CFRipper
CFRipper is a free, open-source Python library and command-line security analyzer for AWS CloudFormation templates.
What CFRipper is
CFRipper is a free, open-source Python library and command-line security analyzer for AWS CloudFormation templates. Its aim is to help keep vulnerable infrastructure from reaching production. The CLI accepts template files for analysis and can produce text or JSON output, with an option to save results to an output folder. Example findings include wildcard principals and overly permissive IAM role policies. Users can add plugins for custom compliance checks and configure rules with a config file and filters folder. Documented exit codes distinguish successful scans, scanning errors, invalid templates, and unhandled exceptions. The project uses the Apache License 2.0 and provides installation instructions for macOS, Linux, and Windows; it uses uv for dependency management. Its analysis scope is CloudFormation, not Terraform or Kubernetes. The documentation also lists commands for linting, coverage, tests, and installing runtime or development dependencies. Some CFRipper rules draw inspiration from cfn-nag, and example scripts are used in test cases.
Good
- Free and Apache-2.0 licensed.
- Accepts CloudFormation template files for analysis.
- Can emit text or JSON results.
- Custom plugins support compliance checks.
- Example findings include permissive IAM policies.
Watch out
- Analysis is limited to CloudFormation templates.
- Terraform analysis is not supported.
- Kubernetes analysis is not supported.
Who it suits
CFRipper suits teams analyzing AWS CloudFormation templates that want a CLI tool with configurable rules and custom checks. It is not suited to infrastructure defined in Terraform or Kubernetes, based on its listed analysis scope.
Verdict
CFRipper offers configurable command-line analysis for CloudFormation, with text and JSON results and custom plugins. Its narrow template scope makes it a fit specifically for teams working with CloudFormation.
Plans and prices
From CFRipper's own pricing page, checked 8 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| CFRipper | Free | Apache-2.0 licensed software · CloudFormation templates |
| Free | Free | AWS CloudFormation templates · CLI and Python library · custom compliance plugins |
The facts
Each one read from CFRipper's own pages, with the date it was checked.
What it does
- Attribution
- The documentation says some CFRipper rules were inspired by cfn-nag and its example scripts are used in test cases.checked 8 Oct 2026
- Built-in security checks
- Documented examples include detection of wildcard principals and overprivileged IAM role permissions.checked 21 Oct 2026
- Changelog compatibility
- The changelog records Python 3.14 support in version 1.19 and removal of Python 3.9 support in version 1.18.checked 21 Oct 2026
- Custom checks
- Users can add their own compliance checks through custom plugins.checked 21 Oct 2026
- Development checks
- The documentation lists commands for linting, coverage, tests, and installing runtime or development dependencies.checked 8 Oct 2026
- Documentation
- The README links to a dedicated Read the Docs documentation site.checked 21 Oct 2026
- Dynamic extensibility
- The changelog says version 1.0 introduced pluggy-based dynamic rule loading and external filter files.checked 21 Oct 2026
- Exit codes
- The CLI documents separate codes for successful scans, scan errors, invalid templates, and unhandled exceptions.checked 21 Oct 2026
- Findings
- Example findings include wildcard principals and overly permissive IAM role policies.checked 8 Oct 2026
- Homebrew dependencies
- The Homebrew formula depends on libyaml, pydantic, and Python 3.14.checked 21 Oct 2026
- Homebrew installation
- Homebrew provides installation through the command brew install cfripper.checked 21 Oct 2026
- Independent description
- CybersecTools describes CFRipper as a security analyzer for CloudFormation vulnerabilities and configuration errors before deployment.checked 21 Oct 2026
- Independent extensibility praise
- CybersecTools highlights the plugin system, Python-library form, multiple output formats, and template resolution as capabilities.checked 21 Oct 2026
- Input
- The CLI accepts CloudFormation template files as arguments for analysis.checked 8 Oct 2026
- Install and development
- The repository says it uses uv for dependency management and shows installation instructions for macOS, Linux, and Windows.checked 8 Oct 2026
- Language
- The documentation describes CFRipper as a Python tool.checked 8 Oct 2026
- License
- The package and repository use the OSI-approved Apache License 2.0.checked 21 Oct 2026
- Limit: independent reviews
- CybersecTools reports that CFRipper has no reviews yet.checked 21 Oct 2026
- Limit: integrations
- CybersecTools does not name any integrations and displays the integration list as unavailable without sign-in.checked 21 Oct 2026
- Limit: scope
- Independent CloudSecDocs catalogues CFRipper specifically in its CloudFormation security-tool section, while listing broader multi-framework coverage for alternatives.checked 21 Oct 2026
- Maintainers
- PyPI lists six verified maintainers, including the Skyscanner security group and individual contributors.checked 21 Oct 2026
Where it runs
- Homebrew platforms
- Homebrew supplies bottles for supported macOS Apple Silicon and Intel systems plus ARM64 and x86_64 Linux.checked 21 Oct 2026
Money
- Independent listing price
- CybersecTools labels CFRipper as a free tool and says it is suitable for cost-conscious teams.checked 21 Oct 2026
The company
- Maker company size
- LinkedIn lists Skyscanner as privately held with 1,001–5,000 employees.checked 21 Oct 2026
Alternatives to CFRipper
- 1
Kubescape
Free planOpen sourceAPILinuxmacOSSelf-hosted8.2From $30 a month - 2
Aikido CSPM
Free planWebAPILinuxmacOS7.9From $300 a month - 3
AWS CloudFormation
Free planiOSWebAPILinux7.7Free plan - 4
Kyverno
Free planOpen sourceWebAPILinuxmacOS7.7Free plan - 5
audytx
Free planWebAPI7.2From $20 a month - 6
Fairwinds Polaris
Free planWebLinuxmacOSSelf-hosted7.1Free plan