cfn-lint

cfn-lint is a free, open-source tool for validating AWS CloudFormation YAML and JSON templates. It checks templates against resource provider schemas and applies additional validations, including checks on property values and recommended practices. It can process AWS Serverless Application Model templates by transforming them with AWS SAM first. Users can choose built-in checks or create custom rules, and configure the linter through command-line options, configuration files or CloudFormation template metadata. Output choices include quiet, parseable, JSON, JUnit, pretty and SARIF formats. Installation options documented by the project include pip, Homebrew for macOS and Docker; supported Python versions are 3.10 through 3.14. Editor integrations include Atom, Emacs, NeoVim/Vim, Sublime, Visual Studio Code and IntelliJ IDEA, alongside a GitHub Action and pre-commit hook. Validation of complex template values is best effort: the tool does not fail solely because it cannot interpret or translate them. The repository identifies its license as MIT No Attribution.

cfn-lint offers configurable checks and several output formats for CloudFormation template validation. Its project describes complex-value checks as best effort, so the tool may not interpret every value.

cfn-lint is for people validating AWS CloudFormation templates, including those working with AWS SAM. Its editor, command-line and CI/CD integrations can suit different development workflows.

cfn-lint is a rule-based validator for AWS CloudFormation templates. It is best suited to AWS teams that want configurable checks in their template and CI workflows. Its scope is useful and focused, but validation is not a guarantee that every complex value is understood or that deployed infrastructure is correct.

Overview

The linter checks CloudFormation YAML and JSON against resource provider schemas, valid property values, and best-practice rules. That makes it a practical way to catch template issues before provisioning, rather than a tool for testing running resources. Its best-effort treatment of complex values matters: it will not fail simply because it cannot interpret or translate one, so teams should not treat a clean result as proof that every expression has been evaluated.

Its policy-as-code capabilities include policy testing, reporting, and configuration compliance for AWS. It supports CloudFormation and AWS SAM, but does not provide provisioning tests, deployed checks, or runtime enforcement.

Key features

• Rule-based validation: Specific checks cover schemas, property values, and best practices. User-defined rules let teams add their own standards, which is useful when built-in checks do not express local requirements.
• Configurable operation: Command-line options, configuration files, and CloudFormation template metadata provide several ways to control checks without relying on a single configuration path.
• AWS SAM processing: SAM templates are transformed with AWS SAM before cfn-lint processes them, making the tool relevant to teams using that AWS framework as well as standard CloudFormation.
• Multiple output formats: Quiet, parseable, JSON, JUnit, pretty, and SARIF output suit different reporting and automation needs, including workflows that consume structured results.
• Workflow integration: Editor integrations cover Atom, Emacs, NeoVim/Vim, Sublime, Visual Studio Code, and IntelliJ IDEA. A GitHub Action and pre-commit hook offer ways to include checks in code review and commit workflows.

Pricing

cfn-lint is free and open source. The cfn-lint plan costs nothing and is MIT-0 licensed; Python 3.10 through 3.14 are supported. There is no paid tier or trial to weigh against the free option. The license permits use, copying, modification, distribution, sublicensing, and sale without restriction, making it suitable for teams that want to adopt or adapt the tool without a software charge.

Installation is documented through pip, Homebrew for macOS, or Docker. Users need a supported Python runtime when choosing an installation approach that relies on Python. For community help, the project invites users to its Discord.

Platforms

cfn-lint supports Linux, macOS, and Windows, and can be self-hosted. That range suits teams running checks on developer machines or their own infrastructure rather than depending on a hosted service.

Who it's for

Choose cfn-lint if your work centers on AWS CloudFormation or SAM and you want schema-aware checks, custom rules, and output that can fit editor and CI/CD workflows. It is less suitable as a standalone assurance tool for teams that need infrastructure provisioning tests, checks against deployed resources, or runtime policy enforcement.

Pros and cons

• Pro: Custom rules and several configuration mechanisms let teams tailor validation to their practices.
• Pro: Structured output, editor integrations, a GitHub Action, and a pre-commit hook give teams multiple ways to bring checks into existing workflows.
• Pro: Free use under MIT-0 terms avoids a software license cost and permits broad reuse.
• Con: Complex values are handled on a best-effort basis, leaving room for expressions the linter cannot interpret.
• Con: It focuses on template validation and does not test provisioning, deployed resources, or runtime behavior.

Alternatives

For another free option, Conftest runs on Linux, macOS, and Windows under the Apache License 2.0; consider it when you want to compare a different open-source tool for infrastructure checks.

Terratest is an open-source project released under Apache 2.0 and built by Gruntwork; it is another free option to consider when evaluating infrastructure testing tools.

Cinc Auditor is free for Linux, macOS, and Windows, with no formal warranties or support; consider it if that distribution model fits your requirements.

kubeconform is a free option for Linux, macOS, self-hosted, and Windows environments, with no paid plans or usage limits stated on its official site.

Serverspec is a free open-source Ruby gem maintained by Gosuke Miyashita, and may merit consideration if you want to compare another project in this category.

terraform-plugin-testing is a free Go module for Terraform provider testing and runs on Linux and macOS, making it the more directly relevant option when testing a Terraform provider.

Test Kitchen is a free Apache-licensed option for Linux, macOS, and Windows, installable through RubyGems, system packages, or Cinc/Chef Workstation.

TFLint is a free open-source command-line Terraform linter for Linux, macOS, self-hosted, and Windows environments; choose it when Terraform templates, rather than CloudFormation, are the focus.

Browse Infrastructure Testing Tools or Infrastructure Policy as Code Tools for more options.

Verdict

cfn-lint is a strong fit for AWS teams that want free, configurable validation for CloudFormation and SAM templates, with output and integrations suited to development and CI workflows. Its main reason to choose it is that focused combination of AWS template checks and extensible rules; look elsewhere if your priority is testing provisioning, deployed infrastructure, or runtime enforcement.