Integrate cfn-nag with Vulnetix. Scan AWS CloudFormation templates for dangerous security patterns and export JSON findings for upload to Vulnetix.
Install & scan
$ gem install cfn-nag # Verify installation cfn_nag_scan --version $ # Scan a template and output JSON cfn_nag_scan --input-path template.yaml --output-format json > cfn-nag.json # SARIF output via GitHub Action (recommended) # uses: stelligent/cfn-nag-sarif-action@main
Run cfn-nag in CI
Scan on every push and upload the report as a workflow artifact:
- name: Install cfn-nag run: gem install cfn-nag - name: Scan CloudFormation templates run: cfn_nag_scan --input-path cloudformation/ --output-format json > cfn-nag.json - name: Upload to Vulnetix run: vulnetix upload --file cfn-nag.json
How Vulnetix compares: better together
Vulnetix does not replace cfn-nag. Keep running it. Vulnetix sits on top of cfn-nag (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
cfn-nag is strongest at its core category and also carries features in Secret Scanning, Cloud Security & CSPM, just as Vulnetix spans categories.
| Capability | Vulnetix | cfn-nag |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✗ |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✗ |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✗ |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✗ |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✓ Core purpose: static security linting of CloudFormation (JSON/YAML) against 140+ rules for IAM wildcards, open SGs, missing encryption/logging |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ~ Flags hardcoded password literals in templates, but not a general secret scanner (no entropy/token detection) |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ~ Detects cloud misconfig patterns (permissive IAM, 0.0.0.0/0 SGs) but at CFN template time only, not live-account CSPM |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✗ |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✗ |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✗ |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ✗ |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What cfn-nag does well
- Deep, purpose-built CloudFormation security linting with 140+ predefined rules targeting IAM wildcards, open security groups, missing encryption, and absent access logging
- Mature Stelligent-maintained tool with flexible suppression model: custom profiles, global deny-lists, and per-resource CloudFormation Metadata suppression
- Recurses JSON/YAML/.template files and evaluates parameter substitution, conditions, pseudo-functions and FindInMap for accurate template analysis
- Easy CI/CD adoption via Docker, GitHub Actions, CodePipeline, and Security Hub/CodeBuild report integration
Where Vulnetix adds to it: cfn-nag is a best-in-class CloudFormation linter but only covers AWS CFN. Vulnetix runs native IaC scanning across Terraform/OpenTofu/k8s/Nix plus SAST, SCA, container, secrets, cloud and SBOM, and ingests cfn-nag output to dedup its CFN findings into one prioritised, exploit-intel-ranked queue with VEX and SSVC, better together, Vulnetix orchestrates rather than replaces cfn-nag's deep CFN rules.
No migration, no rip-and-replace. cfn-nag keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise cfn-nag results in Vulnetix
Upload cfn-nag JSON, SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.