An open-source policy-as-code tool that validates JSON/YAML data like CloudFormation and Kubernetes configs against custom rules.
AWS CloudFormation Guard is an open-source policy-as-code tool that allows developers to define custom rules using a domain-specific language (DSL) and validate JSON or YAML data against them. It is commonly used to enforce security, compliance, and best practices on infrastructure-as-code templates like CloudFormation, Kubernetes configurations, and Terraform plans. The tool helps shift governance left by catching policy violations early in the development and deployment lifecycle.
DevOps engineers, cloud architects, and platform teams who manage infrastructure-as-code and need to enforce organizational policies across CloudFormation, Kubernetes, Terraform, or similar configurations.
Developers choose Guard for its purpose-built, expressive DSL that simplifies policy writing without requiring general programming skills, its support for stateful rules and unit testing, and its seamless integration into CI/CD pipelines and pre-commit hooks for automated validation.
Guard offers a policy-as-code domain-specific language (DSL) to write rules and validate JSON- and YAML-formatted data such as CloudFormation Templates, K8s configurations, and Terraform JSON plans/configurations against those rules. Take this survey to provide feedback about cfn-guard: https://amazonmr.au1.qualtrics.com/jfe/form/SV_bpyzpfoYGGuuUl0
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
The Guard DSL uses human-readable clauses and queries, allowing complex rules like S3 bucket encryption checks without general programming, as demonstrated in the README examples.
Supports JSON and YAML data for CloudFormation, Kubernetes, Terraform plans, and AWS Config, enabling broad infrastructure policy enforcement across tools.
Includes a test command with YAML-based test files, letting developers verify rule behavior for reliability, shown in the API Gateway unit test example.
Can be used in GitHub Actions, pre-commit hooks, and Docker containers, facilitating automated governance in pipelines, with templates provided in the README.
Guard does not support importing policies from remote locations like S3 or GitHub; all rules must be stored locally, limiting dynamic updates.
Only validates Terraform JSON plans, not native HCL files, requiring conversion steps for compliance checks, as admitted in the README's limitations.
Major version updates (e.g., 2.0+) are backward incompatible with older rules, forcing migration efforts, as warned in the release notes section.