DriftArmor — IaC governance engineInstall

Ship Azure rightbefore you apply.

DriftArmor checks your Terraform plan JSON against secure Azure defaults — AKS, SQL, Storage, Redis, and more — with Microsoft Learn citations on every finding.

Install the CLIView on GitHub

The gap

Docs are long. Missed defaults are expensive.

Open networks, weak TLS, skipped identities, and destructive plan changes show up later as incident hours — not as a line item on day one. DriftArmor puts the checklist in your terminal while the plan is still a plan.

What it checks

Auto-detects Azure products in your plan.

check runs the matching packs. drift gates delete and replace on the same product groups.

  • AKS

    Cluster presence, RBAC, monitoring, API exposure

  • Azure SQL

    Public network, Entra admin, TLS, firewall, TDE

  • SQL Managed Instance

    Public data endpoint, TLS, Entra admin, identity

  • Storage

    HTTPS, TLS, public blobs, network rules

  • Managed Redis

    Public network, encrypted protocol, access keys, identity

  • Key Vault

    RBAC authorization, purge protection, network

  • ACR

    Admin account, anonymous pull, network

  • Service Bus

    Local auth, TLS, namespace network rules

  • Virtual Machines

    Encryption at host, Trusted Launch, SSH, identity

  • NSG

    No SSH/RDP/all-ports from the Internet

  • Front Door

    WAF attached, enabled, Prevention, managed rules

How it works

One input. A citation checklist. Clear exit codes.

  1. 01

    Point at the module

    driftarmor check --dir . runs terraform plan and show -json for you — or pass an existing --plan file.

  2. 02

    Run driftarmor check

    Packs auto-detect; Checkov evaluates; results map to product rules.

  3. 03

    Fix with citations

    Pass, fail, warn, or manual — each row links a Learn URL.

Install

Local CLI. No SaaS required.

Install from PyPI, then check a Terraform module directory.

pip install driftarmor
driftarmor check --dir .
driftarmor drift --dir .