AWS CloudFormation vs Checkov

AWS CloudFormation models, provisions, and manages related AWS and third-party resources as infrastructure as code. YAML or JSON templates define AWS resources and their properties. StackSets deploy a common set of resources across multiple AWS accounts and Regions; Change Sets preview proposed stack updates, including possible deletion or replacement, and Drift Detection tracks changes made outside the service. For authoring, AWS CDK supports TypeScript, Python, Java, and .NET, while AWS SAM offers shorthand YAML for serverless resources that is converted during deployment. The CloudFormation Registry supports third-party resources and modules, and stacks can be updated from remote Git repositories. The service is available through API, Linux, macOS, web, and Windows, and manages state. CloudFormation itself has a free plan, with no additional charge for AWS and Alexa resource providers, but created AWS resources are billed at their standard rates. Third-party provider and custom hook operations may also incur charges. Access can be managed with IAM, and CloudTrail logs API calls.

Checkov is a free tool for scanning infrastructure-as-code files for configuration problems that could affect security or compliance. Its documented targets include Terraform, CloudFormation, ARM, Serverless, Helm, Kubernetes, and Docker. The policy library contains more than 750 predefined checks, including checks for standards such as CIS and the AWS Foundations Benchmark. Checkov can also identify common credentials in IaC files, including AWS access keys, Azure service credentials, and private keys. Teams can create custom attribute policies in Python or YAML and composite policies in YAML. Documented continuous-integration integrations include Jenkins, Bitbucket Cloud Pipelines, GitHub Actions, and GitLab CI. Add-ons for Visual Studio Code and JetBrains provide real-time scanning and inline fixes. Installation is documented through pip and Homebrew, with Homebrew specified for macOS or Linux. The project supports Python 3.9 through 3.13 and is distributed under the Apache-2.0 license. Prisma Cloud extends Checkov with runtime scanning, visibility, native VCS integrations, drift detection, and pull request annotations. Alpine is not officially tested or supported; it requires Python 3.11 or later.