Checkov — Static Security Scanning for IaC and Containers

What it is

Checkov is a static analysis tool by Bridgecrew (now part of Palo Alto Networks) that scans infrastructure-as-code files for security misconfigurations and policy violations. It supports Terraform, CloudFormation, Kubernetes manifests, Helm charts, Dockerfiles, and more.

It targets DevOps engineers, platform teams, and security practitioners who want to catch cloud misconfigurations in code before anything is deployed to production.

How it saves time or tokens

Checkov shifts security left by finding issues during development rather than after deployment. Running it in CI catches problems like open S3 buckets, overly permissive IAM policies, or unencrypted databases before they reach production. This avoids costly remediation cycles.

How to use

1. Install Checkov:

pipx install checkov

1. Scan a directory of Terraform files:

checkov -d ./terraform

1. Review the output for passed and failed checks, then fix the flagged resources.

Example

# Install
pipx install checkov

# Scan Terraform directory
checkov -d ./terraform

# Scan a specific file
checkov -f main.tf

# Output as JSON for CI integration
checkov -d ./terraform -o json

# Skip specific checks
checkov -d ./terraform --skip-check CKV_AWS_18,CKV_AWS_21

Related on TokRepo

• AI Tools for Security — Security scanning and compliance tools
• AI Tools for DevOps — DevOps automation and infrastructure tools

Key considerations

When evaluating Checkov for your workflow, consider the following factors. First, assess whether your team has the technical prerequisites to adopt this tool effectively. Second, evaluate the maintenance burden against the productivity gains. Third, check community activity and documentation quality to ensure long-term viability. Integration with your existing toolchain matters more than feature count alone. Start with a small pilot project before rolling out across the organization. Monitor resource usage during the initial adoption phase to identify bottlenecks early. Document your configuration decisions so team members can onboard independently.

Common pitfalls

• Checkov may flag valid configurations as failures if your organization uses custom patterns; use inline skip comments or a config file to suppress false positives.
• Scanning large mono-repos with thousands of IaC files can be slow; scope scans to specific directories.
• Some checks require external context (e.g., variable values from tfvars) that Checkov cannot resolve statically.