diff --git a/pkgs/development/python-modules/bc-python-hcl2/default.nix b/pkgs/development/python-modules/bc-python-hcl2/default.nix
index 42203a43da46..78529e288ca2 100644
--- a/pkgs/development/python-modules/bc-python-hcl2/default.nix
+++ b/pkgs/development/python-modules/bc-python-hcl2/default.nix
@@ -1,33 +1,21 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, lark
 , nose
 , pythonOlder
 }:
 
-let
-  lark-parser = buildPythonPackage rec {
-    pname = "lark-parser";
-    version = "0.10.1";
-
-    src = fetchPypi {
-      inherit pname version;
-      sha256 = "15jr4c1falvgkq664xdgamykk6waklh1psy8v3wlrg0v59hngws2";
-    };
-
-    doCheck = true;
-  };
-in
 buildPythonPackage rec {
   pname = "bc-python-hcl2";
-  version = "0.3.30";
+  version = "0.3.33";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-wfcTIPKbMPa7xpXzkFtxnxG2ZRFzTw35EP7f4zwHxcs=";
+    hash = "sha256-tdsw9gf64VGH9tRWgYZZq3FNa5B5JNhN3k6wUHrU5zY=";
   };
 
   # Nose is required during build process, so can not use `checkInputs`.
@@ -36,7 +24,7 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    lark-parser
+    lark
   ];
 
   # This fork of python-hcl2 doesn't ship tests
diff --git a/pkgs/development/python-modules/pycep-parser/default.nix b/pkgs/development/python-modules/pycep-parser/default.nix
new file mode 100644
index 000000000000..f286e6b45bdb
--- /dev/null
+++ b/pkgs/development/python-modules/pycep-parser/default.nix
@@ -0,0 +1,58 @@
+{ lib
+, assertpy
+, buildPythonPackage
+, fetchFromGitHub
+, lark
+, poetry-core
+, pytestCheckHook
+, pythonOlder
+, regex
+, typing-extensions
+}:
+
+buildPythonPackage rec {
+  pname = "pycep-parser";
+  version = "0.3.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "gruebel";
+    repo = "pycep";
+    rev = version;
+    hash = "sha256-S4jBqMgyreWrEp1SuR8J5RVFc+i1O0xbfgux1UvFP5k=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    lark
+    regex
+    typing-extensions
+  ];
+
+  checkInputs = [
+    assertpy
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'version = "0.3.1-alpha.1"' 'version = "${version}"' \
+      --replace 'regex = "^2022.3.2"' 'regex = "*"'
+  '';
+
+  pythonImportsCheck = [
+    "pycep"
+  ];
+
+  meta = with lib; {
+    description = "Python based Bicep parser";
+    homepage = "https://github.com/gruebel/pycep";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 8117b9ac0495..c6fd90506d94 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -32,13 +32,13 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.0.918";
+  version = "2.0.921";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    hash = "sha256-8nhz32ugnheBH1W3YKKmjRvjjx4WcpSyLwBS0STvsPM=";
+    hash = "sha256-Bl9zwJGyZN5vJVpy63GeaCQ+4X0dYMTAV4FtT96L42U=";
   };
 
   nativeBuildInputs = with py.pkgs; [
@@ -71,6 +71,7 @@ buildPythonApplication rec {
     packaging
     policyuniverse
     prettytable
+    pycep-parser
     pyyaml
     semantic-version
     tabulate
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index fbdd25360e61..7c08ff24e726 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6719,6 +6719,8 @@ in {
 
   pycec = callPackage ../development/python-modules/pycec { };
 
+  pycep-parser = callPackage ../development/python-modules/pycep-parser { };
+
   pycfdns = callPackage ../development/python-modules/pycfdns { };
 
   pycflow2dot = callPackage ../development/python-modules/pycflow2dot {