aws-cloudformation/cloudformation-guard

Health v2 · maintenance only

Adoption not part of the score

1385 stars · 196 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

AWS CloudFormation Guard (cfn-guard) is a general-purpose policy-as-code evaluation tool with an expressive DSL for defining rules. It validates JSON- and YAML-formatted structured data such as CloudFormation templates, Terraform JSON plans, and Kubernetes configurations against those policies.

Use cases

• validate cloudformation templates against security and compliance policies
• check terraform plan for deployment safety before applying
• enforce organizational rules on kubernetes configurations
• detect live state deviations in terraform state files
• validate cloudformation changesets in ci/cd pipelines to prevent unsafe replacements
• continuously monitor aws config configuration items for policy violations
• shift-left governance checks for infrastructure-as-code

When to choose

• you need a declarative DSL to write policy rules for JSON/YAML structured data
• you want to enforce security, compliance, or governance checks on IaC before deployment
• you need to gate CloudFormation, Terraform, or Kubernetes changes in CI/CD pipelines
• you want a Rust-based CLI with lambda deployment options for policy evaluation

When to avoid

• you need policy evaluation for formats other than JSON/YAML structured data
• you rely on Guard 1.0 rules without migrating, since 2.0+ is backward incompatible
• you need runtime runtime enforcement of deployed resources rather than static/config validation

Facets

cli-tool · maturity active

security testing configuration-management cli parser security cloud-computing infrastructure-as-code legal windows cli rust policy-as-code cloudformation terraform kubernetes governance compliance iac-validation shift-left devops linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="aws-cloudformation/cloudformation-guard")