Freedom251 › Infrastructure as Code Security Software
CFRipper
What CFRipper is
CFRipper is a Python library and command-line security analyzer for AWS CloudFormation templates. It aims to help keep vulnerable infrastructure from reaching production. The CLI accepts template files and can return text or JSON results, with an option to save output to a folder. Example findings include wildcard principals and IAM role policies that are too permissive. Users can create compliance checks with custom plugins, and configure rules using a config file and filters folder. Documented exit codes distinguish valid scans, scanning errors, invalid templates and unhandled exceptions. The project provides installation instructions for macOS, Linux and Windows, and is distributed under the Apache License 2.0. Its scope is CloudFormation: Terraform and Kubernetes analysis are not supported. The repository describes uv for dependency management and lists commands for linting, coverage, tests and installing runtime or development dependencies. Some rules draw inspiration from cfn-nag, and its example scripts are used in test cases. The listed plan is free.
Who it suits
CFRipper suits people who analyze AWS CloudFormation templates and want to configure their own compliance checks. It is not suited to Terraform or Kubernetes analysis, which are not supported.
What it does well
- Analyzes AWS CloudFormation templates
- Custom plugins allow user-written compliance checks
- Results can be returned as text or JSON
- Installation guidance covers macOS, Linux and Windows
- Apache License 2.0
What to know first
- Does not analyze Terraform
- Does not analyze Kubernetes
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| CFRipper | Apache-2.0 licensed software · CloudFormation templates | Free |
| Free | AWS CloudFormation templates · CLI and Python library · custom compliance plugins | Free |
As github.com lists them, read 8 Oct 2026. The maker's own page has the final word.
Getting started
- Open the CFRipper repository at https://github.com/Skyscanner/cfripper.
- Follow the repository's installation instructions for macOS, Linux, or Windows.
- Install runtime dependencies using the documented setup.
- Pass CloudFormation template files to the CLI for analysis.
- Choose text or JSON output and optionally save results to an output folder.
- Configure rules with a rules config file or filters folder, or add custom plugins.
Verdict
CFRipper focuses on CloudFormation analysis, with configurable rules, custom plugins and text or JSON output. Its listed scope excludes Terraform and Kubernetes.
Questions
How much does CFRipper cost?
CFRipper is free. Its listed plan costs nothing and is Apache-2.0 licensed.
What does CFRipper analyze?
It analyzes AWS CloudFormation templates. Terraform and Kubernetes analysis are not supported.
Which operating systems are supported?
Installation instructions are provided for macOS, Linux, and Windows.
Can I add my own checks?
Yes. Users can write compliance checks by adding custom plugins.
What output formats does the CLI support?
Documented examples show text and JSON output, with an option to save results to an output folder.
What license does CFRipper use?
The project is distributed under the Apache License 2.0.
Facts from CFRipper's own pages
- Attribution
- The documentation says some CFRipper rules were inspired by cfn-nag and its example scripts are used in test cases. · cfripper.readthedocs.io, 8 Oct 2026
- Built-in security checks
- Documented examples include detection of wildcard principals and overprivileged IAM role permissions. · github.com, 21 Oct 2026
- Changelog compatibility
- The changelog records Python 3.14 support in version 1.19 and removal of Python 3.9 support in version 1.18. · github.com, 21 Oct 2026
- Custom checks
- Users can add their own compliance checks through custom plugins. · github.com, 21 Oct 2026
- Development checks
- The documentation lists commands for linting, coverage, tests, and installing runtime or development dependencies. · cfripper.readthedocs.io, 8 Oct 2026
- Documentation
- The README links to a dedicated Read the Docs documentation site. · github.com, 21 Oct 2026
- Dynamic extensibility
- The changelog says version 1.0 introduced pluggy-based dynamic rule loading and external filter files. · github.com, 21 Oct 2026
- Exit codes
- The CLI documents separate codes for successful scans, scan errors, invalid templates, and unhandled exceptions. · pypi.org, 21 Oct 2026
- Findings
- Example findings include wildcard principals and overly permissive IAM role policies. · github.com, 8 Oct 2026
- Homebrew dependencies
- The Homebrew formula depends on libyaml, pydantic, and Python 3.14. · formulae.brew.sh, 21 Oct 2026
- Homebrew installation
- Homebrew provides installation through the command brew install cfripper. · formulae.brew.sh, 21 Oct 2026
- Homebrew platforms
- Homebrew supplies bottles for supported macOS Apple Silicon and Intel systems plus ARM64 and x86_64 Linux. · formulae.brew.sh, 21 Oct 2026
- Independent description
- CybersecTools describes CFRipper as a security analyzer for CloudFormation vulnerabilities and configuration errors before deployment. · cybersectools.com, 21 Oct 2026
- Independent extensibility praise
- CybersecTools highlights the plugin system, Python-library form, multiple output formats, and template resolution as capabilities. · cybersectools.com, 21 Oct 2026
- Independent listing price
- CybersecTools labels CFRipper as a free tool and says it is suitable for cost-conscious teams. · cybersectools.com, 21 Oct 2026
- Input
- The CLI accepts CloudFormation template files as arguments for analysis. · github.com, 8 Oct 2026
- Install and development
- The repository says it uses uv for dependency management and shows installation instructions for macOS, Linux, and Windows. · github.com, 8 Oct 2026
- Language
- The documentation describes CFRipper as a Python tool. · cfripper.readthedocs.io, 8 Oct 2026
- License
- The package and repository use the OSI-approved Apache License 2.0. · pypi.org, 21 Oct 2026
- Limit: independent reviews
- CybersecTools reports that CFRipper has no reviews yet. · cybersectools.com, 21 Oct 2026
- Limit: integrations
- CybersecTools does not name any integrations and displays the integration list as unavailable without sign-in. · cybersectools.com, 21 Oct 2026
- Limit: scope
- Independent CloudSecDocs catalogues CFRipper specifically in its CloudFormation security-tool section, while listing broader multi-framework coverage for alternatives. · cloudsecdocs.com, 21 Oct 2026
- Maintainers
- PyPI lists six verified maintainers, including the Skyscanner security group and individual contributors. · pypi.org, 21 Oct 2026
- Maker company size
- LinkedIn lists Skyscanner as privately held with 1,001–5,000 employees. · linkedin.com, 21 Oct 2026