How does cfn-guard differentiate from cfn-linter?

[tvb]

Hi AWS,

Awesome news! cfn-guard really looks promising. I do have one question. How does cfn-guard differentiate from cfn-linter (https://github.com/aws-cloudformation/cfn-python-lint)?

[adamchainz]

This is also my question. I've written custom cfn-lint rules for compliance. cfn-guard seems to be a faster way of writing such rules. Why isn't it part of cfn-lint?

[nathanataws]

We see the two tools as complementary. As @adamchainz has correctly intuited, cfn-guard is purpose-built and optimized specifically for the tasks of rule-writing and checking.

[tvb]

Hi @nathanataws thank you for replying.

Could you elaborate a bit more on this? If you can write rules in cfn-guard, why would one write rules also in cfn-lint?

I think I understand what you are saying. It means we can use the basic checks for valid CFN with cfn-lint and if you need custom rules (e.g.: check for missing tags?) you can use cfn-guard to write these?

[MTNPCGCG]

Will there be a mechanism for more complex (programmatic rules) as well? For most rules, the rule syntax from cfn-guard is fantastic, but occasionally something more complex might be needed.

[ranman166]

So I could assume this is similar to cfn-nag?

[n1t1nv3rma]

IMO, this is a great tool for non-programmers to create simple and easy to understand validation rules.
So one canjust rely on combination of standard AWS CLI "aws cloudformation validate-template..." and CFN Guard.

[PatMyron]

So one canjust rely on combination of standard AWS CLI "aws cloudformation validate-template..." and CFN Guard.

aws cloudformation validate-template only does primitive validation and does not catch much

cfn-guard/opa focus on fast custom rule writing for concise constraints and don't have default rules

cfn-lint focuses more on default rules which mostly catch deployment failures since CloudFormation itself doesn't do much static analysis before provisioning resources
(cfn-lint has other default rules like not hardcoding sensitive properties/availability zones/partitions/etc, setting DeletionPolicy/UpdateReplacePolicy to protect resources, approaching template limits, unused Parameters/Mappings/Conditions, etc.)

cfn_nag/cfripper default rules focus on security

cfn-lint/cfn_nag/cfripper also support more extensible custom rules if custom rules aren't expressible within cfn-guard / opa concise constraints

[razcloud]

Closing this issue as it was a Q&A, and the original question was answered.

For other questions, please create a new Issue. Thank you.

[miparnisari]

So, to summarize, this was a project created by someone who got very excited about Rust, and instead of building something new, they rewrote a tool that already existed, in an ecosystem of tools that was already quite large.

I'm not saying this is a bad thing but a better choice would have been to release this project as a personal project and not under the CFN umbrella. Because this just left customers of CFN confused.