No. 14 of 22 ·Infrastructure as Code Security Software

c7n-left

Windows · Mac · Linux · Self-hosted

Freedom report

Two barsScore 5.6

Free tierNo free tier on record
Open codeNo open-source code on record
Runs widely3 of 6 device platforms
DocumentedPlans, terms and facts published

c7n-left is ranked #14 of 22 in infrastructure as code security software on Freedom251. It runs on Linux, macOS, Self-hosted, Windows.

Compared on infrastructure as code security software

Free plan: Yes
Terraform analysis: Yes
Custom policies: Yes
Pull request scanning: Yes

Best c7n-left alternatives

See all 20

Two bars Snyk Open Source Free tier No. 1$25/mo6.7 Two bars Aikido CSPM Free tier No. 2$300/mo6.6 Two bars AWS CloudFormation Free tier No. 3Free6.6 Two bars Conftest Free tier No. 4Free6.6 Two bars KloudSec IaC Security Free tier No. 5$79/mo6.6 Two bars Trivy Free tier No. 6Free6.6

The record

Purpose: c7n-left evaluates Cloud Custodian policies directly against infrastructure-as-code source assets.
Install: The package can be installed with `pip install c7n-left`.
Supported environments: The package supports Python versions above 3.10 on macOS and Linux; the documentation recommends Docker images for Windows.
Docker security: The project provides signed Docker images based on Chainguard’s Wolfi Linux, and documents signature verification with cosign.
IaC input: c7n-left evaluates Terraform root modules, and remote module dependencies must be fetched with Terraform before running it.
CI integration: Its GitHub output mode reports annotations directly into pull requests.
Policy controls: Command-line filters can select policies and resources by name, category, minimum severity, resource type, or ID.
Policy language: Policies support standard Custodian filters, multiple resource types, taggable-resource filtering, and multi-hop resource graph traversal.
Provider coverage: The taggable filter supports Terraform resources from AWS, Azure, GCP, OCI, and Tencent Cloud providers.
Policy tests: c7n-left supports policy tests using Terraform files and YAML or JSON assertion plans.
Default failure behavior: Policy matches cause the run to exit with code 1 by default, while `--warn-on` can make selected matches log as warnings instead.
CLI stability: The documentation warns that the command-line interface is subject to change.
Project and audience: Cloud Custodian is an open-source rules engine for managing public cloud accounts and resources, with policies for security, compliance, tagging, and cost management.
Policy checks: Policies can check Terraform resources using Custodian filters, including tag checks and multi-hop resource traversal.

Where it ranks on Freedom251

Best Infrastructure as Code Security Software in 2026#14 of 22

Is c7n-left yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote c7n-left

Sources

cloudcustodian.io/docs/tools/c7n-left.html· checked 3 Oct 2026
cloudcustodian.io/docs/· checked 3 Oct 2026
cloudcustodian.io· checked 3 Oct 2026