The best cfn-nag alternatives
The rest of Best IaC Security Scanners, in this site's order: each with what it costs, where it runs and its record score.
It suits software teams looking to automate pull-request review and scan code or infrastructure for security issues.
Pulumi is for engineers who want to manage infrastructure in general-purpose languages across supported cloud providers.
Kubescape suits teams that operate Kubernetes clusters and need configuration, vulnerability, compliance, or runtime security checks.
Polaris suits Kubernetes teams that want to check configuration practices in local YAML files or cluster workloads.
kube-score suits Kubernetes users who want static checks on object definitions, including teams incorporating checks into CI/CD.
Trivy suits teams and developers who need to scan code, artifacts, container images, or Kubernetes environments.
Checkov suits developers and teams scanning infrastructure-as-code for configuration issues, credentials, and compliance checks.
It suits developers and platform teams checking Kubernetes configuration against security and readiness policies.
TFLint suits Terraform users who want local checks for language rules, cloud-specific issues, and naming practices.
terraform-compliance suits developers and security teams writing readable Terraform policy checks.