---
id: cdk-nag
version: "3.0.2"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# cdk-nag — Check CDK v2 applications for best practices using a combination on available rule packs.

License: permissive · Maintenance: active · Downloads: 3.7M/mo

## What it is and what it does

cdk-nag is a linting and compliance-checking tool for CDK applications and CloudFormation templates. It runs predefined rule packs—including AWS Solutions best practices, HIPAA security, NIST 800-53 revisions 4 and 5, PCI DSS 3.2.1, and Serverless patterns—to detect security misconfigurations and compliance gaps in infrastructure code. The tool integrates into validation frameworks, allowing you to suppress specific violations on individual constructs or stacks with inline acknowledgments and audit trails.

The package depends on aws-cdk-lib, constructs, jsii, and publication. It supports Python 3.10 through 3.14 and is actively maintained. Violations are reported in a policy-validation-report.json file in the cloud assembly, with optional CloudFormation metadata integration for compatibility with existing compliance tooling.

Use it for:

- Enforce best practices across CDK applications before synthesis or deployment.
- Validate infrastructure code against regulatory frameworks during CI/CD pipelines.
- Suppress known violations on specific resources with documented reasons for audit compliance.
- Scan CloudFormation templates directly for security and compliance issues.
- Integrate compliance checking into synthesis pipelines to catch violations early.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Scans AWS CDK applications and CloudFormation templates against predefined rule packs to identify security and compliance violations.

Yes. cdk-nag is actively maintained, has no known vulnerabilities, low install friction, and provides essential compliance and security scanning for CDK users. The permissive Apache-2.0 license poses no restrictions. Install it if you use CDK and need to enforce security or compliance standards.

## Install

pip install cdk-nag
uv add cdk-nag
poetry add cdk-nag

## Installing cdk-nag

Before you install: Low install friction with a pure Python wheel distribution. Actively maintained with recent releases and 1032 repository stars.

License in practice: Licensed under Apache-2.0 (permissive), allowing free use, modification, and distribution with minimal restrictions.

Quickstart:

pip install cdk-nag

from cdk_nag import AwsSolutionsChecks
from constructs import Construct

Validations.of(app).add_plugins(AwsSolutionsChecks(app))

Requires Python 3.10 or later; aws-cdk-lib and constructs must be installed as runtime dependencies.

Verify before relying:

- Whether all rule packs (AWS Solutions, HIPAA, NIST 800-53 rev 4/5, PCI DSS, Serverless) are equally mature or if some are experimental.
- Performance characteristics when scanning large CDK applications or complex CloudFormation templates.
- Specific use cases for the publication runtime dependency.

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 3.7M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

cdk security scanning, cloudformation compliance checking, aws best practices validation, cdk rule enforcement, infrastructure compliance audit, compliance-scanning, infrastructure-as-code

[View on SkillFed](https://skillfed.io/packages/cdk-nag) · [View on PyPI](https://pypi.org/project/cdk-nag/)