cfn-lint

cfn-lint is a free validator for AWS CloudFormation templates and AWS SAM. It is a strong fit for teams that want configurable checks before deployment, but it is not a substitute for testing deployed infrastructure.

Overview

The linter checks CloudFormation YAML and JSON against resource provider schemas, valid property values, and best-practice rules. That focused scope makes it useful for catching template issues in development and CI/CD workflows. Its validation of complex values is best effort: it does not fail merely because it cannot interpret or translate one, so a clean result is not proof that every expression has been evaluated.

For AWS infrastructure work, cfn-lint also supports policy as code, policy testing, policy reporting, and configuration compliance. Its declared scope does not include provisioning tests, checks against deployed resources, or runtime enforcement.

Key features

• Rule-based checks: Built-in rules cover specific validations, and custom rules let teams express their own standards. That flexibility helps tailor checks, though teams must define and maintain any organization-specific rules themselves.
• Configuration choices: Command-line options, configuration files, and CloudFormation template metadata provide several ways to control behavior, suiting both one-off use and repeatable workflows.
• AWS SAM support: SAM templates are transformed with AWS SAM before processing, extending the linter beyond plain CloudFormation templates.
• Multiple outputs and integrations: Quiet, parseable, JSON, JUnit, pretty, and SARIF outputs support different reporting workflows. Editor integrations cover Atom, Emacs, NeoVim/Vim, Sublime, Visual Studio Code, and IntelliJ IDEA; a GitHub Action and pre-commit hook help bring checks into routine development.
• Installation and runtime: Installation is documented through pip, Homebrew on macOS, or Docker. Python 3.10 through 3.14 are supported.

Pricing

cfn-lint is free: its plan costs nothing. The project identifies the repository license as MIT No Attribution, allowing use, copying, modification, distribution, sublicensing, and sale without restriction. There is no paid tier to trade off against the free plan, making it suitable for individual developers and teams that need template validation without a software charge.

Platforms

cfn-lint supports Linux, macOS, Windows, and self-hosted use. The documented pip, Homebrew, and Docker installation routes give teams options for developer machines and controlled environments.

Who it's for

Choose cfn-lint if your work centers on AWS CloudFormation or SAM templates and you want schema- and rule-based checks that can be configured and incorporated into editor, pre-commit, or CI/CD workflows. Look elsewhere if the requirement is to test provisioning outcomes, inspect deployed resources, or enforce policies at runtime; those are outside its stated capabilities.

Pros and cons

• Pro: Custom rules and several configuration mechanisms let teams adapt validation to their standards.
• Pro: Multiple structured and human-readable output formats, plus editor and CI integrations, make it practical to fit checks into existing workflows.
• Pro: The free plan and permissive license remove a software purchase barrier for teams that want to use or adapt the tool.
• Con: Complex values receive best-effort validation, so findings cannot establish that every template expression is understood.
• Con: Its template-focused scope leaves provisioning tests, deployed checks, and runtime enforcement to other tools or processes.

Alternatives

AWS CloudFormation is the direct choice for readers seeking AWS's CloudFormation service rather than a separate template linter; the service itself is free, while underlying AWS resources are billed at their own rates.

Conftest is another free, cross-platform option for readers comparing open-source policy testing tools.

Chef InSpec may suit readers looking for a freemium option with a free trial and support across API, Linux, macOS, self-hosted, and Windows environments.

Cinc Auditor is a free alternative for readers considering a free distribution of Chef InSpec, with no formal warranties or support.

KICS is a free option for readers comparing infrastructure policy-as-code tools across Linux, macOS, self-hosted, and Windows.

kubeconform is a free alternative for readers whose selection criteria include Linux, macOS, self-hosted, and Windows support.

OpenSCAP is a free, open-source option for readers evaluating tools under the OpenSCAP umbrella.

Serverspec is a free open-source Ruby gem for readers considering a Ruby-based alternative.

Browse Infrastructure Testing Tools or Infrastructure Policy as Code Tools for more options in those categories.

Verdict

cfn-lint is the right choice for AWS-focused teams that need free, configurable validation of CloudFormation and SAM templates with useful editor and CI/CD integration. Choose it for early template checks; look elsewhere or add complementary tooling when you need proof from provisioning, checks on deployed infrastructure, or runtime enforcement.