Integrate cfn-lint with Vulnetix. Validate AWS CloudFormation templates for correctness, best practices, and security issues. Export findings in SARIF format and upload to Vulnetix.
Install & scan
$ # Recommended - run without global install uv run --with cfn-lint cfn-lint --version # Install globally with pip pip install "cfn-lint" # Or via Homebrew brew install cfn-lint $ uv run --with cfn-lint cfn-lint -f sarif -t template.yaml > cfn-lint.sarif
Run cfn-lint in CI
Scan on every push and upload the report as a workflow artifact:
- name: Scan CloudFormation with cfn-lint
run: |
pip install cfn-lint
cfn-lint -f sarif -t "**/*.yaml" > cfn-lint.sarif
- name: Upload report
uses: actions/upload-artifact@v6
with:
name: cfn-lint
path: cfn-lint.sarif
if-no-files-found: warnThen one publish job hands every artifact in the run to Vulnetix, recorded under cfn-lint's own name and version. Written once per workflow, however many scanners you run:
publish:
name: Publish to Vulnetix
runs-on: ubuntu-latest
needs: [scan] # every scanner job, or its report is never published
if: always() # or one failing scanner suppresses all the others
permissions:
contents: read
actions: read # required to list the run's artifacts
env:
VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
steps:
- uses: actions/checkout@v5
- name: Install Vulnetix CLI
run: |
curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
- name: Publish scanner reports
env:
GITHUB_TOKEN: ${{ github.token }}
run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --jsonAfter the run, vulnetix gha status reports what was actually recorded.
How Vulnetix compares: better together
Vulnetix does not replace cfn-lint. Keep running it. Vulnetix sits on top of cfn-lint (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
| Capability | Vulnetix | cfn-lint |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✗ |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✗ |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✗ |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✗ |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✓ Core: spec-compliance linting of CloudFormation/SAM templates; primarily correctness with some best-practice/IAM checks, less a dedicated security scanner (pairs with cfn-guard/cfn-nag for policy) |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✗ |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✗ |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✗ |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✗ |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✗ |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ✗ |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What cfn-lint does well
- Official AWS tool: validates templates against the authoritative CloudFormation resource provider schemas for every resource type and property
- Native AWS SAM (Serverless Application Model) support, transforming templates before linting
- Structured rule severity model (E errors, W warnings, I info) with usable off-the-shelf checks including some IAM policy and property-value validation
- SARIF output (via the sarif extra) plus IDE/CI integrations, making it easy to catch invalid templates before deployment
Where Vulnetix adds to it: Vulnetix ingests cfn-lint's SARIF findings and merges its CloudFormation validation results into a single deduplicated, exploit-intel-prioritised queue with SSVC, versioned VEX and autofix spanning all scanner types. Better together: cfn-lint stays the authoritative CloudFormation linter; Vulnetix orchestrates its output alongside dedicated security scanners rather than replacing it.
No migration, no rip-and-replace. cfn-lint keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise cfn-lint results in Vulnetix
Upload cfn-lint SARIF, JSON, JUnit output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.