Infrastructure as code · Security scanning

Checkov: IaC and Policy as Code Scanning

Christophe LimpalairCybr
Christophe Limpalair ↗ @christophelimp ↗

What is Checkov?

Checkov scans infrastructure as code (IaC) for misconfigurations and policy violations before deployment. Run it in your editor, in pre-commit hooks, or in CI/CD. Built-in checks cover common security requirements, and custom Python or YAML policies enforce your organization’s rules.

Start a Terraform scan
checkov --version
checkov -d ./terraform --framework terraform
checkov -d ./terraform --framework terraform --quiet

CLI quick reference

Scan scope and output

Help menu
--help, -h

Show available options for your installed version.

Display version
--version, -v
Display only failed checks
--quiet

Also disables progress bars in CLI output.

List checks
--list, -l

List available checks and their IDs.

IaC root directory
--directory, -d <DIRECTORY>

Scan a directory.

Frameworks to include
--framework <FRAMEWORKS...>

Separate frameworks with spaces, e.g. terraform cloudformation.

Frameworks to exclude
--skip-framework <FRAMEWORKS...>

Skip the specified framework scanners.

Scan a single file
--file, -f <FILE>

Use instead of --directory.

Checks and configuration

Skip a path
--skip-path <SKIP_PATH>

A regular expression relative to the working directory.

Run specific checks
--check, -c <CHECKS>

Separate check IDs with commas.

Skip specific checks
--skip-check <CHECKS>

Exclude selected checks from the scan.

Load custom policies
--external-checks-dir <DIRECTORY>

Load local custom checks.

Run all loaded external checks
--run-all-external-checks
Evaluate variables and locals
--evaluate-variables <BOOL>

For example, --evaluate-variables true.

Load a configuration file
--config-file <PATH>

Read a Checkov YAML configuration.

Create configuration from this command
--create-config <PATH>

Write the current command-line arguments to a configuration file.

Print configuration settings
--show-config
Create a baseline
--create-baseline

Save findings to .checkov.baseline.

Compare against a baseline
--baseline <BASELINE>

Report new failures relative to the baseline.

Images and secrets

Scan a Docker image
--docker-image <DOCKER_IMAGE>

Also available as --image. Requires platform credentials via --bc-api-key; this is different from scanning a Dockerfile.

Dockerfile for the scanned image
--dockerfile-path <PATH>

Associate the scanned image with its Dockerfile.

Scan commit history for secrets
--scan-secrets-history

Enable secret scanning of Git history.

Scan all file types for secrets
--enable-secret-scan-all-files <BOOL>

Expand secret scanning beyond the default file types.

Exclude files from secret scanning
--block-list-secret-scan <FILES>

Filter files out of the secret scanner; this does not enable scanning.

Custom Python policies

Create an empty __init__.py and save the following Python files in custom_policies/. Replace ./terraform with your IaC directory.

custom_policies/
├── __init__.py
├── CustomVPCCIDRBlockCheck.py
└── RestrictEC2InstanceType.py
Run the custom policies
checkov -d ./terraform --framework terraform \
  --external-checks-dir ./custom_policies \
  --check CUSTOM_AWS_001,CUSTOM_AWS_002

Example: Enforce a VPC CIDR prefix

This policy checks that each VPC’s cidr_block starts with 10.0.. For example, 10.0.0.0/16 passes and 192.168.0.0/16 fails. A VPC without a cidr_block also fails.

CustomVPCCIDRBlockCheck.py
from typing import Any

from checkov.common.models.enums import CheckResult, CheckCategories
from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck


class CustomVPCCIDRBlockCheck(BaseResourceCheck):
    def __init__(self) -> None:
        name = "Ensure VPC CIDR block range is within the specified range (10.0.x.x)"
        id = "CUSTOM_AWS_001"
        supported_resources = ("aws_vpc",)
        categories = (CheckCategories.NETWORKING,)
        super().__init__(name=name, id=id, categories=categories,
                         supported_resources=supported_resources)

    def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:
        if 'cidr_block' in conf.keys():
            cidr_block = conf['cidr_block'][0]
            if cidr_block.startswith("10.0."):
                return CheckResult.PASSED
        return CheckResult.FAILED


check = CustomVPCCIDRBlockCheck()

Example: Restrict EC2 instance types

This policy flags EC2 instances that use the t2.micro instance type. For example, t2.micro fails and t3.micro passes. Change t2.micro in the check to block a different instance type.

RestrictEC2InstanceType.py
from checkov.common.models.enums import CheckCategories, CheckResult
from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck


class AWSEC2InstanceTypeCheck(BaseResourceCheck):
    def __init__(self):
        name = "Ensure that EC2 instances are not t2.micro type"
        id = "CUSTOM_AWS_002"
        supported_resources = ['aws_instance']
        categories = [CheckCategories.NETWORKING]
        super().__init__(name=name, id=id, categories=categories,
                         supported_resources=supported_resources)

    def scan_resource_conf(self, conf):
        # Check if the instance_type attribute is set to t2.micro.
        if 'instance_type' in conf.keys():
            if conf['instance_type'][0] == 't2.micro':
                return CheckResult.FAILED
        return CheckResult.PASSED


check = AWSEC2InstanceTypeCheck()

Use this cheat sheet with AI

Copy a ready-to-use prompt into your preferred AI assistant.

Preview prompt
More cheat sheets