cfn-lint: Validate CloudFormation Templates
cfn-lint template.yaml checks a CloudFormation template against AWS resource specs and rules, printing Exxxx/Wxxxx findings and failing on errors.
cfn-lint goes far beyond aws cloudformation validate-template: it checks properties, types, intrinsic functions, and best practices offline, so bad IaC fails in CI, not at deploy.
What it does
cfn-lint parses a CloudFormation template (YAML or JSON), resolves intrinsic functions, and validates every resource against the AWS resource provider schemas plus a rule set. Each finding has an id: E-prefixed rules are errors, W-prefixed are warnings, I-prefixed are informational. It exits non-zero when errors are present.
Common usage
pip install cfn-lint
# lint one template
cfn-lint template.yaml
# lint every template by glob
cfn-lint templates/**/*.yaml
# check for a specific region's resource support
cfn-lint --regions us-east-1 eu-west-1 -- template.yaml
# format results for GitHub annotations
cfn-lint --format github template.yamlOptions
| Flag | What it does |
|---|---|
| --regions <r...> | Regions to validate resource availability against |
| --format json|github|junit|sarif | Output format for CI ingestion |
| --ignore-checks <id...> | Suppress specific rules, e.g. W3005 |
| --include-checks <id...> | Enable informational (I) rules |
| --template <file> | Explicit template path |
| --non-zero-exit-code error|warning|none | Which severity makes it exit non-zero |
In CI
Run cfn-lint as a step on every push touching templates; errors already produce a non-zero exit, so the job fails on invalid IaC. Use --format github for inline annotations, and --non-zero-exit-code warning if you want warnings to block merges too.
Common errors in CI
E3012 Property Resources/MyBucket/Properties/VersioningConfiguration should be an object flags a type/structure error. E1010 Invalid GetAtt ... means an intrinsic function references a resource or attribute that does not exist. E0000 Template needs to be an object means the file is not valid YAML/JSON. W3005 Obsolete DependsOn is a warning by default. E1001 Top level template section X is not valid flags an unknown top-level key.