# stelligent/cfn_nag

Linting tool for CloudFormation templates

Repository: https://github.com/stelligent/cfn_nag
Canonical: https://ross.abutalabs.com/products/cfn_nag
Language: Ruby
License: MIT
License Family: permissive
Topics: continuous-testing, unit-testing, cloudformation, aws, devops, iam-rules, cloudformation-templates, cfn-nag, open-source, static-analysis, stelligent, cfn, lint, linting, amazon, security, security-automation, cloudformation-security, hacktoberfest, compliance
Last push: 2024-08-01T23:27:46+00:00

## Health v2 (maintenance only)
Score: 23/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 3856, "days_push": 762, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1309, forks 208 (observed 2026-08-28T04:04:19.459252+00:00)

## What it is
cfn_nag is a command-line linting tool that scans AWS CloudFormation templates for insecure infrastructure patterns such as overly permissive IAM and security group rules, missing encryption, disabled access logs, and hardcoded passwords. It is written in Ruby, installable via gem/brew/Docker, and integrates into CI/CD pipelines with non-zero exit codes on violations.

## Use cases
- lint cloudformation templates for security issues
- find overly permissive IAM policies in cfn templates
- check that security groups don't allow wildcard access
- detect missing encryption in cloudformation resources
- scan cfn templates for hardcoded passwords
- run cloudformation security checks in CI pipeline
- audit infrastructure-as-code for compliance violations

## When to choose
- you use AWS CloudFormation and want automated security linting before deployment
- you need to enforce IAM and security group best practices in CI/CD
- you want a simple CLI or Docker-based scanner with JSON output for tooling integration

## When to avoid
- you use Terraform, Pulumi, or other non-CloudFormation IaC tools
- you need full static analysis or runtime security scanning rather than pattern-based linting
- you need actively developed features, as the project appears to be in maintenance mode

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: linter, security, vulnerability-scanning, testing, ci-cd
- domain: security, infrastructure-as-code, cloud-computing, developer-tools
- platform: cli, ruby
- tags: cloudformation, aws, infrastructure-as-code, security-linting, iam, compliance, static-analysis, devops, macos, linux, docker

## Member repositories
- stelligent/cfn_nag (main) score 23

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:19.459252+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:50:01.246836+00:00, confidence not recorded.
  - readme: https://github.com/stelligent/cfn_nag (fetched 2026-08-28T04:04:19.459252+00:00, sha b36f4e5471e2)
- Data as of 2026-08-30T08:39:29.467469+00:00.