--- title: "Checkov: IaC and Policy as Code Scanning Cheat Sheet | Cybr" description: "Scan infrastructure as code with Checkov: CLI options, scan scope, baselines, secrets, and custom Python policies for VPCs and EC2." url: https://cybr.com/cheat-sheets/checkov/ --- Infrastructure as code · Security scanning # Checkov: IaC and Policy as Code Scanning ![Christophe Limpalair](https://cybr.com/cloud-attack-simulations/christophe.png)[**Cybr**](https://cybr.com/) [Christophe Limpalair ↗](https://www.linkedin.com/in/christophelimpalair/) [@christophelimp ↗](https://x.com/christophelimp) ## What is Checkov? Checkov scans infrastructure as code (IaC) for misconfigurations and policy violations before deployment. Run it in your editor, in pre-commit hooks, or in CI/CD. Built-in checks cover common security requirements, and custom Python or YAML policies enforce your organization’s rules. Start a Terraform scan ```bash checkov --version checkov -d ./terraform --framework terraform checkov -d ./terraform --framework terraform --quiet ``` ## CLI quick reference ### Scan scope and output Help menu `--help, -h` Show available options for your installed version. Display version `--version, -v` Display only failed checks `--quiet` Also disables progress bars in CLI output. List checks `--list, -l` List available checks and their IDs. IaC root directory `--directory, -d ` Scan a directory. Frameworks to include `--framework ` Separate frameworks with spaces, e.g. `terraform cloudformation`. Frameworks to exclude `--skip-framework ` Skip the specified framework scanners. Scan a single file `--file, -f ` Use instead of `--directory`. ### Checks and configuration Skip a path `--skip-path ` A regular expression relative to the working directory. Run specific checks `--check, -c ` Separate check IDs with commas. Skip specific checks `--skip-check ` Exclude selected checks from the scan. Load custom policies `--external-checks-dir ` Load local custom checks. Run all loaded external checks `--run-all-external-checks` Evaluate variables and locals `--evaluate-variables ` For example, `--evaluate-variables true`. Load a configuration file `--config-file ` Read a Checkov YAML configuration. Create configuration from this command `--create-config ` Write the current command-line arguments to a configuration file. Print configuration settings `--show-config` Create a baseline `--create-baseline` Save findings to `.checkov.baseline`. Compare against a baseline `--baseline ` Report new failures relative to the baseline. ### Images and secrets Scan a Docker image `--docker-image ` Also available as `--image`. Requires platform credentials via `--bc-api-key`; this is different from scanning a Dockerfile. Dockerfile for the scanned image `--dockerfile-path ` Associate the scanned image with its Dockerfile. Scan commit history for secrets `--scan-secrets-history` Enable secret scanning of Git history. Scan all file types for secrets `--enable-secret-scan-all-files ` Expand secret scanning beyond the default file types. Exclude files from secret scanning `--block-list-secret-scan ` Filter files out of the secret scanner; this does not enable scanning. ## Custom Python policies Create an empty `__init__.py` and save the following Python files in `custom_policies/`. Replace `./terraform` with your IaC directory. ``` custom_policies/ ├── __init__.py ├── CustomVPCCIDRBlockCheck.py └── RestrictEC2InstanceType.py ``` Run the custom policies ```bash checkov -d ./terraform --framework terraform \ --external-checks-dir ./custom_policies \ --check CUSTOM_AWS_001,CUSTOM_AWS_002 ``` ### Example: Enforce a VPC CIDR prefix This policy checks that each VPC’s `cidr_block` starts with `10.0.`. For example, `10.0.0.0/16` passes and `192.168.0.0/16` fails. A VPC without a `cidr_block` also fails. CustomVPCCIDRBlockCheck.py ```python from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class CustomVPCCIDRBlockCheck(BaseResourceCheck): def __init__(self) -> None: name = "Ensure VPC CIDR block range is within the specified range (10.0.x.x)" id = "CUSTOM_AWS_001" supported_resources = ("aws_vpc",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if 'cidr_block' in conf.keys(): cidr_block = conf['cidr_block'][0] if cidr_block.startswith("10.0."): return CheckResult.PASSED return CheckResult.FAILED check = CustomVPCCIDRBlockCheck() ``` ### Example: Restrict EC2 instance types This policy flags EC2 instances that use the `t2.micro` instance type. For example, `t2.micro` fails and `t3.micro` passes. Change `t2.micro` in the check to block a different instance type. RestrictEC2InstanceType.py ```python from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AWSEC2InstanceTypeCheck(BaseResourceCheck): def __init__(self): name = "Ensure that EC2 instances are not t2.micro type" id = "CUSTOM_AWS_002" supported_resources = ['aws_instance'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): # Check if the instance_type attribute is set to t2.micro. if 'instance_type' in conf.keys(): if conf['instance_type'][0] == 't2.micro': return CheckResult.FAILED return CheckResult.PASSED check = AWSEC2InstanceTypeCheck() ``` ## Use this cheat sheet with AI Copy a ready-to-use prompt into your preferred AI assistant. Goal Preview prompt Prompt **Sources and more info** - [Checkov CLI reference ↗](https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html) - [Python custom policies ↗](https://www.checkov.io/3.Custom%20Policies/Python%20Custom%20Policies.html) - [Installing Checkov ↗](https://www.checkov.io/2.Basics/Installing%20Checkov.html) [More security cheat sheets →](https://cybr.com/cheat-sheets/) [More cheat sheets](https://cybr.com/cheat-sheets/)