Checkov vs Terratest

Checkov is a free tool for scanning infrastructure-as-code files for configuration problems that could affect security or compliance. Its documented targets include Terraform, CloudFormation, ARM, Serverless, Helm, Kubernetes, and Docker. The policy library contains more than 750 predefined checks, including checks for standards such as CIS and the AWS Foundations Benchmark. Checkov can also identify common credentials in IaC files, including AWS access keys, Azure service credentials, and private keys. Teams can create custom attribute policies in Python or YAML and composite policies in YAML. Documented continuous-integration integrations include Jenkins, Bitbucket Cloud Pipelines, GitHub Actions, and GitLab CI. Add-ons for Visual Studio Code and JetBrains provide real-time scanning and inline fixes. Installation is documented through pip and Homebrew, with Homebrew specified for macOS or Linux. The project supports Python 3.9 through 3.13 and is distributed under the Apache-2.0 license. Prisma Cloud extends Checkov with runtime scanning, visibility, native VCS integrations, drift detection, and pull request annotations. Alpine is not officially tested or supported; it requires Python 3.11 or later.

Terratest is an open-source Go library for writing automated tests for infrastructure code. Its helpers cover Terraform, OpenTofu, Terragrunt, Packer, Helm, Docker, and Kubernetes, as well as AWS, Azure, and GCP APIs. Tests can run infrastructure tools, deploy real resources, validate the resulting environment, and remove resources afterward. Validation can use HTTP requests, API calls, SSH connections, and shell commands. The documentation covers unit, integration, and end-to-end tests, along with parallelism, retries, error handling, and static analysis. Terratest runs locally and supports configuration-compliance checks, provisioning tests, deployed checks, and policy as code. The project is free under the Apache 2.0 License. The quick start requires Go 1.26 or later and OpenTofu or Terraform for its examples. The documentation recommends cleaning up after tests because they may create resources in real environments. General questions and issue reports go through GitHub Discussions and Issues; Gruntwork offers commercial support to companies using Terratest in production. The v1 line receives security fixes only while v2 is in development.