Checkov vs terraform-compliance
Checkov
checkov.ioterraform-compliance
terraform-compliance.comSide by side
| Figure | Checkov | terraform-compliance |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| macOS | Yes | — |
| Linux | Yes | Yes |
| Self-hosted | — | Yes |
| Plans published | 1 | 1 |
| Spec score · Infrastructure Testing Tools | 8.0 (#10) | 7.2 (#20) |
| Spec score · Infrastructure Policy as Code Tools | 7.9 (#12) | 7.2 (#18) |
| Spec score · IaC Security Scanners | 7.9 (#8) | 7.2 (#11) |
| CI integrations | The documentation describes integrations with Jenkins, Bitbucket Cloud Pipelines, GitHub Actions, and GitLab CI. | The documentation includes CI/CD examples for CircleCI and GitHub Actions. |
| License | The Checkov GitHub repository identifies its license as Apache-2.0. | The maker’s site says the project is open source, free to use, and distributed under the MIT license. |
| Purpose | Checkov scans infrastructure-as-code files for misconfigurations that can cause security or compliance problems. | terraform-compliance is a lightweight, security- and compliance-focused test framework for negative testing of infrastructure as code written with Terraform. |
Plans
In their own words
Checkov
Checkov is a free tool for scanning infrastructure-as-code files for configuration problems that could affect security or compliance. Its documented targets include Terraform, CloudFormation, ARM, Serverless, Helm, Kubernetes, and Docker. The policy library contains more than 750 predefined checks, including checks for standards such as CIS and the AWS Foundations Benchmark. Checkov can also identify common credentials in IaC files, including AWS access keys, Azure service credentials, and private keys. Teams can create custom attribute policies in Python or YAML and composite policies in YAML. Documented continuous-integration integrations include Jenkins, Bitbucket Cloud Pipelines, GitHub Actions, and GitLab CI. Add-ons for Visual Studio Code and JetBrains provide real-time scanning and inline fixes. Installation is documented through pip and Homebrew, with Homebrew specified for macOS or Linux. The project supports Python 3.9 through 3.13 and is distributed under the Apache-2.0 license. Prisma Cloud extends Checkov with runtime scanning, visibility, native VCS integrations, drift detection, and pull request annotations. Alpine is not officially tested or supported; it requires Python 3.11 or later.
terraform-compliance
terraform-compliance is a free, open-source framework for security and compliance testing of Terraform infrastructure as code. It checks Terraform plan or state output against policies written as behavior-driven feature files, and it can read plan output converted to JSON. Given steps establish context, When steps filter it, and Then steps fail scenarios when conditions are unmet. The project says it works with any Terraform provider and supports Terraform versions newer than 0.12. Checks can run before deployment, in pipelines, or through git hooks. Feature files may come from a local directory or Git repository, with SSH authentication for private repositories. Installation is documented through pip, requiring Python 3.x, or Docker. CI/CD examples cover CircleCI and GitHub Actions. Controls include warning-only failures, skipped-step failures, case-sensitive matching, and resource exclusion. The tool supports policy testing, admission control, and policy reporting, but not runtime enforcement. Its MIT license permits free use.