Sachin Chaurasiya
Search articles, labs, tools…

Secure · IaC scanner

Checkov

Checkov evaluates infrastructure-as-code files against a library of security and compliance policies before anything is planned or applied, with per-resource suppressions, baselines and JUnit/SARIF output for CI.

Stage
Secure
Category
IaC scanner
Website
www.checkov.io
Documentation
Official docs
Source
bridgecrewio/checkov
License
Apache-2.0
On this page

What it does

Reads Terraform, CloudFormation, Kubernetes manifests, Helm charts, Dockerfiles and more, and evaluates each resource against policies with stable IDs (CKV_AWS_24, “no security groups allow ingress from 0.0.0.0/0 to port 22”). It runs on source, needs no cloud credentials, and exits 1 when a check fails, which makes it a merge-request gate. Verified with Checkov 3.3.17 in the Infrastructure as Code Security path.

Where it fits

Secure: before terraform plan, on every merge request, alongside fmt and validate. It complements rather than replaces a scan of the deployed account, because it only sees what is in the code.

Quick start

docker run --rm -v "$PWD:/tf" -w /tf bridgecrew/checkov:3.3.17 --directory /tf --framework terraform --compact --quiet
docker run --rm -v "$PWD:/tf" -w /tf bridgecrew/checkov:3.3.17 --directory /tf --create-baseline   # record existing findings
docker run --rm -v "$PWD:/tf" -w /tf bridgecrew/checkov:3.3.17 --directory /tf --baseline .checkov.baseline \
  --output cli --output junitxml --output sarif --output-file-path reports

Suppress a finding on one resource with a reason inside the block: #checkov:skip=CKV_AWS_157:Single-AZ accepted for this database; RPO covered by snapshots. Repository-wide policy (skip-check, hard-fail-on, soft-fail) lives in a committed .checkov.yaml.

Common pitfalls

  • Twenty findings on thirty lines is normal. Sort them: exposure and encryption first, opinions (Multi-AZ, replication, notifications) decided per repository with reasons.
  • The secrets framework matches token formats and high-entropy strings; a plain hardcoded password is not found. Fix that structurally (provider-managed credentials, sensitive variables), do not rely on detection.
  • Severity levels require the Prisma Cloud platform; open-source Checkov expresses policy as lists of check IDs.
  • Pin the image tag. A floating latest changes the policy set without a merge request.

On this site

  • Cloud Identity and Least Privilege: the IAM policy checks (CKV_AWS_62, CKV_AWS_286 to CKV_AWS_290) on a wildcard CI policy, and a documented CKV_AWS_356 exception for ec2:Describe*.

Articles about Checkov

Cloud Security beginner

Cloud Identity and Least Privilege: Humans, Workloads and CI

Human and workload identities and the credentials that carry them: why static keys are dangerous, how a bound short-lived token differs from a legacy one, how CI assumes a role without a key, and how to scope each one.

13 min read
Infrastructure as Code intermediate

IaC Security in CI/CD: Gates, Exceptions and Baselines

Put Checkov in front of terraform plan: a GitLab CI job on every merge request, a baseline so only new findings fail, a pass/fail policy by check ID, exceptions with reasons, reports in the MR, and branch protection.

12 min read
Infrastructure as Code intermediate

Scan Infrastructure as Code with Checkov

Run Checkov against Terraform with a public database, an open security group and an unprotected bucket; read the 22 findings and why they matter; fix them; then record the rest as documented skips.

12 min read