Evaluation methodology and sources

Cloudeval’s core product is the evaluation layer. It builds a project model, resolves infrastructure context, creates architecture graph and cost signals, applies reviewed scoring treatment, normalizes evidence, and turns results into reports, release gates, exports, and agent-ready context. Pinned open-source tools contribute selected evidence to that workflow. They do not define the product experience or scoring by themselves; Cloudeval attributes them clearly when their catalogs contribute observations.

Applicable checks depend on provider, IaC format, resources, project configuration, and enabled policies. Not every project runs every check.

Cloudeval evaluation surface

Cloudeval capability	What Cloudeval adds
Project modeling	Source scope, provider, format, configuration, report history, sharing state, and evidence boundaries.
Architecture and dependency context	Graph, topology, relationships, affected resources, and review context.
Cost and FinOps context	Cost estimates, coverage warnings, service-family summaries, and savings context for common billable Azure services.
Reviewed scoring	Separates reviewed Well-Architected-style treatment from deployment-quality and additional IaC observations.
Normalization and deduplication	Turns multiple evidence sources into clearer findings without asking users to reconcile duplicate observations manually.
Release gates and reports	Converts evidence into report sections, issue counts, gates, exports, and stakeholder-ready summaries.
Agent-ready context	Provides scoped report and evidence context for CLI, MCP-compatible agents, and handoff workflows.
Third-party evidence attribution	Lists tool names, versions, licenses, and source links transparently when outside catalogs contribute observations.

Published coverage counts

Metric	Public wording	How to read it
Attributed cloud and IaC checks	1,650+ attributed cloud and IaC checks	The published lower-bound count across pinned scanner catalogs before Cloudeval applicability, reviewed scoring, normalization, deduplication, and output treatment are applied.

This is a conservative public lower bound, not a promise that every project runs every check. Cloudeval rounds down because applicability can change when providers, IaC formats, resources, project configuration, and policies change. Cloudeval’s project model, graph, cost context, reports, and evidence treatment add practical value around those checks without being presented as a separate numerical count.

How Cloudeval uses evidence

Third-party catalog snapshot

Snapshot date: July 11, 2026.

Workflow	Approximate scanner-native checks
Azure ARM	743
Azure Bicep	684
AWS CloudFormation	460
AWS Terraform	455
Azure Terraform	302

Workflow counts overlap and must not be added together. A scanner check can apply to more than one workflow or IaC format.

Third-party roles

Tool	Pinned version	Provider and format	Role inside Cloudeval	Default output treatment
PSRule.Rules.Azure	`1.47.0`	Azure ARM and Bicep-generated ARM	Azure architecture evidence	Reviewed Azure architecture mappings can contribute to Cloudeval architecture review.
ARM TTK	`20250401 (0.26)`	Azure ARM	Template deployment-quality evidence	Deployment quality.
Checkov	`3.3.6`	ARM, Bicep-generated ARM, CloudFormation, and Terraform where supported	Additional IaC evidence	Additional IaC findings unless Cloudeval has reviewed a different output treatment.
cfn-lint	`1.52.1`	AWS CloudFormation	CloudFormation syntax, resource model, and deployment-quality evidence	Deployment quality.
AWS CloudFormation Guard	`3.2.0`	AWS CloudFormation	AWS beta policy evidence and release-gate evaluation	Reviewed AWS beta controls where Cloudeval supports that treatment.

Count methodology

Method	Public behavior
Public coverage floor	`1,650+ attributed cloud and IaC checks` covers the deduplicated lower bound across the pinned scanner catalogs listed above.
Pinned third-party versions	Catalog counts are taken from the tool versions listed above.
Double-count prevention	The same third-party check is not counted twice merely because it can apply to more than one workflow.
Workflow applicability	Workflow rows show where those checks can apply. They overlap and are not additive.
Reviewed treatment	Only checks Cloudeval has reviewed for architecture scoring contribute to Well-Architected-style review. Other observations stay in deployment quality, additional IaC findings, or release-gate output.
Not assessed behavior	Unsupported provider, format, resource, or policy areas should be shown as `Not assessed`, not as pass, fail, or zero risk.

Licensing and attribution

Cloudeval integrates permissively licensed open-source tools as evidence sources. Cloudeval independently evaluates, normalizes, and presents results. These third-party projects are independent of Cloudeval; no affiliation, certification, sponsorship, or approval is implied.

Project	License	Source and license
PSRule.Rules.Azure `1.47.0`	MIT	Source, License
ARM TTK `20250401 (0.26)`	MIT	Source, License
Checkov `3.3.6`	Apache-2.0	Source, License
cfn-lint `1.52.1`	MIT-0	Source, License
AWS CloudFormation Guard `3.2.0`	Apache-2.0	Source, License

Cloudeval uses project names as text attribution. It does not use project logos unless separate trademark clearance exists.

Coverage boundaries

The 1,650+ attributed cloud and IaC checks count is a pinned-catalog lower bound, not a per-project result count.
Workflow counts overlap and are not additive.
Not every project runs every check.
AWS CloudFormation beta support is not an end-to-end AWS Well-Architected assessment.
Checkov observations appear as additional IaC findings unless Cloudeval has reviewed a different output treatment.
Third-party projects are independent; no affiliation, certification, sponsorship, or approval is implied.

​Cloudeval evaluation surface

​Published coverage counts

​How Cloudeval uses evidence

​Third-party catalog snapshot

​Third-party roles

​Count methodology

​Licensing and attribution

​Coverage boundaries

​Related pages

Cloudeval evaluation surface

Published coverage counts

How Cloudeval uses evidence

Third-party catalog snapshot

Third-party roles

Count methodology

Licensing and attribution

Coverage boundaries

Related pages