stelligent/cfn_nag

Health v2 · maintenance only

Adoption not part of the score

1309 stars · 208 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

cfn_nag is a command-line linting tool that scans AWS CloudFormation templates for insecure infrastructure patterns such as overly permissive IAM and security group rules, missing encryption, disabled access logs, and hardcoded passwords. It is written in Ruby, installable via gem/brew/Docker, and integrates into CI/CD pipelines with non-zero exit codes on violations.

Use cases

• lint cloudformation templates for security issues
• find overly permissive IAM policies in cfn templates
• check that security groups don't allow wildcard access
• detect missing encryption in cloudformation resources
• scan cfn templates for hardcoded passwords
• run cloudformation security checks in CI pipeline
• audit infrastructure-as-code for compliance violations

When to choose

• you use AWS CloudFormation and want automated security linting before deployment
• you need to enforce IAM and security group best practices in CI/CD
• you want a simple CLI or Docker-based scanner with JSON output for tooling integration

When to avoid

• you use Terraform, Pulumi, or other non-CloudFormation IaC tools
• you need full static analysis or runtime security scanning rather than pattern-based linting
• you need actively developed features, as the project appears to be in maintenance mode

Facets

cli-tool · maturity maintenance

linter security vulnerability-scanning testing ci-cd security infrastructure-as-code cloud-computing developer-tools cli ruby cloudformation aws infrastructure-as-code security-linting iam compliance static-analysis devops macos linux docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="stelligent/cfn_nag")