Review AWS CloudFormation (beta)

Beta Cloudeval can review supported AWS CloudFormation JSON and YAML as static infrastructure-as-code. This does not connect to a live AWS account and does not provide Azure/AWS feature parity.

Why it matters

Use this workflow to identify applicable template risks before deployment, generate architecture context, and carry evidence into GitHub or CLI review. Unsupported or unavailable evaluation areas must remain Not assessed rather than appearing to pass.

Quick example

Start with the public AWS CloudFormation review example.

git clone https://github.com/ganakailabs/cloudeval-aws-cloudformation-review-example.git
cd cloudeval-aws-cloudformation-review-example
cloudeval review --source-root . --format json --output review

Demo pull requests

The example repository keeps long-lived PRs open so you can inspect the review output before wiring your own repository:

Demo PR	Expected check after setup	What to inspect
Passing baseline	Green	CloudFormation YAML and JSON import with a clean baseline review.
Public access regression	Red	S3 public access, network exposure, and database findings.
Deployment-quality regression	Red	cfn-lint-style deployment-quality feedback for invalid references.
Review surfaces demo	Red	PR summary, Cloudeval App Check Run annotations, SARIF/code scanning upload, and workflow artifacts for CloudFormation.

The Action runs only after the repository has a Cloudeval GitHub project and the CLOUDEVAL_ACCESS_KEY and CLOUDEVAL_PROJECT_ID secrets are configured. Without those secrets, the example workflow exits early so forks are safe.

Supported workflow

Choose a supported template source

Use CloudFormation JSON or YAML from a local workspace or GitHub-linked project.

Confirm the project boundary

For repositories with multiple or nested templates, commit .cloudeval/config.yaml and identify the intended roots and entry templates.

Run the review

Use the CLI locally or the GitHub Action in CI. Keep the ref, commit, and source root with the review artifact.

Inspect applicability

Review findings, evidence, unsupported resources, and every Not assessed area before making a merge decision.

Coverage boundary

Area	Current behavior
CloudFormation JSON and YAML ingestion	Beta static evaluation for supported templates
Source-linked GitHub review	Available through the documented repository and Action workflows
Architecture and evaluation output	Depends on parsed resources and applicable checks
Live AWS account connection	Not available
Runtime telemetry or deployed-state proof	Not available from static CloudFormation input
Unsupported services or signals	Report as unsupported or `Not assessed`; do not infer a pass

Do not describe this workflow as live AWS assessment, full CNAPP coverage, or provider parity. The evidence is limited to the supplied source and supported static evaluation paths.

Supported clouds and IaC formats
Evaluation coverage
IaC project configuration
Review with GitHub Actions
Review CloudFormation before deployment: tools compared — compare linting, policy checks, PR review and change sets.

​Why it matters

​Quick example

​Demo pull requests

​Supported workflow

​Coverage boundary

​Related pages

Why it matters

Quick example

Demo pull requests

Supported workflow

Coverage boundary

Related pages