# cdklabs/cdk-nag

Check CDK applications for best practices using a combination of available rule packs

Repository: https://github.com/cdklabs/cdk-nag
Canonical: https://ross.abutalabs.com/products/cdk-nag
Language: TypeScript
License: Apache-2.0
License Family: permissive
Last push: 2026-08-31T23:08:57+00:00

## Health v2 (maintenance only)
Score: 94/100 (v2, computed 2026-09-03T02:39:23.370411+00:00)
- activity 100, release rhythm 84, longevity 100
- inputs: {"age_days": 1870, "days_push": 2, "days_rel": 29, "gap_med": 1.0, "n_releases_24m": 291}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1035, forks 85 (observed 2026-09-01T02:14:00.192078+00:00)

## What it is
cdk-nag is a library that checks AWS CDK applications and CloudFormation templates for best practices using pre-built rule packs such as AWS Solutions, HIPAA Security, NIST 800-53, PCI DSS, and Serverless. It reports rule violations during synthesis and allows developers to acknowledge or suppress specific findings on constructs.

## Use cases
- check my CDK app for security best practices
- scan CloudFormation templates for compliance violations
- enforce HIPAA or PCI DSS rules on infrastructure code
- suppress known rule violations on specific CDK constructs
- create custom rule packs for organizational standards
- audit IaC against NIST 800-53 controls

## When to choose
- you use AWS CDK or CloudFormation and want automated compliance and best-practice checks
- you need to enforce regulatory rule packs like HIPAA, PCI DSS, or NIST on your infrastructure
- you want violations surfaced during CDK synthesis before deployment

## When to avoid
- you use Terraform, Pulumi, or other non-CDK IaC tools
- you need runtime or dynamic security scanning of deployed resources rather than static template checks
- you need general-purpose linting beyond infrastructure rules

## Facets
- artifact type: library
- maturity: active
- function: security, testing, linter, developer-tools
- domain: infrastructure-as-code, security, cloud-computing, developer-tools
- platform: python, jvm, dotnet, go, cli
- tags: aws-cdk, cloudformation, compliance, rule-packs, static-analysis, infrastructure-as-code, devops, nodejs

## Member repositories
- cdklabs/cdk-nag (main) score 94

## Provenance
- Observed fields: from GitHub, fetched 2026-09-01T02:14:00.192078+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:04:53.015484+00:00, confidence not recorded.
  - readme: https://github.com/cdklabs/cdk-nag (fetched 2026-09-01T02:14:00.192078+00:00, sha 1fb0f68ae246)
- Data as of 2026-08-30T08:39:29.467469+00:00.