Checkov
Static analysis scanner for infrastructure-as-code that detects misconfigurations in Terraform, CloudFormation, Kubernetes, and Dockerfile.
Technical Architecture & Overview
Checkov is an open-source static code analysis tool from Bridgecrew, now Palo Alto Networks, that detects security and compliance misconfigurations in infrastructure as code. It supports Terraform, CloudFormation, AWS SAM, Kubernetes, Helm, Kustomize, Dockerfile, Bicep, Azure ARM, OpenTofu, and Serverless Framework. It includes over 1000 built-in policies for AWS, Azure, and GCP, plus graph-based analysis to find complex issues.
Targeted Technical Use Cases
Static analysis of IaC and container build files in CI/CD pipelines before deployment.
Evaluation & Trade-offs
Core Strengths
- +Large built-in policy set covering AWS, Azure, and GCP IaC frameworks.
- +Graph-based analysis finds complex multi-resource misconfigurations.
- +Includes SCA for secrets and vulnerable package detection.
Trade-Offs & Limitations
- -Broad checks can produce false positives that require policy tuning.
- -Policies may need adjustments for organization-specific exceptions.
- -Does not protect runtime resources directly.
Defensive Security Application
Add Checkov to CI/CD pipelines to block misconfigured IaC before deployment and fix findings by updating templates and build files.
Frequently Asked Questions
What is Checkov?→
Checkov is an open-source static code analysis tool from Bridgecrew, now Palo Alto Networks, that detects security and compliance misconfigurations in infrastructure as code. It supports Terraform, CloudFormation, AWS SAM, Kubernetes, Helm, Kustomize, Dockerfile, Bicep, Azure ARM, OpenTofu, and Serverless Framework. It includes over 1000 built-in policies for AWS, Azure, and GCP, plus graph-based analysis to find complex issues.
What is Checkov used for?→
Static analysis of IaC and container build files in CI/CD pipelines before deployment.
What are the strengths of Checkov?→
- +Large built-in policy set covering AWS, Azure, and GCP IaC frameworks.
- +Graph-based analysis finds complex multi-resource misconfigurations.
- +Includes SCA for secrets and vulnerable package detection.
What are the limitations of Checkov?→
- +Broad checks can produce false positives that require policy tuning.
- +Policies may need adjustments for organization-specific exceptions.
- +Does not protect runtime resources directly.
How is Checkov used defensively?→
Add Checkov to CI/CD pipelines to block misconfigured IaC before deployment and fix findings by updating templates and build files.