities. It looks for insecure patterns, such as IAM rules that are too permissive, security groups that are open to the world, and unencrypted resources. It provides specific, actionable feedback on potential security risks.
✨ Key Features
- Scans CloudFormation templates for security vulnerabilities
- Focuses on identifying insecure configurations
- Provides failing and warning violation levels
- Can be extended with custom rules
- Simple CLI interface
🎯 Key Differentiators
- Purely focused on security patterns in CloudFormation
- Simple, direct, and easy to interpret results
- Lightweight and fast
Unique Value: Provides fast, simple, and security-focused static analysis specifically for AWS CloudFormation templates.
🎯 Use Cases (3)
✅ Best For
- Security-focused static analysis of CloudFormation templates.
💡 Check With Vendor
Verify these considerations match your specific requirements:
- General-purpose linting (cfn-lint is better for this)
- Scanning non-CloudFormation IaC
🏆 Alternatives
While cfn-lint focuses on whether a template is valid, cfn-nag focuses on whether it is secure. The two are highly complementary. Compared to Checkov, it is less broad but simpler and faster for CloudFormation-only workflows.
💻 Platforms
✅ Offline Mode Available
🔌 Integrations
💰 Pricing
Free tier: Fully open-source and free.
🔄 Similar Tools in Pre-Commit IaC Scanning
Checkov
Open-source IaC scanner that finds misconfigurations in Terraform, CloudFormation, Kubernetes, and m...
Terrascan
Open-source static code analyzer for IaC that helps detect security issues and compliance violations...
KICS
Open-source IaC scanner from Checkmarx that supports a wide range of platforms and offers extensive ...
Trivy
Versatile open-source security scanner from Aqua Security that finds vulnerabilities, IaC misconfigu...
tfsec
A fast, open-source static analysis scanner for Terraform code to find security misconfigurations....
Prisma Cloud
A comprehensive Cloud Native Application Protection Platform (CNAPP)....