Skip to main content
terminal ● cdk-insights scan
✓ 52 issues found
💡 134 Insights

Scroll down to learn more

Scroll Down Arrow

Write code.
Get insights.
Repeat.

CDK Insights is built to use AI and static analysis to audit your AWS CDK stacks, surface hidden issues, and suggest best practices — before they become problems

Check Mark Icon
Free forever static analysis
Star Icon
30+ AWS services supported
Shield Icon
No registration required

Effortless, Powerful Features

CDK Insights is packed with features that actually matter for CDK developers. No fluff, just powerful tools to make your infrastructure better.

Free Forever
Static Analysis

Free Forever Static Analysis

  • Checkmark Icon
    Security & compliance checks with CDK Nag
  • Checkmark Icon
    Linting and best practices
  • Checkmark Icon
    Fast feedback in terminal or CI
  • Checkmark Icon
    No credit card required
See QuickstartArrow Right Icon
🚧Coming Soon
Pro & AI
AI Analysis

AI-Powered Deep Analysis

  • Checkmark Icon
    Evaluates against AWS Well-Architected Framework
  • Checkmark Icon
    STRIDE threat modeling
  • Checkmark Icon
    Actionable, context-aware recommendations
  • Checkmark Icon
    JSON, Markdown, Table, or Summary output
Why Choose CDK Insights?Arrow Right Icon

How It Works

CDK Insights is simple to use. Just run a command, and it will analyze your CDK stacks to find potential issues and suggest improvements.

1

Install & Run

Get started instantly with our CLI tool. No registration required, no complex setup—just immediate analysis of your CDK stacks.

Terminal
$ npm install -g cdk-insights
$ cdk-insights scan
🔍 Analyzing your infrastructure...
🚧Coming Soon
2

AI Analysis

Advanced AI scans your infrastructure across 34 AWS services

AI Sparkles Icon
✨
34
AWS Services
3

Security

Identify vulnerabilities and compliance issues

CRITICAL
S3 Public Access
MEDIUM
IAM Permissions
LOW
Encryption
8
Issues Found
4

Cost Optimization

Identify opportunities to reduce AWS spend

LAMBDA
High memory allocation
S3
Missing lifecycle policy
S3
Intelligent tiering disabled
3
Optimizations Found
5

Export & Integrate

Multiple output formats for any workflow

JSON for CI/CD pipelines
MD
Markdown reports
▤
Table output
⚡
SARIF for IDE integration
6
Output Formats
🧠AI-Powered Analysis🚧Coming Soon

Beyond Static Analysis

I've integrated advanced AI using AWS Bedrock to deliver context-aware recommendations, intelligent code suggestions, and architectural insights that understand your specific infrastructure. Access your analysis history and manage licenses through my web dashboard.

📊

Static Analysis

Fast & Free Forever

Checkmark

Rule-based Security Checks

30+ AWS services covered

Checkmark

Cost Optimization

Find obvious savings opportunities

Checkmark

Instant Results

Analysis in seconds

🚧Coming Soon
🧠

AI Analysis

Powered by AWS Bedrock

Checkmark

Context-Aware Recommendations

Understands your specific infrastructure

Checkmark

Custom Code Suggestions

Tailored fixes with code examples

Checkmark

Architectural Pattern Recognition

Spots complex multi-resource issues

Checkmark

Natural Language Explanations

Clear explanations of issues and solutions

Checkmark

Web Dashboard Access

View analysis history and manage licenses

See AI Analysis in Action

Here's how AI goes beyond static analysis to provide intelligent, context-aware recommendations

⚠️

Static Analysis

Rule-based detection

⚠️ MEDIUM: Lambda function has high memory allocation

Memory usage may be excessive for this function

💡 Recommendation: Consider reducing memory allocation

🚧Coming Soon
🧠

AI Analysis

Context-aware insights

⚠️ MEDIUM: Lambda function has high memory allocation

Memory usage may be excessive for this function

🧠 AI Insight: Based on your function's 30s timeout and SQS message processing, 3008MB is likely over-provisioned. Most SQS processing functions work efficiently with 512-1024MB.

💡 Smart Suggestion: Reduce to 1024MB and monitor

memorySize: 1024

Powered by AWS Bedrock

CDK Insights leverages multiple foundation models via AWS Bedrock for intelligent infrastructure analysis with built-in failover

✨

Claude 3 Sonnet

Anthropic

Advanced reasoning for complex security analysis and architectural recommendations.

Deep Analysis
🔥

Mixtral 8x7B

Mistral AI

Fast mixture-of-experts model for efficient infrastructure pattern analysis.

Fast Inference
🦙

Llama 3 70B

Meta

Open-weight model providing high-quality code understanding and suggestions.

Code Analysis
⭐

Amazon Nova

AWS

AWS-native model optimized for cloud infrastructure understanding.

AWS Native
🚀

Amazon Titan

AWS

Enterprise-grade foundation model with strong security focus.

Enterprise
🔄

Smart Failover

Built-in Redundancy

Automatic model failover ensures high availability and consistent analysis results.

99.9% Uptime
🔒

Privacy-First AI Analysis

Your code never leaves your environment

Checkmark

Redacted CloudFormation Only

Only anonymized infrastructure templates are analyzed

Checkmark

Source Code Stays Local

Your CDK source code never leaves your machine

Checkmark

Automatic Redaction

Sensitive data automatically removed before analysis

Checkmark

AWS Bedrock Security

Enterprise-grade security from AWS

Why CDK Insights?

CDK Insights was built to solve the problem of discovering infrastructure issues after deployment. Now you can catch problems before they reach production.

CDK-Insights Icon

CDK Insights

Purpose-built for CDK

CDK-Specific Check

CDK-Specific Analysis

Understands CDK constructs, patterns, and best practices — not just CloudFormation

Free Forever Check

Free Forever Static Analysis

No trials, no limits on basic analysis — comprehensive static checking always free

No Registration Check

No Registration Required

Start analyzing immediately — no accounts, no signups, no barriers

Privacy-First Check

Privacy-First Design

Free tier: 100% local analysis. AI tier: sends only redacted CloudFormation templates, never source code

AI-Powered Check

Optional AI Enhancement

Upgrade to AI-powered analysis for deeper insights and contextual recommendations

Traditional Tools Icon

Traditional Tools

Generic CloudFormation analysis

Generic Analysis Cross

Generic CloudFormation Analysis

Treats your CDK code like raw CloudFormation — misses CDK-specific patterns

Pay-Walled Cross

Pay-Walled or Trial Limited

Basic analysis often requires payment or limited trial periods

Account Required Cross

Account Registration Required

Sign up barriers and account creation before you can try anything

Data Upload Cross

Data Upload Required

Upload your infrastructure code to external services for analysis

No AI Cross

Limited AI Integration

Basic rule-based analysis without intelligent context-aware recommendations

The CDK Insights Difference

Purpose-built for CDK developers who want deep, actionable insights without compromising privacy

Instant Setup Icon

Instant Setup

One command gets you started: 

npx cdk-insights scan

CDK-Native Icon

CDK-Native

Understands your CDK constructs, L2/L3 patterns, and TypeScript code structure

Smart Analysis Icon

Smart Analysis

Context-aware AI that understands your specific infrastructure patterns and requirements

Experience the difference. Try CDK Insights today and see why CDK developers choose us.

Local-First.
Privacy-Guaranteed.

The free tier runs 100% on your machine. No data leaves your environment. The AI analysis sends only redacted CloudFormation templates for advanced analysis.

Your Machine Icon

Your Machine

CDK Insights runs directly on your local machine. Your code never leaves your environment.

Analysis Flow Arrow Vertical
Analysis Engine Icon

Local Analysis

Powerful static analysis engine processes your CDK code locally using CDK-Nag and custom rules.

No Network Icon

No Network

Works completely offline. No internet connection required.

No Uploads Icon

No Uploads

Your code stays on your machine. Nothing gets uploaded anywhere.

No Tracking Icon

No Tracking

We don't track usage, collect analytics, or monitor your activity.

No Accounts Icon

No Accounts

No registration, no sign-ups, no personal information required.

How Local Analysis Works

Behind the scenes, CDK Insights leverages proven open-source tools to deliver comprehensive analysis

CDK-Nag Icon

CDK-Nag Integration

Built on AWS's own CDK-Nag for security and compliance checking

Static Analysis Icon

Static Code Analysis

Comprehensive TypeScript AST parsing and pattern matching

CloudFormation Icon

CloudFormation Synthesis

Analyzes synthesized CloudFormation templates for infrastructure insights

Best Practices Icon

Best Practice Rules

Curated rules for AWS Well-Architected Framework compliance

Export Icon

Multiple Export Formats

JSON, Markdown, Table, and Summary export options for integration

Fast Analysis Icon

Fast Analysis

Optimized for speed — most projects analyzed in under 10 seconds

Ready for Privacy-First Analysis?

Experience the security of local analysis. No servers, no uploads, no compromises.

Privacy-First.
Security-Built.

Your code should stay yours. That's why CDK Insights is designed to run locally first, with AI features that only process what you choose to share.

Local Analysis Icon

Local Analysis

Free tier runs 100% locally on your machine. No code leaves your environment. Static analysis with CDK-Nag happens entirely offline.

AI tier sends only redacted CloudFormation templates to our backend for AI analysis - never your source code.

Zero data transmission
Control Icon

You're In Control

AI analysis is completely opt-in. Static analysis runs locally by default. You decide if and when to use AI-powered features — there's no automatic data collection or background processing.

Opt-in AI features
No AI Training Icon

No AI Training

Your data is never used for AI training. CDK Insights uses AWS Bedrock, which guarantees that your inputs and outputs are not used to train or improve foundation models.

AWS Bedrock guarantee

Additional Security Measures

End-to-End Encryption Check

End-to-End Encryption

All data in transit protected with TLS 1.2+ encryption

Zero-Knowledge Architecture Check

Minimal Data Collection

We only collect the minimum data necessary for analysis and recommendations

Secure Payment Processing Check

Secure Payment Processing

Payments handled by Stripe — we never store card details

Regular Security Audits Check

Security Monitoring

Built-in monitoring and security best practices

GDPR & SOC 2 Compliant Check

Privacy Standards

Designed with privacy-first principles and minimal data collection

AWS Infrastructure Check

AWS Infrastructure

Built on AWS with enterprise-grade security and compliance

Ready to analyze your CDK stacks with complete privacy? Start with our free tier — no registration required.

Built for Trust.
Designed for Reliability.

Your trust is everything. CDK Insights is built with security and reliability at its core, ensuring your infrastructure analysis is both safe and accurate.

Security First Icon

Security First

Privacy by design

Local First Check

Local-First Analysis

Static analysis runs entirely on your machine

Encryption Check

End-to-End Encryption

All communications protected with TLS 1.2+ encryption

Audit Check

Security Best Practices

Built with industry-standard security practices and principles

CDK-Nag Integration Check

CDK-Nag Integration

Works with AWS's open source CDK-Nag for static analysis

Reliability Icon

Reliability

Built to last

Uptime Check

High Availability

Built on AWS's reliable cloud infrastructure

Graceful Fallback Check

Graceful Fallbacks

Static analysis always works, even without connectivity

Serverless Check

Serverless Architecture

Scales automatically with demand, no single points of failure

Monitoring Check

System Monitoring

Built-in monitoring and error tracking

Transparency Icon

Transparency

Open and honest

Clear Pricing Check

Clear Pricing

Simple, transparent pricing with no hidden fees or surprises

Privacy Check

Privacy Policy

Clear documentation of our data handling practices

Documentation Check

Open Documentation

Comprehensive guides and documentation freely available

Changelog Check

Public Changelog

Detailed release notes and feature updates

Security & Privacy Principles

Built on industry best practices for security, privacy, and reliability

Security-First Design Icon

Security-First Design

Built with security as a core design principle

Privacy-Focused Icon

Privacy-Focused

Minimal data collection with privacy-first design principles

Industry Standards Icon

Industry Standards

Follows established security best practices

AWS Security Icon

AWS Security

Built on AWS's secure cloud infrastructure

Trust Built on Action, Not Words

Every design decision prioritizes your security and privacy. Experience the difference of infrastructure analysis built for the modern enterprise.

Outputs That Fit Your Workflow

CDK Insights is designed to fit into your existing workflow. Whether you prefer markdown reports, GitHub issues, or direct integration, you'll get insights in the format that works best for you.

cdk-insights scan
markdown output
↕ scroll

**Executive Summary:**

We discovered **366 total issues** across **71 resources** (97.2% with issues).

**Top Priorities:**

🔴 14 Critical severity issues

🟠 52 High severity issues

MetricCount
Resources scanned71
Resources with issues69
Total issues found366
% of resources with issues97.2%

### WAF Pillar Impact

• **Operational Excellence**: 136

• **Security**: 140

• **Cost Optimization**: 66

• **Reliability**: 18

• **Performance Efficiency**: 6

• **Sustainability**: 0

### Next Steps

1. Triage 🔴 critical issues first

2. Fix 🟠 high‐impact items next

3. Schedule 🟡 medium‐priority tasks

4. Plan 🟢 low‐priority enhancements

Resource: InsecureIamRole41A4AD76

🔴🔴🔴 CRITICAL Severity Issue 🔴🔴🔴

  • • Issue: IAM policy allows full access to all resources.
  • • Recommendation: Restrict IAM policies to least privilege access.
  • • 📍 Source Location: cdk/stacks/TestCdkInsightsStack.ts:26:5
  • • Source Path: TestCdkInsightsStack/InsecureIamRole41A4AD76
  • • WAF Pillar: Security

🔴🔴🔴 CRITICAL Severity Issue 🔴🔴🔴

  • • Issue: The role has been granted the AWS managed policy AdministratorAccess, which provides full access to AWS services and resources.
  • • Recommendation: Review the permissions granted to the role and replace the AdministratorAccess policy with the minimum necessary permissions.
  • • 📍 Source Location: cdk/stacks/TestCdkInsightsStack.ts:26:5
  • • Source Path: TestCdkInsightsStack/InsecureIamRole41A4AD76
  • • WAF Pillar: Security

Potential Fix Example:

// Example of a more restrictive policy
const restrictedPolicy = new iam.Policy(this, 'RestrictedPolicy', {
  statements: [
    new iam.PolicyStatement({
      actions: ['s3:GetObject', 's3:PutObject'],
      effect: iam.Effect.ALLOW,
      resources: ['arn:aws:s3:::example-bucket/*']
    }),
  ],
});
// Assign the policy to the role
role.addManagedPolicy(restrictedPolicy);
JSON Format Icon

JSON Export

Machine-readable structured data perfect for automation and CI/CD pipelines.

cdk-insights scan --output json
Markdown Format Icon

Markdown Reports

Human-readable documentation perfect for GitHub issues and team sharing.

cdk-insights scan --output markdown
Table Format Icon

Table View

Clean tabular output with colored severity levels - the default format.

cdk-insights scan --output table
Summary Format Icon

Summary View

Concise overview showing just the essential metrics and highest priority issues.

cdk-insights scan --output summary
GitHub Integration Icon

GitHub Integration

Automatically create GitHub issues from findings

# Create GitHub issues from findings cdk-insights scan --with-issue # Perfect for CI/CD workflows cdk-insights scan --output json --with-issue

Requires GitHub CLI (gh) to be installed and authenticated

Configuration Icon

Smart Configuration

Save your preferences and customize analysis

# Set your preferred output format cdk-insights config set output markdown # Focus on specific services cdk-insights config set services IAM,S3,Lambda # View current settings cdk-insights config list

Configuration persists across all analyses