cfn_nag defined the job. Context finishes it.
Stelligent's cfn_nag taught a generation of AWS teams to lint CloudFormation for security before deploying it, and that instinct is exactly right. audytx is the next architectural step for the same job: instead of matching patterns resource by resource, it builds the cross-resource relationship graph first and reasons about your template before it judges it — writing the suppressions you used to write by hand, with the rationale printed.
Two architectures for one job
This is a design comparison, not a benchmark: audytx's published measured numbers are from its Terraform benchmark, and we don't relabel them as CloudFormation results.
| Dimension | audytx | cfn_nag |
|---|---|---|
| Approach | cross-resource context reasoning — the relationship graph decides which findings survive | per-resource pattern matching (per its README) |
| False-positive handling | automatic context suppression, every suppression printed with its rationale | manual Metadata/rules_to_suppress entries, written per resource |
Conditional resources (Fn::If) | both branches evaluated; unresolved conditions downgrade the finding one step and mark it conditional — never a silent guess | — |
| Terraform + CloudFormation | one engine, same AWS_* rule ids across both languages | CloudFormation-family templates only |
| Delivery | hosted MCP server + GitHub App PR review (both live today) | Ruby gem / Docker CLI in your pipeline |
| Release cadence | actively developed — live version on /status | latest release v0.8.10 (June 7, 2022) |
cfn_nag facts (approach, suppression syntax, packaging, release) per its own repository, checked July 2026. The Fn::If row states audytx's behavior; cfn_nag's is not characterized. audytx's measured precision/recall numbers are Terraform-corpus results — see the benchmark.
cfn-lint, cfn_nag, Checkov, audytx — four tools, four jobs
The CloudFormation tooling question is usually framed as either/or. It's really a stack, and each layer has a genuine mission:
cfn-lint — is the template valid?
AWS's own linter, actively maintained, validates templates against the CloudFormation resource provider schemas — property names, valid values, best practices. It's a correctness tool, not a security scanner, and it's complementary to everything below: run it always. audytx assumes a deployable template and asks the next question.
cfn_nag — does the template match known-insecure patterns?
The security-linting layer cfn_nag pioneered: W- and F-numbered rules flagging open security groups, missing encryption, wildcard IAM. The mission is right; the per-resource architecture is what caps it — it can't see that the "missing DLQ" Lambda is invoked synchronously, so you write the suppression yourself.
Checkov — the breadth sweep
Checkov scans CloudFormation alongside Terraform, Kubernetes, and more, with the widest policy catalog in open source. If you want one breadth tool across many frameworks, it's a defensible choice — our Checkov page shows the measured precision trade-off on Terraform, where both tools were benchmarked.
audytx — is the finding real in this template?
The precision layer: rules fire naively, then the relationship graph — who invokes what, which roles trust whom, what's exposed — decides what survives, and every suppression ships with its reason. Same engine, same rule ids as its Terraform scans.
The migration map
What each cfn_nag habit becomes:
| In cfn_nag | In audytx |
|---|---|
W- / F-numbered findings (W9, F27…), CloudFormation-specific | AWS_* rule ids shared with Terraform — one vocabulary if your estate has both |
Metadata → cfn_nag → rules_to_suppress entries with a reason, per resource | most disappear — context suppresses them automatically and prints the reason for you; the rest go in a .audytx-baseline.yaml with an expiry date |
gem install cfn-nag / Docker image wired into CI | no install: your coding agent or CI calls scan_cloudformation on the hosted MCP server with a free Client ID |
| Non-zero exit on failing rules to gate the pipeline | severity-ranked findings in the tool response today; PR-blocking gates arrive with the GitHub App CFN surface |
Frequently asked questions
Is cfn_nag still maintained?
The repository is public and not archived, but its most recent release is v0.8.10 from June 7, 2022, per its own releases page. Judge the cadence against your needs — AWS has shipped many new resource types and defaults since then.
What is the best cfn_nag alternative?
Start from the job cfn_nag was doing for you. For its security-linting job, audytx is the context-aware step up: the same insecure-pattern coverage class, plus cross-resource reasoning that suppresses false positives automatically with a printed reason. Keep cfn-lint for template validity — it's complementary, and AWS maintains it actively. And if what you want is one breadth tool across many frameworks, that's a different job, and Checkov is the right answer for it.
Does audytx scan CloudFormation today?
Yes — live on the hosted MCP server via the scan_cloudformation tool (verify on /status: supported_iac lists cloudformation). The GitHub App reviews CloudFormation pull requests too; the offline CLI still scans Terraform only, with CloudFormation rolling out there next.
Scan your first template in one tool call
Mint a free Client ID, point your agent at the MCP server, and see which of your cfn_nag suppressions the context engine writes for you.