Checkov — Static Security Scanning for IaC and Containers

Introduction

Checkov brings shift-left security to infrastructure code. It ships with 1,000+ built-in policies covering AWS, Azure, GCP, Kubernetes, Dockerfile, GitHub Actions, and Bicep, and it runs fast enough to fit into a pre-commit hook.

What Checkov Does

• Parses IaC using native Terraform, CFN, Kustomize, and Helm libraries
• Flags misconfigurations like open S3 buckets or missing encryption
• Detects secrets in committed code with entropy + regex rules
• Supports custom policies in Python or Rego/OPA
• Integrates with CI as SARIF, JUnit, CycloneDX, or JSON output

Architecture Overview

The CLI loads the target files, builds an in-memory resource graph, and evaluates each resource against policy check classes. Graph-based checks (e.g., cross-resource references) run after atomic checks. Results stream to stdout or a structured writer.

Self-Hosting & Configuration

• Pure-Python; pipx or container image bridgecrew/checkov
• Configure via .checkov.yaml or CLI flags
• Suppress with inline # checkov:skip=CKV_AWS_20: reason
• Wire into pre-commit, GitHub Actions, GitLab CI, Jenkins
• Pair with Prisma Cloud for centralized reporting (optional)

Key Features

• 1,000+ policies across 30+ resource providers
• Secret scanning with a curated regex set
• Graph-based multi-resource rules (e.g., KMS + S3 pairing)
• SBOM and license detection in a single pass
• Apache-2.0 license, community maintained

Comparison with Similar Tools

• tfsec — Terraform-focused, now in Aqua security's trivy suite
• Trivy — broader vuln scanning; overlaps on IaC checks
• KICS — similar IaC scope, fewer CFN policies
• Terrascan — policy-as-code via Rego, fewer built-ins
• Snyk IaC — commercial, richer UI

FAQ

Q: How do I write a custom policy? A: Subclass BaseResourceCheck in Python or drop a Rego file in --external-checks-dir.

Q: Does it analyze Helm? A: Yes — it renders charts with helm template and scans the output.

Q: Can it gate pull requests? A: Yes — emit SARIF and enable GitHub code scanning, or fail the job on non-zero exit.

Q: Does it need cloud credentials? A: No for static scans. Optional Bridgecrew platform integration does.

Sources

• https://github.com/bridgecrewio/checkov
• https://www.checkov.io/