cfn-nag

What cfn-nag is

cfn-nag is a free static analyzer for AWS CloudFormation templates. It checks for configuration patterns that can point to insecure infrastructure, including broad IAM permissions, permissive security group rules, disabled access logs or encryption, and password literals. It accepts JSON, .template, YAML, and YML files, and scans nested directories when given a directory. Findings print to standard output, with JSON output available; failures produce a non-zero exit code, while warnings return success.

The project documents installation through RubyGems or Homebrew. Gem installation requires Ruby 2.5 or later, and a Dockerfile and published Docker Hub image are also provided. cfn-nag can be run in GitHub Actions and deployed in AWS CodePipeline through the AWS Serverless Application Repository. Teams can choose checks using profiles and deny lists, suppress rules for specific resources, and add custom rules distributed as gems or loaded from S3. The tool is MIT-licensed and is designed to work offline; S3 rule retrieval is optional. Its static analysis cannot account for deployment parameter values unless users pass them in a JSON file. By default, Fn::If analysis uses the true outcome, so inspecting false outcomes requires condition values.

Who it suits

cfn-nag suits teams that review AWS CloudFormation templates and want configurable checks for common security patterns. It can fit workflows using GitHub Actions or AWS CodePipeline, and it can run locally or in Docker.

Limits

Static analysis cannot see deployment-supplied parameter values unless they are provided through a JSON file. By default, Fn::If analysis substitutes the true outcome; condition values are needed to inspect false outcomes.

Getting started

1. Open the cfn-nag project on GitHub.
2. Install through RubyGems with Ruby 2.5 or later, or use Homebrew.
3. Alternatively, use the provided Dockerfile or the stelligent/cfn_nag Docker Hub image.
4. Run the scanner on JSON, .template, YAML, or YML files, or provide a directory to scan recursively.
5. For CI, follow the project guidance for GitHub Actions or AWS CodePipeline.

Verdict

Choose cfn-nag if your team needs a free, customizable scanner focused on CloudFormation security patterns, including use in GitHub Actions or AWS CodePipeline. Look elsewhere if you need Terraform or Kubernetes analysis, or if you need static analysis to infer deployment parameters without supplying them.