CFRipper
What it is
CFRipper is a free, open-source Python library and command-line security analyzer for AWS CloudFormation templates. Its purpose is to help keep vulnerable infrastructure from reaching production. The CLI accepts template files, analyzes them, and can produce text or JSON output, with an option to save results to an output folder. Example findings include wildcard principals and overly permissive IAM role policies. Teams can add custom plugins for compliance checks and configure rules through a rules file and filters folder. Documented exit codes distinguish successful scans, scanning errors, invalid templates, and unhandled exceptions. Installation guidance covers macOS, Linux, and Windows, while dependency management uses uv. The project is licensed under Apache License 2.0. Its analysis scope is CloudFormation; Terraform and Kubernetes are not supported. The repository also lists commands for linting, coverage, tests, and runtime or development dependencies. Some rules were inspired by cfn-nag. CFRipper is available without a paid plan.
For and against
For
- Free Apache-2.0 software
- CloudFormation template analysis
- Custom compliance plugins
- Text and JSON output
- macOS, Linux, and Windows installation
Against
- No Terraform analysis
- No Kubernetes analysis
- Requires CloudFormation templates
- Command-line tool
The verdict
CFRipper provides focused CloudFormation security analysis with configurable rules and clear scan results. Its open-source model fits teams comfortable running Python tooling locally.
Who it suits
CFRipper suits teams managing AWS CloudFormation who want a local Python and CLI analyzer with customizable compliance checks. It is less suitable when infrastructure is defined in Terraform or Kubernetes.
Plans and prices
Free
AWS CloudFormation templates · CLI and Python library · custom compliance plugins
Read 21 Oct 2026 · cybersectools.com
CFRipper
Apache-2.0 licensed software · CloudFormation templates
Read 8 Oct 2026 · github.com
On the record
- Attribution
- The documentation says some CFRipper rules were inspired by cfn-nag and its example scripts are used in test cases.cfripper.readthedocs.io · read 8 Oct 2026
- Built-in security checks
- Documented examples include detection of wildcard principals and overprivileged IAM role permissions.github.com · read 21 Oct 2026
- Changelog compatibility
- The changelog records Python 3.14 support in version 1.19 and removal of Python 3.9 support in version 1.18.github.com · read 21 Oct 2026
- Custom checks
- Users can add their own compliance checks through custom plugins.github.com · read 21 Oct 2026
- Development checks
- The documentation lists commands for linting, coverage, tests, and installing runtime or development dependencies.cfripper.readthedocs.io · read 8 Oct 2026
- Documentation
- The README links to a dedicated Read the Docs documentation site.github.com · read 21 Oct 2026
- Dynamic extensibility
- The changelog says version 1.0 introduced pluggy-based dynamic rule loading and external filter files.github.com · read 21 Oct 2026
- Exit codes
- The CLI documents separate codes for successful scans, scan errors, invalid templates, and unhandled exceptions.pypi.org · read 21 Oct 2026
- Findings
- Example findings include wildcard principals and overly permissive IAM role policies.github.com · read 8 Oct 2026
- Homebrew dependencies
- The Homebrew formula depends on libyaml, pydantic, and Python 3.14.formulae.brew.sh · read 21 Oct 2026
- Homebrew installation
- Homebrew provides installation through the command brew install cfripper.formulae.brew.sh · read 21 Oct 2026
- Homebrew platforms
- Homebrew supplies bottles for supported macOS Apple Silicon and Intel systems plus ARM64 and x86_64 Linux.formulae.brew.sh · read 21 Oct 2026
- Independent description
- CybersecTools describes CFRipper as a security analyzer for CloudFormation vulnerabilities and configuration errors before deployment.cybersectools.com · read 21 Oct 2026
- Independent extensibility praise
- CybersecTools highlights the plugin system, Python-library form, multiple output formats, and template resolution as capabilities.cybersectools.com · read 21 Oct 2026
- Independent listing price
- CybersecTools labels CFRipper as a free tool and says it is suitable for cost-conscious teams.cybersectools.com · read 21 Oct 2026
- Input
- The CLI accepts CloudFormation template files as arguments for analysis.github.com · read 8 Oct 2026
- Install and development
- The repository says it uses uv for dependency management and shows installation instructions for macOS, Linux, and Windows.github.com · read 8 Oct 2026
- Language
- The documentation describes CFRipper as a Python tool.cfripper.readthedocs.io · read 8 Oct 2026
