Bicep and ARM templates are checked by this infrastructure-as-code scanner, which ships with Microsoft Security DevOps and bundles PSRule. Checkov or Terrascan cover Terraform, CloudFormation and Kubernetes files.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Template Analyzer in context, with comparison tables and the common traps.
Terms in this definition
- Bicep
Domain-specific language for declaring Azure infrastructure as code, which is compiled into ARM templates.
- ARM
Short for Azure Resource Manager, the control plane Azure uses for deploying and managing resources.
- Microsoft Security DevOps
Runs security scanners like Checkov, Terrascan and Template Analyzer as part of a pipeline, either as an Azure DevOps task or a GitHub action. Setting
categories: 'IaC'restricts it to the IaC scanners. - Checkov
Open-source scanner for infrastructure-as-code that Microsoft Security DevOps runs; because it understands Terraform, ARM, Kubernetes manifests, CloudFormation, Helm charts and Dockerfiles, its format coverage exceeds Template Analyzer's.
- Terraform
HashiCorp's open-source tool for describing infrastructure declaratively in HCL. For Azure it relies on four providers: AzureRM, AzAPI, AzureAD and AzureDevops.