checkov fails to download external modules

[seanstark]

I started seeing checkov failures on downloading external modules to support scanning functionality. Since the checkov.exe is not including the --download-external-modules flag this failing.

• Need the ability to include the --download-external-modules flag

D:\a\_msdo\packages\nuget\Microsoft.Guardian.CheckovRedist_windows_amd64.3.2.497\tools\dist\checkov.exe --directory .\ --output sarif --soft-fail --output-file-path D:\a\aks-store-demo\aks-store-demo\.gdn\.r\checkov\001\checkov.sarif

Error:      2026-04-03 17:00:19,354 [ThreadPoolEx] [WARNI]  Failed to download module Azure/avm-res-documentdb-databaseaccount/azurerm:0.10.0 (for external modules, the --download-external-modules flag is required)

Error:      2026-04-03 17:00:19,354 [ThreadPoolEx] [WARNI]  Failed to download module Azure/avm-res-containerregistry-registry/azurerm:0.4.0 (for external modules, the --download-external-modules flag is required)

Error:      2026-04-03 17:00:19,354 [ThreadPoolEx] [WARNI]  Failed to download module Azure/avm-res-containerservice-managedcluster/azurerm:0.1.7 (for external modules, the --download-external-modules flag is required)

Error:      2026-04-03 17:00:19,356 [ThreadPoolEx] [WARNI]  Failed to download module Azure/avm-res-cognitiveservices-account/azurerm:0.10.0 (for external modules, the --download-external-modules flag is required)

Error:      2026-04-03 17:00:19,356 [ThreadPoolEx] [WARNI]  Failed to download module Azure/avm-res-servicebus-namespace/azurerm:0.4.0 (for external modules, the --download-external-modules flag is required)

Error:      2026-04-03 17:00:21,600 [ThreadPoolEx] [WARNI]  Fail to read file .\.github\workflows\test-e2e-pr.yml. error: 'charmap' codec can't decode byte 0x9d in position 1457: character maps to <undefined>`

[DimaBir]

Hi @seanstark, thanks for reporting this.

You can enable --download-external-modules today by setting an environment variable in your workflow:

- uses: microsoft/security-devops-action@latest
  env:
    GDN_CHECKOV_DOWNLOADEXTERNALMODULES: "true"
  with:
    tools: checkov

MSDO supports passing arguments to individual tools through the GDN_<ToolName>_<ArgumentId> environment variable pattern. You can find more details on the wiki.

Let me know if that resolves the issue for you.