c7n-left

6.3easy start · #14 of 22
in Infrastructure as Code Security Software

Free to practise onnot on record
Free trialnot on record
Well documentedyes
Runs where you workyes

Runs on Linux, Mac, self-hosted, Windows.

c7n-left is ranked #14 of 22 in infrastructure as code security software on The Geeks Club. It runs on Linux, macOS, Self-hosted, Windows.

Compared on infrastructure as code security software

Free plan: Yes
Terraform analysis: Yes
Custom policies: Yes
Pull request scanning: Yes

Best c7n-left alternatives

See all 12

KloudSec IaC Security 0 of 4 in the starter kit Lesson 17.9 Aikido CSPM 0 of 4 in the starter kit Lesson 27.4 Conftest 0 of 4 in the starter kit Lesson 37.4 Snyk Open Source 0 of 4 in the starter kit Lesson 47.4 Kubescape 0 of 4 in the starter kit Lesson 57.2 audytx 0 of 4 in the starter kit Lesson 67.1

The record

Purpose: c7n-left evaluates Cloud Custodian policies directly against infrastructure-as-code source assets.
Install: The package can be installed with `pip install c7n-left`.
Supported environments: The package supports Python versions above 3.10 on macOS and Linux; the documentation recommends Docker images for Windows.
Docker security: The project provides signed Docker images based on Chainguard’s Wolfi Linux, and documents signature verification with cosign.
IaC input: c7n-left evaluates Terraform root modules, and remote module dependencies must be fetched with Terraform before running it.
CI integration: Its GitHub output mode reports annotations directly into pull requests.
Policy controls: Command-line filters can select policies and resources by name, category, minimum severity, resource type, or ID.
Policy language: Policies support standard Custodian filters, multiple resource types, taggable-resource filtering, and multi-hop resource graph traversal.
Provider coverage: The taggable filter supports Terraform resources from AWS, Azure, GCP, OCI, and Tencent Cloud providers.
Policy tests: c7n-left supports policy tests using Terraform files and YAML or JSON assertion plans.
Default failure behavior: Policy matches cause the run to exit with code 1 by default, while `--warn-on` can make selected matches log as warnings instead.
CLI stability: The documentation warns that the command-line interface is subject to change.
Project and audience: Cloud Custodian is an open-source rules engine for managing public cloud accounts and resources, with policies for security, compliance, tagging, and cost management.
Policy checks: Policies can check Terraform resources using Custodian filters, including tag checks and multi-hop resource traversal.

Where it ranks on The Geeks Club

Best Infrastructure as Code Security Software in 2026#14 of 22

Is c7n-left yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote c7n-left

Sources

cloudcustodian.io/docs/tools/c7n-left.html· checked 3 Oct 2026
cloudcustodian.io/docs/· checked 3 Oct 2026
cloudcustodian.io· checked 3 Oct 2026