No. 11 of 27 ·Infrastructure Testing Tools

cfn-nag

Mac · Linux · Self-hosted

Freedom report

Two barsScore 6.4

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely2 of 6 device platforms
DocumentedPlans, terms and facts published

cfn-nag is ranked #11 of 27 in infrastructure testing tools on Freedom251. It runs on Linux, macOS, Self-hosted. There is a free plan.

cfn-nag plans and pricing

All plans

cfn-nag Free MIT-licensed software · Ruby >= 2.5 github.com · 3 Oct 2026

Compared on infrastructure testing tools

Free plan: Yes
Terraform analysis: No
Kubernetes analysis: No
CloudFormation analysis: Yes
Custom policies: Yes
Secrets detection: Yes

Best cfn-nag alternatives

See all 20

Two bars AWS CloudFormation Free tier No. 1Free6.6 Two bars Conftest Free tier No. 2Free6.6 Two bars cfn-lint Free tier No. 3Free6.5 Two bars Chef InSpec Free tier No. 4Free6.5 Two bars Cinc Auditor Free tier No. 5Free6.5 Two bars KICS Free tier No. 6Free6.5

The record

Purpose: cfn-nag scans CloudFormation templates for patterns that may indicate insecure infrastructure.
Checks: The project lists checks for overly permissive IAM and security group rules, disabled access logs or encryption, and password literals.
Install: The project documents installation with RubyGems and Homebrew, and requires Ruby 2.5 or later for gem installation.
Template inputs: The scanner processes JSON, .template, YAML, and YML files and recursively scans subdirectories when given a directory.
Output: Results go to standard output; JSON output is available, and failures return a non-zero exit code while warnings return success.
Docker: A Dockerfile is provided, and the project says its image is published as stelligent/cfn_nag on Docker Hub.
Integrations: The project documents running cfn-nag in GitHub Actions workflows and deploying it in AWS CodePipeline through the AWS Serverless Application Repository.
Rule customization: Users can filter checks with profiles and deny lists, suppress rules per resource, and develop custom rules distributed as gems or loaded from S3.
Template analysis limit: Static analysis cannot see parameter values supplied at deployment unless users provide those values through a JSON file.
Conditional analysis limit: By default, cfn-nag substitutes the true outcome for Fn::If, so rules do not inspect false outcomes unless condition values are provided.
Offline use: The gem specification describes cfn-nag as a static analysis tool that must work without network connectivity, while noting S3 rule retrieval is optional.
License: The project uses the MIT License, which grants permission to use, copy, modify, merge, publish, distribute, sublicense, and sell the software subject to its terms.
Support: The project directs users to submit bug reports and feature requests through its GitHub issue tracker.
Price from: Free

Where it ranks on Freedom251

Best Infrastructure Testing Tools in 2026#11 of 27
Best Infrastructure as Code Security Software in 2026#11 of 22

Is cfn-nag yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote cfn-nag

Sources

github.com/stelligent/cfn_nag· checked 3 Oct 2026
github.com/stelligent/cfn_nag/blob/master/cfn-nag.· checked 3 Oct 2026
github.com/stelligent/cfn_nag/blob/master/LICENSE.· checked 3 Oct 2026