Open-source scanner for infrastructure-as-code that Microsoft Security DevOps runs; because it understands Terraform, ARM, Kubernetes manifests, CloudFormation, Helm charts and Dockerfiles, its format coverage exceeds Template Analyzer's.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Checkov in context, with comparison tables and the common traps.
Terms in this definition
- Microsoft Security DevOps
Runs security scanners like Checkov, Terrascan and Template Analyzer as part of a pipeline, either as an Azure DevOps task or a GitHub action. Setting
categories: 'IaC'restricts it to the IaC scanners. - Agents (classic) API
First-generation Foundry Agent Service API, based on threads, messages and runs. It is deprecated, replaced by conversations and responses, and retires on 31 March 2027.
- Terraform
HashiCorp's open-source tool for describing infrastructure declaratively in HCL. For Azure it relies on four providers: AzureRM, AzAPI, AzureAD and AzureDevops.
- ARM
Short for Azure Resource Manager, the control plane Azure uses for deploying and managing resources.
- FORMAT
A DAX function that turns a value into text according to a format string, for instance "MMMM" to show a month's name. Since the output is text, numeric operations can't use it, and dynamic format strings were introduced to get around that.
- Template Analyzer
Bicep and ARM templates are checked by this infrastructure-as-code scanner, which ships with Microsoft Security DevOps and bundles PSRule. Checkov or Terrascan cover Terraform, CloudFormation and Kubernetes files.