cfn-lint

cfn-lint <template.yml>

Validates CloudFormation templates with cfn-lint, detecting syntax errors and incorrect properties before deployment.

Run it in the AWS IaC pipeline when you want template validation: cfn-lint analyzes the template and reports errors — syntax, incorrect properties, broken references, invalid values — with the rule (E/W) and line number. It's the reference CloudFormation linter (from AWS): template validation before deploy (and security scanning). In AWS DevSecOps, cfn-lint is the first check in the CloudFormation pipeline: valid template before deploy (and cfn-nag, 050).

Don't use it as a security analysis: cfn-lint validates syntax and properties — security misconfigurations are covered by cfn-nag (050) or Checkov. And watch out: linter rules update with new CloudFormation resources (linter versions): keep the version up to date. Errors (E) break the pipeline; warnings (W) are reviewed. For deploy validation (real values), use the CLI's cloudformation validate-template; cfn-lint is the local template analysis.