Checkov vs terraform-plugin-testing

Checkov is a free tool for scanning infrastructure-as-code files for configuration problems that could affect security or compliance. Its documented targets include Terraform, CloudFormation, ARM, Serverless, Helm, Kubernetes, and Docker. The policy library contains more than 750 predefined checks, including checks for standards such as CIS and the AWS Foundations Benchmark. Checkov can also identify common credentials in IaC files, including AWS access keys, Azure service credentials, and private keys. Teams can create custom attribute policies in Python or YAML and composite policies in YAML. Documented continuous-integration integrations include Jenkins, Bitbucket Cloud Pipelines, GitHub Actions, and GitLab CI. Add-ons for Visual Studio Code and JetBrains provide real-time scanning and inline fixes. Installation is documented through pip and Homebrew, with Homebrew specified for macOS or Linux. The project supports Python 3.9 through 3.13 and is distributed under the Apache-2.0 license. Prisma Cloud extends Checkov with runtime scanning, visibility, native VCS integrations, drift detection, and pull request annotations. Alpine is not officially tested or supported; it requires Python 3.11 or later.

terraform-plugin-testing is a free Go helper module for testing Terraform providers on Linux and macOS. It supports unit tests that exercise plugin code in isolation without network connections, and acceptance tests that run real Terraform plan, apply, refresh, and destroy operations. Acceptance testing includes Lifecycle, Import, Refresh, and Query modes. The plancheck package can inspect empty or non-empty plans, resource and data source values, and actions. The statecheck package checks known values, sensitive values, and comparisons between resource or data source attributes. The framework uses a local Terraform binary with standard Go testing tools, including go test and the testing package, so tests can run in continuous integration environments such as GitHub Actions. Acceptance runs may create and destroy infrastructure, which can consume quotas and incur expenses. Prerequisites include a recent stable Go release, Terraform CLI 0.12.26 or later, provider and resource access, and TF_ACC set to a value. The project uses Mozilla Public License v2.0.