CloudFormation Guard helps you enforce policies on your infrastructure using a domain-specific language (DSL). Guard allows you to define rules against JSON and YAML formatted data like CloudFormation templates, Kubernetes configurations, and Terraform configurations. It addresses the challenge of ensuring infrastructure conforms to organizational standards for security and compliance.
Guard's DSL is designed for clarity and expressiveness, making policies easy to write and understand. It offers features like looping, filtering, and composable rules for advanced policy creation. Guard supports various use cases, from preventative governance to deployment safety checks, and integrates with CI/CD pipelines.
- Policy-as-Code: Define and enforce policies using a declarative DSL.
- Multi-Domain Support: Validates CloudFormation, Kubernetes, Terraform, and more.
- Extensible: Supports custom rules and integrations with external data sources.
- CI/CD Integration: Easily integrate Guard into CI/CD pipelines for automated validation.
- Flexible Rule Engine: Enables complex policy logic with loops, conditions, and queries.
- JSON/YAML Output: Provides parseable output for automated reporting and remediation.
- Pre-commit Hook Support: Enforces policies before code is committed to repositories.
Guard has been actively developed and maintained with a focus on backward compatibility updates and new features in recent releases. It has a growing community of users and contributors. CloudFormation Guard version 3.0 has introduced new functionality including stateful rules, SAM CLI support, and improved regular expression handling which indicates a commitment to continued development.
Guard benefits DevOps teams, security engineers, and developers who want to automate the enforcement of infrastructure policies. It is ideal for preventing misconfigurations, ensuring compliance, and improving deployment safety. By validating infrastructure as code early in the development lifecycle, Guard reduces risks and promotes consistency.