cdklabs/cdk-nag

Health v2 · maintenance only

Adoption not part of the score

1035 stars · 85 forks observed · 2026-09-01

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

cdk-nag is a library that checks AWS CDK applications and CloudFormation templates for best practices using pre-built rule packs such as AWS Solutions, HIPAA Security, NIST 800-53, PCI DSS, and Serverless. It reports rule violations during synthesis and allows developers to acknowledge or suppress specific findings on constructs.

Use cases

• check my CDK app for security best practices
• scan CloudFormation templates for compliance violations
• enforce HIPAA or PCI DSS rules on infrastructure code
• suppress known rule violations on specific CDK constructs
• create custom rule packs for organizational standards
• audit IaC against NIST 800-53 controls

When to choose

• you use AWS CDK or CloudFormation and want automated compliance and best-practice checks
• you need to enforce regulatory rule packs like HIPAA, PCI DSS, or NIST on your infrastructure
• you want violations surfaced during CDK synthesis before deployment

When to avoid

• you use Terraform, Pulumi, or other non-CDK IaC tools
• you need runtime or dynamic security scanning of deployed resources rather than static template checks
• you need general-purpose linting beyond infrastructure rules

Facets

library · maturity active

security testing linter developer-tools infrastructure-as-code security cloud-computing developer-tools python jvm dotnet go cli aws-cdk cloudformation compliance rule-packs static-analysis infrastructure-as-code devops nodejs

Member repositories

For agents

markdown · JSON · MCP: product_card(name="cdklabs/cdk-nag")