cfn-nag

cfn_nag_scan --input-path <template>

Analyze CloudFormation templates with cfn-nag, detecting insecure configurations (permissions, ports, encryption) against security rules.

Run it in the AWS IaC pipeline when you want security analysis of templates: cfn-nag (from Stelligent) analyzes the template and reports findings — excessive permissions (wildcards in policies), open ports (0.0.0.0), disabled encryption, credentials in properties — with rules (F/W) and severity. It is the reference CloudFormation security analyzer: the complement to cfn-lint (syntax) with security. In AWS DevSecOps, cfn-nag is the gate for the CloudFormation pipeline: findings (FATAL) are blocked before deploy.

Do not use it as a complete analysis: cfn-nag covers security rules for CloudFormation resources — organizational policies (tags, conventions) are covered with terraform-compliance/OPA and the rest of IaC with Checkov. Generic rules generate false positives (legitimate contexts): they are triaged (cfn-nag suppression). And note: cfn-nag analyzes the template — the actual stack state (drift) is covered by audits (Prowler). The combination cfn-lint + cfn-nag covers template syntax and security.