cfn-nag

6.7easy start · #15 of 27
in Infrastructure Testing Tools

Free to practise onyes
Free trialnot on record
Well documentedyes
Runs where you worknot on record

Runs on Linux, Mac, self-hosted.

cfn-nag is ranked #15 of 27 in infrastructure testing tools on The Geeks Club. It runs on Linux, macOS, Self-hosted. There is a free plan.

cfn-nag plans and pricing

All plans

cfn-nag Free MIT-licensed software · Ruby >= 2.5 github.com · 3 Oct 2026

Compared on infrastructure testing tools

Free plan: Yes
Terraform analysis: No
Kubernetes analysis: No
CloudFormation analysis: Yes
Custom policies: Yes
Secrets detection: Yes

Best cfn-nag alternatives

See all 12

Chef InSpec 0 of 4 in the starter kit Lesson 17.7 Conftest 0 of 4 in the starter kit Lesson 27.3 Test Kitchen 0 of 4 in the starter kit Lesson 37.2 kubeconform 0 of 4 in the starter kit Lesson 47.1 Terratest 0 of 4 in the starter kit Lesson 57.1 AWS CloudFormation 0 of 4 in the starter kit Lesson 66.9

The record

Purpose: cfn-nag scans CloudFormation templates for patterns that may indicate insecure infrastructure.
Checks: The project lists checks for overly permissive IAM and security group rules, disabled access logs or encryption, and password literals.
Install: The project documents installation with RubyGems and Homebrew, and requires Ruby 2.5 or later for gem installation.
Template inputs: The scanner processes JSON, .template, YAML, and YML files and recursively scans subdirectories when given a directory.
Output: Results go to standard output; JSON output is available, and failures return a non-zero exit code while warnings return success.
Docker: A Dockerfile is provided, and the project says its image is published as stelligent/cfn_nag on Docker Hub.
Integrations: The project documents running cfn-nag in GitHub Actions workflows and deploying it in AWS CodePipeline through the AWS Serverless Application Repository.
Rule customization: Users can filter checks with profiles and deny lists, suppress rules per resource, and develop custom rules distributed as gems or loaded from S3.
Template analysis limit: Static analysis cannot see parameter values supplied at deployment unless users provide those values through a JSON file.
Conditional analysis limit: By default, cfn-nag substitutes the true outcome for Fn::If, so rules do not inspect false outcomes unless condition values are provided.
Offline use: The gem specification describes cfn-nag as a static analysis tool that must work without network connectivity, while noting S3 rule retrieval is optional.
License: The project uses the MIT License, which grants permission to use, copy, modify, merge, publish, distribute, sublicense, and sell the software subject to its terms.
Support: The project directs users to submit bug reports and feature requests through its GitHub issue tracker.
Price from: Free

Where it ranks on The Geeks Club

Best Infrastructure Testing Tools in 2026#15 of 27
Best Infrastructure as Code Security Software in 2026#12 of 22

Is cfn-nag yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote cfn-nag

Sources

github.com/stelligent/cfn_nag· checked 3 Oct 2026
github.com/stelligent/cfn_nag/blob/master/cfn-nag.· checked 3 Oct 2026
github.com/stelligent/cfn_nag/blob/master/LICENSE.· checked 3 Oct 2026