Checkov

How it works

Checkov is a Python CLI maintained by Palo Alto Networks (Prisma Cloud, formerly Bridgecrew). Each framework has its own parser (HCL2 for Terraform, YAML and JSON for CloudFormation and Kubernetes, a Dockerfile parser, Bicep and ARM parsers, and Terraform plan JSON). Attribute checks are Python classes that get one resource's parsed config and return passed or failed. They have ids like CKV_AWS_20.

For Terraform, CloudFormation, Kubernetes and several other frameworks it also builds an in-memory graph of resources and the references between them (for Terraform, after rendering variables, locals and modules). Graph checks (CKV2_*) are YAML policies made of attribute, connection and filter conditions joined with and/or/not, so a rule can ask whether a bucket has a connected public access block rather than only looking at the bucket. Your own Python or YAML checks load from --external-checks-dir.

The github_actions framework parses workflow YAML and runs seven job checks plus one graph check: ACTIONS_ALLOW_UNSECURE_COMMANDS, a regex list of untrusted github.event fields inside run: (CKV_GHA_2), curl with secrets, netcat to an IP, missing cosign signing or SBOM attestation, non-empty workflow_dispatch inputs, and write-all top-level permissions. The github_configuration framework calls the GitHub REST and GraphQL APIs with GITHUB_TOKEN (org settings, branch protection on the current branch, webhooks, collaborators, org admins), saves the JSON under github_conf/ and runs CKV_GITHUB_* checks on it. The secrets framework uses bc-detect-secrets, Bridgecrew's fork of Yelp's detect-secrets, with regex, keyword and entropy detectors.

Output is cli, json, sarif, junitxml, csv, cyclonedx, spdx, gitlab_sast or github_failed_only, and the exit code is non-zero on any failed check unless --soft-fail is set. Suppress with a checkov:skip=CKV_AWS_20:reason comment inside the resource, a checkov.io/skip annotation in Kubernetes, --skip-check with wildcards, or a .checkov.baseline file. Severities, SCA (sca_package, sca_image) and enforcement rules come from Prisma Cloud and only work with --bc-api-key.

What it catches

• Public buckets, open security groups and missing encryption in Terraform, CloudFormation, ARM, Bicep and Serverless
• Privileged pods, hostPath mounts and missing limits in Kubernetes, Helm and Kustomize
• Dockerfiles with no non-root USER or no HEALTHCHECK
• Untrusted github.event fields expanded inside workflow run: steps
• ACTIONS_ALLOW_UNSECURE_COMMANDS and write-all workflow permissions
• Org 2FA, SSO and branch protection gaps read from the GitHub API
• Hardcoded credentials in IaC and, with a flag, in any file

Run it

pip3 install checkov
checkov -d . --skip-download
checkov -d . --framework github_actions --compact

In GitHub Actions

checkov:
  runs-on: ubuntu-latest
  permissions:
    contents: read
    security-events: write
  steps:
    - uses: actions/checkout@<sha> # v7.0.1
      with:
        persist-credentials: false
    - uses: bridgecrewio/checkov-action@<sha> # v12.3131.0
      with:
        directory: .
        output_format: cli,sarif
        output_file_path: console,results.sarif
    - uses: github/codeql-action/upload-sarif@<sha> # v4.38.3
      if: success() || failure()
      with:
        sarif_file: results.sarif

What leaves your machine

By default it calls Prisma Cloud's API to add guideline links to results (the README says no identifiable customer data is sent); --skip-download turns that off. With --bc-api-key, results and SCA package data go to Prisma Cloud, and the github_configuration framework reads settings from the GitHub API with your token.

Limits

• Without a Prisma Cloud API key findings have no severity, so you cannot gate CI on HIGH and above; you gate on individual checks instead.
• Workflow coverage is thin: eight checks, the injection check is a regex over run: text, and nothing flags unpinned actions, pull_request_target or cache use. Run zizmor for workflows.
• The default rule set is large and noisy on real Terraform. Expect to spend time on --skip-check lists, inline skips or a baseline.
• The official action runs ghcr.io/bridgecrewio/checkov by version tag, not by digest, so pinning the action SHA does not pin the image.

Links

• Repository: bridgecrewio/checkov ↗
• CLI command reference ↗
• GitHub Actions policy index ↗
• YAML custom policies ↗
• checkov-action ↗

Related tools