Automating Proactive Security Controls with the CloudFormation Guard Security Analyzer

Co-authored with Prabhu G , AWS Solutions Architect based out of Bangalore, India.

Organizations in regulated industries (financial services, healthcare, government) share a common bottleneck when adopting new AWS services. Before any service can be allowlisted for enterprise use, Cloud and Security teams must analyze CloudFormation resource documentation, evaluate configuration properties against threat models, and craft guardrails that prevent misconfiguration. Think enforcing encryption at rest on every S3 bucket, blocking public access by default, or requiring IMDSv2 on EC2 instances.

This work is painstaking. A single CloudFormation resource type like AWS::S3::Bucket exposes dozens of security-relevant properties. Cloud Platform and Security teams responsible for onboarding a new service may spend days going through the documentation, cross-referencing the AWS Security Best Practices, and hand-writing CloudFormation Guard rules, only to repeat the process when the next service onboarding request arrives. The result is onboarding delays, inconsistent coverage across services, and proactive controls that lag behind the pace of AWS innovation.

What if you could point an AI agent at any CloudFormation resource documentation URL and have it do the heavy lifting? What if it could identify every security-critical property, assessing risk, recommending hardening steps, and generating ready-to-use Guard rules that implement proactive controls in your CI/CD pipeline?

That is exactly what the CloudFormation Guard Security Analyzer  does. It is a multi-agent system, powered by Amazon Bedrock AgentCore, that turns days of manual security analysis into minutes.

Most organizations start their cloud security journey with detective controls, AWS Config rules that flag non-compliant resources after they have already been provisioned. Detective controls are valuable, but they operate after the fact. A misconfigured resource may exist in production for hours or days before a Config rule evaluation catches it.

Proactive controls flip this model. By evaluating CloudFormation templates before deployment, you prevent non-compliant infrastructure from ever reaching production. AWS CloudFormation Guard  is purpose-built for this: a policy-as-code language that validates templates against rules you define, integrated directly into your CI/CD pipeline. It can also be deployed as a CloudFormation Hook to enforce rules at the point of resource provisioning.

AWS provides an open-source Guard Rules Registry  with hundreds of managed rule sets mapped to AWS Config rules. However, not all resource properties are covered. New services launch frequently, security best practices evolve, and organizations often need custom rules tailored to their specific compliance requirements.

Writing custom Guard rules demands deep knowledge of both the resource specification and cfn-guard 3.x syntax. It requires understanding which properties carry security implications, what the secure default should be, and how to express that constraint in a valid rule. For a Security team responsible for dozens of services, this effort does not scale.

The CloudFormation Guard Security Analyzer addresses this gap by using AI agents to automatically generate custom Guard rules where managed rules do not yet exist. The workflow is straightforward:

Scan: Point the tool at any CloudFormation resource documentation URL. The Security Analyzer Agent scans the documentation and identifies every security-relevant configuration property. For AWS::S3::Bucket, this surfaces properties like BucketEncryption, PublicAccessBlockConfiguration, VersioningConfiguration, LoggingConfiguration, etc. Some of these resources like AWS::EC2::Instance has 41 properties.

Assess: Each identified property receives a risk assessment: CRITICAL, HIGH, MEDIUM, or LOW. The assessment includes a specific threat description explaining what happens if the property is misconfigured, along with actionable hardening recommendations grounded in AWS documentation via AWS MCP Servers.

Generate: For any identified property, the tool generates a valid cfn-guard 3.x rule. Each rule comes with pass and fail CloudFormation test templates so you can validate locally with cfn-guard validate before plugging the rule into your pipeline. The rules are ready to enforce as proactive controls. They block non-compliant templates at deployment time, not after.

The analyzer is built as a fully serverless application on AWS, orchestrated by four specialized AI agents hosted on Amazon Bedrock AgentCore using the Strands Agents SDK.

The multi-agent workflow operates in three stages:

Quick Scan (30–120 seconds): The user provides a CloudFormation resource documentation URL. The Security Analyzer Agent streams results property-by-property via Server-Sent Events, giving immediate feedback on every security-relevant property it finds. It returns a full property-by-property assessment in seconds from cached output from the previous run and under two minutes for a fresh scan.

Guard Rule Generation (per property): For any identified property, the user can request a Guard rule. The Guard Rule Generator Agent produces a valid cfn-guard 3.x rule using Strands SDK structured output with tool_use schema enforcement, ensuring syntactically correct output every time.

Detailed Analysis (2–5 minutes, optional): For deeper coverage, a Step Functions workflow orchestrates multiple agents in parallel. A Crawler Agent extracts all security-relevant properties from the documentation. Up to eight Property Analyzer Agents deep-dive each property concurrently, with progress streaming to the frontend via WebSocket in real time. Results are aggregated and a PDF report is generated.

We know that many customers would simply prefer to use the agent within AI coding tool. The integrations/ folder packages the instructions to run the agent directly inside your AI coding tool. It uses AWS MCP servers for grounded documentation reads and cfn-guard validation.

Claude Code: Install with claude --plugin-dir ./integrations/claude, then run the /cfn-guard-security-analyzer:cfn-analyze orchestrator command with a service name, resource type, or documentation URL.

Kiro: Copy the .kiro/ folder into your workspace, reference the steering doc with #cfn-security-analyzer, then ask in plain language; for example, "Generate a cfn-guard rule for AWS::S3::Bucket BucketEncryption."

Both produce identical output: a severity-ranked report plus self-validated cfn-guard rules with pass/fail templates, saved under ./cfn-analysis/.

The CloudFormation Guard Security Analyzer does not replace human judgment in security decision-making. It accelerates the most time-consuming parts of the process which are the initial analysis, rule authoring and pass/fail test CloudFormation templates. This means Security teams can focus on policy decisions rather than documentation parsing and syntax debugging.

For organizations implementing proactive controls at scale, the benefits are clear. Service onboarding timelines compress from days to minutes. Coverage becomes consistent across resource types rather than dependent on which engineer happened to author the rules. New AWS services can be evaluated and onboarded with right security controls as soon as their CloudFormation documentation is published. And every generated rule includes test templates, making validation and peer review straightforward.

If your team is responsible for defining and enforcing security guardrails on CloudFormation templates, especially in regulated environments where proactive controls are a compliance requirement, this tool is worth exploring.

We're keen to hear how you use and extend it further.

The project is open source under the MIT-0 license.

🔗 GitHub: aws-samples/sample-cfn-guard-security-analyzer 

📖 Reference: AWS CloudFormation Guard User Guide (PDF) : comprehensive documentation on Guard rule syntax, CLI usage, and CloudFormation Hooks integration.

Clone the repository, try the IDE integrations without deploying, or deploy the full serverless application with cdk deploy. The README includes detailed setup instructions, architecture diagrams, and a demo walkthrough.