EVERYTHING XIAOMI
Get listed

CFRipper

CFRipper is a free, open-source Python library and command-line security analyzer for AWS CloudFormation templates.

Place
#16 of 20
Score
6.0
CFRipper's website

What CFRipper is

CFRipper is a free, open-source Python library and command-line security analyzer for AWS CloudFormation templates. Its aim is to help keep vulnerable infrastructure from reaching production. The CLI accepts template files for analysis and can produce text or JSON output, with an option to save results to an output folder. Example findings include wildcard principals and overly permissive IAM role policies. Users can add plugins for custom compliance checks and configure rules with a config file and filters folder. Documented exit codes distinguish successful scans, scanning errors, invalid templates, and unhandled exceptions. The project uses the Apache License 2.0 and provides installation instructions for macOS, Linux, and Windows; it uses uv for dependency management. Its analysis scope is CloudFormation, not Terraform or Kubernetes. The documentation also lists commands for linting, coverage, tests, and installing runtime or development dependencies. Some CFRipper rules draw inspiration from cfn-nag, and example scripts are used in test cases.

Good

  • Free and Apache-2.0 licensed.
  • Accepts CloudFormation template files for analysis.
  • Can emit text or JSON results.
  • Custom plugins support compliance checks.
  • Example findings include permissive IAM policies.

Watch out

  • Analysis is limited to CloudFormation templates.
  • Terraform analysis is not supported.
  • Kubernetes analysis is not supported.

Who it suits

CFRipper suits teams analyzing AWS CloudFormation templates that want a CLI tool with configurable rules and custom checks. It is not suited to infrastructure defined in Terraform or Kubernetes, based on its listed analysis scope.

Verdict

CFRipper offers configurable command-line analysis for CloudFormation, with text and JSON results and custom plugins. Its narrow template scope makes it a fit specifically for teams working with CloudFormation.

Plans and prices

From CFRipper's own pricing page, checked 8 Oct 2001.

All about pricing
PlanPriceWhat it gives you
CFRipperFreeApache-2.0 licensed software · CloudFormation templates

The facts

Each one read from CFRipper's own pages, with the date it was checked.

What it does

Attribution
The documentation says some CFRipper rules were inspired by cfn-nag and its example scripts are used in test cases.checked 8 Oct 2001
Custom checks
Users can write their own compliance checks by adding custom plugins.checked 8 Oct 2001
Development checks
The documentation lists commands for linting, coverage, tests, and installing runtime or development dependencies.checked 8 Oct 2001
Exit codes
The documented CLI uses exit code 0 for successful valid scans, 1 for scanning errors, 2 for invalid templates, and 3 for unhandled exceptions.checked 8 Oct 2001
Findings
Example findings include wildcard principals and overly permissive IAM role policies.checked 8 Oct 2001
Input
The CLI accepts CloudFormation template files as arguments for analysis.checked 8 Oct 2001
Install and development
The repository says it uses uv for dependency management and shows installation instructions for macOS, Linux, and Windows.checked 8 Oct 2001
Language
The documentation describes CFRipper as a Python tool.checked 8 Oct 2001
License
The project is distributed under the Apache License 2.0.checked 8 Oct 2001
Output formats
The CLI examples show text and JSON output, with an option to save results to an output folder.checked 8 Oct 2001
Purpose
CFRipper is a library and CLI security analyzer for AWS CloudFormation templates that aims to prevent vulnerable infrastructure from reaching production.checked 8 Oct 2001
Rule configuration
The CLI supports a rules config file and a rules filters folder.checked 8 Oct 2001

Alternatives to CFRipper

All alternatives
  1. 1Aikido CSPM logo

    Aikido CSPM

    Free planWebAPILinuxmacOS
    7.9From $300 a month
    Visit
  2. 2

    Kyverno

    Free planOpen sourceWebAPILinuxmacOS
    7.7Free plan
    Visit
  3. 3Fairwinds Polaris logo

    Fairwinds Polaris

    Free planWebLinuxmacOSSelf-hosted
    7.1Free plan
    Visit
  4. 4

    KloudSec IaC Security

    Free planWebAPILinuxmacOS
    7.0From $79 a month
    Visit
  5. 5

    kube-score

    Free planWebLinuxmacOSSelf-hosted
    6.9Free plan
    Visit
  6. 6Trivy logo

    Trivy

    Free planLinuxmacOSSelf-hostedWindows
    6.9Free plan
    Visit