- Home
- IaC Security Scanners
- cfn-nag
cfn-nag
What it is
cfn-nag is free, MIT-licensed software that scans AWS CloudFormation templates for patterns that may indicate insecure infrastructure. Its checks include overly permissive IAM policies and security group rules, disabled access logs or encryption, and password literals. It processes JSON, .template, YAML, and YML files, and can scan subdirectories when given a directory. Results go to standard output, with JSON output available; failures return a non-zero exit code, while warnings return success. Installation is documented through RubyGems and Homebrew, with Ruby 2.5 or later required for gem installation. A Dockerfile and Docker Hub image are provided, and the project documents use in GitHub Actions and AWS CodePipeline. Users can filter checks with profiles and deny lists, suppress rules per resource, and develop custom rules. Static analysis cannot account for deployment parameter values unless those values are supplied in a JSON file. By default, Fn::If analysis uses the true outcome; condition values are needed to inspect false outcomes. The project describes the tool as able to work offline, with S3 rule retrieval optional.
For and against
For
- Scans JSON, template, YAML, and YML files
- Supports custom rules and rule suppression
- Can run without network connectivity
- MIT-licensed and free
Against
- Requires Ruby 2.5 or later for gem installation
- Deployment parameters need a supplied JSON file for analysis
- Does not analyze Terraform or Kubernetes
The verdict
cfn-nag offers configurable static checks for CloudFormation templates, including command-line output and documented CI integrations. Its analysis has limits around deployment-supplied parameters and conditional branches.
Who it suits
cfn-nag is for teams checking AWS CloudFormation templates for specified security-related patterns. It may suit workflows using RubyGems, Homebrew, Docker, GitHub Actions, or AWS CodePipeline.
Plans and prices
cfn-nag
MIT-licensed software · Ruby >= 2.5
Read 3 Oct 2026 · github.com
On the record
- Checks
- The project lists checks for overly permissive IAM and security group rules, disabled access logs or encryption, and password literals.github.com · read 3 Oct 2026
- Conditional analysis limit
- By default, cfn-nag substitutes the true outcome for Fn::If, so rules do not inspect false outcomes unless condition values are provided.github.com · read 3 Oct 2026
- Docker
- A Dockerfile is provided, and the project says its image is published as stelligent/cfn_nag on Docker Hub.github.com · read 3 Oct 2026
- Install
- The project documents installation with RubyGems and Homebrew, and requires Ruby 2.5 or later for gem installation.github.com · read 3 Oct 2026
- Integrations
- The project documents running cfn-nag in GitHub Actions workflows and deploying it in AWS CodePipeline through the AWS Serverless Application Repository.github.com · read 3 Oct 2026
- License
- The project uses the MIT License, which grants permission to use, copy, modify, merge, publish, distribute, sublicense, and sell the software subject to its terms.github.com · read 3 Oct 2026
- Offline use
- The gem specification describes cfn-nag as a static analysis tool that must work without network connectivity, while noting S3 rule retrieval is optional.github.com · read 3 Oct 2026
- Output
- Results go to standard output; JSON output is available, and failures return a non-zero exit code while warnings return success.github.com · read 3 Oct 2026
- Purpose
- cfn-nag scans CloudFormation templates for patterns that may indicate insecure infrastructure.github.com · read 3 Oct 2026
- Rule customization
- Users can filter checks with profiles and deny lists, suppress rules per resource, and develop custom rules distributed as gems or loaded from S3.github.com · read 3 Oct 2026
- Support
- The project directs users to submit bug reports and feature requests through its GitHub issue tracker.github.com · read 3 Oct 2026
- Template analysis limit
- Static analysis cannot see parameter values supplied at deployment unless users provide those values through a JSON file.github.com · read 3 Oct 2026
- Template inputs
- The scanner processes JSON, .template, YAML, and YML files and recursively scans subdirectories when given a directory.github.com · read 3 Oct 2026
