/iac-checkov

name: iac-checkov
description: >
  Infrastructure as Code (IaC) security scanning using Checkov with 750+ built-in policies for Terraform,
  CloudFormation, Kubernetes, Dockerfile, and ARM templates. Use when: (1) Scanning IaC files for security
  misconfigurations and compliance violations, (2) Validating cloud infrastructure against CIS, PCI-DSS,
  HIPAA, and SOC2 benchmarks, (3) Detecting secrets and hardcoded credentials in IaC, (4) Implementing
  policy-as-code in CI/CD pipelines, (5) Generating compliance reports with remediation guidance for
  cloud security posture management.
version: 0.1.0
maintainer: SirAppSec
category: devsecops
tags: [iac, checkov, terraform, kubernetes, cloudformation, compliance, policy-as-code, cloud-security]
frameworks: [PCI-DSS, HIPAA, SOC2, NIST, GDPR]
dependencies:
  python: ">=3.8"
  packages: [checkov]
references:
  - https://www.checkov.io/
  - https://github.com/bridgecrewio/checkov
  - https://docs.paloaltonetworks.com/prisma/prisma-cloud

Infrastructure as Code Security with Checkov

Overview

Checkov is a static code analysis tool that scans Infrastructure as Code (IaC) files for security misconfigurations and compliance violations before deployment. With 750+ built-in policies, Checkov helps prevent cloud security issues by detecting problems in Terraform, CloudFormation, Kubernetes, Dockerfiles, Helm charts, and ARM templates.

Checkov performs graph-based scanning to understand resource relationships and detect complex misconfigurations that span multiple resources, making it more powerful than simple pattern matching.

Quick Start

Install Checkov

# Via pip
pip install checkov

# Via Homebrew (macOS)
brew install checkov

# Via Docker
docker pull bridgecrew/checkov

Scan Terraform Directory

# Scan all Terraform files in directory
checkov -d ./terraform

# Scan specific file
checkov -f ./terraform/main.tf

# Scan with specific framework
checkov -d ./infrastructure --framework terraform

Scan Kubernetes Manifests

# Scan Kubernetes YAML files
checkov -d ./k8s --framework kubernetes

# Scan Helm chart
checkov -d ./helm-chart --framework helm

Scan CloudFormation Template

# Scan CloudFormation template
checkov -f ./cloudformation/template.yaml --framework cloudformation

Core Workflow

Step 1: Understand Scan Scope

Identify IaC files and frameworks to scan:

# Supported frameworks
checkov --list-frameworks

# Output:
# terraform, cloudformation, kubernetes, dockerfile, helm,
# serverless, arm, secrets, ansible, github_actions, gitlab_ci

**Scope Considerations:**

• Scan entire infrastructure directory for comprehensive coverage
• Focus on specific frameworks during initial adoption
• Exclude generated or vendor files
• Include both production and non-production configurations

Step 2: Run Basic Scan

Execute Checkov with appropriate output format:

# CLI output (human-readable)
checkov -d ./terraform

# JSON output (for automation)
checkov -d ./terraform -o json

# Multiple output formats
checkov -d ./terraform -o cli -o json -o sarif

# Save output to file
checkov -d ./terraform -o json --output-file-path ./reports

**What Checkov Detects:**

• Security misconfigurations (unencrypted resources, public access)
• Compliance violations (CIS benchmarks, industry standards)
• Secrets and hardcoded credentials
• Missing security controls (logging, monitoring, encryption)
• Insecure network configurations
• Resource relationship issues (via graph analysis)

Step 3: Filter and Prioritize Findings

Focus on critical issues first:

# Show only high severity issues
checkov -d ./terraform --check CKV_AWS_*

# Skip specific checks (false positives)
checkov -d ./terraform --skip-check CKV_AWS_8,CKV_AWS_21

# Check against specific compliance framework
checkov -d ./terraform --compact --framework terraform \
  --check CIS_AWS,CIS_AZURE

# Run only checks with specific severity
checkov -d ./terraform --check HIGH,CRITICAL

**Severity Levels:**

• **CRITICAL**: Immediate security risks (public S3 buckets, unencrypted databases)
• **HIGH**: Significant security concerns (missing MFA, weak encryption)
• **MEDIUM**: Important security best practices (missing tags, logging disabled)
• **LOW**: Recommendations and hardening (resource naming conventions)

Step 4: Suppress False Positives

Use inline suppression for legitimate exceptions:

# Terraform example
resource "aws_s3_bucket" "example" {
  # checkov:skip=CKV_AWS_18:This bucket is intentionally public for static website
  bucket = "my-public-website"
  acl    = "public-read"
}

# Kubernetes example
apiVersion: v1
kind: Pod
metadata:
  name: privileged-pod
  annotations:
    checkov.io/skip: CKV_K8S_16=Legacy application requires privileged mode
spec:
  containers:
  - name: app
    securityContext:
      privileged: true

See `references/suppression_guide.md` for comprehensive suppression strategies.

Step 5: Create Custom Policies

Define organization-specific policies:

# custom_checks/require_s3_versioning.py
from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
from checkov.common.models.enums import CheckResult, CheckCategories

class S3BucketVersioning(BaseResourceCheck):
    def __init__(self):
        name = "Ensure S3 bucket has versioning enabled"
        id = "CKV_AWS_CUSTOM_001"
        supported_resources = ['aws_s3_bucket']
        categories = [CheckCategories.BACKUP_AND_RECOVERY]
        super().__init__(name=name, id=id, categories=categories,
                         supported_resources=supported_resources)

    def scan_resource_conf(self, conf):
        if 'versioning' in conf:
            if conf['versioning'][0].get('enabled') == [True]:
                return CheckResult.PASSED
        return CheckResult.FAILED

check = S3BucketVersioning()

Run with custom policies:

checko