How does cfn-guard differentiate from cfn-linter?

[tvb]

Hi AWS,

Awesome news! cfn-guard really looks promising. I do have one question. How does cfn-guard differentiate from cfn-linter (https://github.com/aws-cloudformation/cfn-python-lint)?

[adamchainz]

This is also my question. I've written custom cfn-lint rules for compliance. cfn-guard seems to be a faster way of writing such rules. Why isn't it part of cfn-lint?

[nathanataws]

We see the two tools as complementary. As @adamchainz has correctly intuited, cfn-guard is purpose-built and optimized specifically for the tasks of rule-writing and checking.

[tvb]

Hi @nathanataws thank you for replying.

Could you elaborate a bit more on this? If you can write rules in cfn-guard, why would one write rules also in cfn-lint?

I think I understand what you are saying. It means we can use the basic checks for valid CFN with cfn-lint and if you need custom rules (e.g.: check for missing tags?) you can use cfn-guard to write these?

[MTNPCGCG]

Will there be a mechanism for more complex (programmatic rules) as well? For most rules, the rule syntax from cfn-guard is fantastic, but occasionally something more complex might be needed.

[ranman166]

So I could assume this is similar to cfn-nag?

[n1t1nv3rma]

IMO, this is a great tool for non-programmers to create simple and easy to understand validation rules.
So one canjust rely on combination of standard AWS CLI "aws cloudformation validate-template..." and CFN Guard.

[PatMyron]

So one canjust rely on combination of standard AWS CLI "aws cloudformation validate-template..." and CFN Guard.

aws cloudformation validate-template unfortunately only does very basic validation and does not catch much

cfn-guard and opa focus on faster custom rule writing for concise constraints and don't have plans for default rules

cfn-lint focuses more on default rules which mostly catch deployment failures since CloudFormation itself doesn't do enough static analysis before provisioning resources
(cfn-lint has other default rules like not hardcoding sensitive properties/availability zones/partitions/etc, setting DeletionPolicy/UpdateReplacePolicy to protect certain resources, approaching template limits, unused Parameters/Mappings/Conditions, etc.)

cfn_nag/cfripper default rules focus more on security

cfn-lint/cfn_nag/cfripper all support more extensible custom rules in addition to their default rules if custom rules aren't expressible within cfn-guard / opa concise constraints

[razcloud]

Closing this issue as it was a Q&A, and the original question was answered.

For other questions, please create a new Issue. Thank you.