IaC Scanning and Policy as Code with Checkov [Cheat Sheet]

We posted a video introducing the benefits of Infrastructure as Code (IaC) scanning and Policy as Code scanning, and why you absolutely should be running some sort of solution if you are using any IaC tools for production (like Terraform).

In this post, we’re sharing a cheat sheet that can help you get started with a tool named Checkov that can help you achieve that. Feel free to download it and share it with colleagues or on social media!

Infrastructure as code · Security scanning

Checkov: IaC and Policy as Code Scanning

Cybr

Christophe Limpalair ↗ @christophelimp ↗

What is Checkov?

Checkov scans infrastructure as code (IaC) for misconfigurations and policy violations before deployment. Run it in your editor, in pre-commit hooks, or in CI/CD. Built-in checks cover common security requirements, and custom Python or YAML policies enforce your organization’s rules.

Start a Terraform scan

checkov --version
checkov -d ./terraform --framework terraform
checkov -d ./terraform --framework terraform --quiet

CLI quick reference

Scan scope and output

Help menu: --help, -h
Show available options for your installed version.
Display version: --version, -v
Display only failed checks: --quiet
Also disables progress bars in CLI output.
List checks: --list, -l
List available checks and their IDs.
IaC root directory: --directory, -d <DIRECTORY>
Scan a directory.
Frameworks to include: --framework <FRAMEWORKS...>
Separate frameworks with spaces, e.g. terraform cloudformation.
Frameworks to exclude: --skip-framework <FRAMEWORKS...>
Skip the specified framework scanners.
Scan a single file: --file, -f <FILE>
Use instead of --directory.

Checks and configuration

Skip a path: --skip-path <SKIP_PATH>
A regular expression relative to the working directory.
Run specific checks: --check, -c <CHECKS>
Separate check IDs with commas.
Skip specific checks: --skip-check <CHECKS>
Exclude selected checks from the scan.
Load custom policies: --external-checks-dir <DIRECTORY>
Load local custom checks.
Run all loaded external checks: --run-all-external-checks
Evaluate variables and locals: --evaluate-variables <BOOL>
For example, --evaluate-variables true.
Load a configuration file: --config-file <PATH>
Read a Checkov YAML configuration.
Create configuration from this command: --create-config <PATH>
Write the current command-line arguments to a configuration file.
Print configuration settings: --show-config
Create a baseline: --create-baseline
Save findings to .checkov.baseline.
Compare against a baseline: --baseline <BASELINE>
Report new failures relative to the baseline.

Images and secrets

Scan a Docker image: --docker-image <DOCKER_IMAGE>
Also available as --image. Requires platform credentials via --bc-api-key; this is different from scanning a Dockerfile.
Dockerfile for the scanned image: --dockerfile-path <PATH>
Associate the scanned image with its Dockerfile.
Scan commit history for secrets: --scan-secrets-history
Enable secret scanning of Git history.
Scan all file types for secrets: --enable-secret-scan-all-files <BOOL>
Expand secret scanning beyond the default file types.
Exclude files from secret scanning: --block-list-secret-scan <FILES>
Filter files out of the secret scanner; this does not enable scanning.

Custom Python policies

Create an empty __init__.py and save the following Python files in custom_policies/. Replace ./terraform with your IaC directory.

custom_policies/
├── __init__.py
├── CustomVPCCIDRBlockCheck.py
└── RestrictEC2InstanceType.py

Run the custom policies

checkov -d ./terraform --framework terraform \
  --external-checks-dir ./custom_policies \
  --check CUSTOM_AWS_001,CUSTOM_AWS_002

Example: Enforce a VPC CIDR prefix

This policy checks that each VPC’s cidr_block starts with 10.0.. For example, 10.0.0.0/16 passes and 192.168.0.0/16 fails. A VPC without a cidr_block also fails.

CustomVPCCIDRBlockCheck.py

from typing import Any

from checkov.common.models.enums import CheckResult, CheckCategories
from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck


class CustomVPCCIDRBlockCheck(BaseResourceCheck):
    def __init__(self) -> None:
        name = "Ensure VPC CIDR block range is within the specified range (10.0.x.x)"
        id = "CUSTOM_AWS_001"
        supported_resources = ("aws_vpc",)
        categories = (CheckCategories.NETWORKING,)
        super().__init__(name=name, id=id, categories=categories,
                         supported_resources=supported_resources)

    def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:
        if 'cidr_block' in conf.keys():
            cidr_block = conf['cidr_block'][0]
            if cidr_block.startswith("10.0."):
                return CheckResult.PASSED
        return CheckResult.FAILED


check = CustomVPCCIDRBlockCheck()

Example: Restrict EC2 instance types

This policy flags EC2 instances that use the t2.micro instance type. For example, t2.micro fails and t3.micro passes. Change t2.micro in the check to block a different instance type.

RestrictEC2InstanceType.py

from checkov.common.models.enums import CheckCategories, CheckResult
from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck


class AWSEC2InstanceTypeCheck(BaseResourceCheck):
    def __init__(self):
        name = "Ensure that EC2 instances are not t2.micro type"
        id = "CUSTOM_AWS_002"
        supported_resources = ['aws_instance']
        categories = [CheckCategories.NETWORKING]
        super().__init__(name=name, id=id, categories=categories,
                         supported_resources=supported_resources)

    def scan_resource_conf(self, conf):
        # Check if the instance_type attribute is set to t2.micro.
        if 'instance_type' in conf.keys():
            if conf['instance_type'][0] == 't2.micro':
                return CheckResult.FAILED
        return CheckResult.PASSED


check = AWSEC2InstanceTypeCheck()

Use this cheat sheet with AI

Copy a ready-to-use prompt into your preferred AI assistant.

Goal

Preview prompt

Prompt

Use this Cybr cheat sheet as reference: Checkov: IaC and Policy as Code Scanning
Source: https://cybr.com/cheat-sheets/checkov/

My goal: Help me run a scan

Help me run Checkov against my infrastructure code. Ask about my installed version, frameworks, directory layout, and local or CI workflow. Choose commands, explain scope and exclusions, interpret results and exit codes, and show how to verify that expected files and checks ran. Explain what a baseline suppresses and distinguish Dockerfile scanning from authenticated image scanning.

Use the included reference material even if you cannot open the source URL. Ask for missing context rather than inventing my environment. Explain assumptions. For version-sensitive service behavior or commands, consult current official documentation when available, cite it, and explain any differences from this reference. If you cannot verify something, say so.

Reference material from the cheat sheet (structured text or a curated summary):

{
  "intro": "Checkov scans infrastructure as code (IaC) for misconfigurations and policy violations before deployment. Run it in your editor, in pre-commit hooks, or in CI/CD. Built-in checks cover common security requirements, and custom Python or YAML policies enforce your organization’s rules.",
  "groups": [
    {
      "title": "Scan scope and output",
      "options": [
        {
          "label": "Help menu",
          "flag": "--help, -h",
          "note": "Show available options for your installed version."
        },
        {
          "label": "Display version",
          "flag": "--version, -v",
          "note": ""
        },
        {
          "label": "Display only failed checks",
          "flag": "--quiet",
          "note": "Also disables progress bars in CLI output."
        },
        {
          "label": "List checks",
          "flag": "--list, -l",
          "note": "List available checks and their IDs."
        },
        {
          "label": "IaC root directory",
          "flag": "--directory, -d <DIRECTORY>",
          "note": "Scan a directory."
        },
        {
          "label": "Frameworks to include",
          "flag": "--framework <FRAMEWORKS...>",
          "note": "Separate frameworks with spaces, e.g. `terraform cloudformation`."
        },
        {
          "label": "Frameworks to exclude",
          "flag": "--skip-framework <FRAMEWORKS...>",
          "note": "Skip the specified framework scanners."
        },
        {
          "label": "Scan a single file",
          "flag": "--file, -f <FILE>",
          "note": "Use instead of `--directory`."
        }
      ]
    },
    {
      "title": "Checks and configuration",
      "options": [
        {
          "label": "Skip a path",
          "flag": "--skip-path <SKIP_PATH>",
          "note": "A regular expression relative to the working directory."
        },
        {
          "label": "Run specific checks",
          "flag": "--check, -c <CHECKS>",
          "note": "Separate check IDs with commas."
        },
        {
          "label": "Skip specific checks",
          "flag": "--skip-check <CHECKS>",
          "note": "Exclude selected checks from the scan."
        },
        {
          "label": "Load custom policies",
          "flag": "--external-checks-dir <DIRECTORY>",
          "note": "Load local custom checks."
        },
        {
          "label": "Run all loaded external checks",
          "flag": "--run-all-external-checks",
          "note": ""
        },
        {
          "label": "Evaluate variables and locals",
          "flag": "--evaluate-variables <BOOL>",
          "note": "For example, `--evaluate-variables true`."
        },
        {
          "label": "Load a configuration file",
          "flag": "--config-file <PATH>",
          "note": "Read a Checkov YAML configuration."
        },
        {
          "label": "Create configuration from this command",
          "flag": "--create-config <PATH>",
          "note": "Write the current command-line arguments to a configuration file."
        },
        {
          "label": "Print configuration settings",
          "flag": "--show-config",
          "note": ""
        },
        {
          "label": "Create a baseline",
          "flag": "--create-baseline",
          "note": "Save findings to `.checkov.baseline`."
        },
        {
          "label": "Compare against a baseline",
          "flag": "--baseline <BASELINE>",
          "note": "Report new failures relative to the baseline."
        }
      ]
    },
    {
      "title": "Images and secrets",
      "options": [
        {
          "label": "Scan a Docker image",
          "flag": "--docker-image <DOCKER_IMAGE>",
          "note": "Also available as `--image`. Requires platform credentials via `--bc-api-key`; this is different from scanning a Dockerfile."
        },
        {
          "label": "Dockerfile for the scanned image",
          "flag": "--dockerfile-path <PATH>",
          "note": "Associate the scanned image with its Dockerfile."
        },
        {
          "label": "Scan commit history for secrets",
          "flag": "--scan-secrets-history",
          "note": "Enable secret scanning of Git history."
        },
        {
          "label": "Scan all file types for secrets",
          "flag": "--enable-secret-scan-all-files <BOOL>",
          "note": "Expand secret scanning beyond the default file types."
        },
        {
          "label": "Exclude files from secret scanning",
          "flag": "--block-list-secret-scan <FILES>",
          "note": "Filter files out of the secret scanner; this does not enable scanning."
        }
      ]
    }
  ],
  "quickStart": "checkov --version\ncheckov -d ./terraform --framework terraform\ncheckov -d ./terraform --framework terraform --quiet",
  "tree": "custom_policies/\n├── __init__.py\n├── CustomVPCCIDRBlockCheck.py\n└── RestrictEC2InstanceType.py",
  "runCustom": "checkov -d ./terraform --framework terraform \\\n  --external-checks-dir ./custom_policies \\\n  --check CUSTOM_AWS_001,CUSTOM_AWS_002",
  "policyIntro": "Create an empty `__init__.py` and save the following Python files in `custom_policies/`. Replace `./terraform` with your IaC directory.",
  "policies": [
    {
      "title": "Example: Enforce a VPC CIDR prefix",
      "filename": "CustomVPCCIDRBlockCheck.py",
      "note": "This policy checks that each VPC’s `cidr_block` starts with `10.0.`. For example, `10.0.0.0/16` passes and `192.168.0.0/16` fails. A VPC without a `cidr_block` also fails.",
      "code": "from typing import Any\n\nfrom checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass CustomVPCCIDRBlockCheck(BaseResourceCheck):\n    def __init__(self) -> None:\n        name = \"Ensure VPC CIDR block range is within the specified range (10.0.x.x)\"\n        id = \"CUSTOM_AWS_001\"\n        supported_resources = (\"aws_vpc\",)\n        categories = (CheckCategories.NETWORKING,)\n        super().__init__(name=name, id=id, categories=categories,\n                         supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:\n        if 'cidr_block' in conf.keys():\n            cidr_block = conf['cidr_block'][0]\n            if cidr_block.startswith(\"10.0.\"):\n                return CheckResult.PASSED\n        return CheckResult.FAILED\n\n\ncheck = CustomVPCCIDRBlockCheck()"
    },
    {
      "title": "Example: Restrict EC2 instance types",
      "filename": "RestrictEC2InstanceType.py",
      "note": "This policy flags EC2 instances that use the `t2.micro` instance type. For example, `t2.micro` fails and `t3.micro` passes. Change `t2.micro` in the check to block a different instance type.",
      "code": "from checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass AWSEC2InstanceTypeCheck(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure that EC2 instances are not t2.micro type\"\n        id = \"CUSTOM_AWS_002\"\n        supported_resources = ['aws_instance']\n        categories = [CheckCategories.NETWORKING]\n        super().__init__(name=name, id=id, categories=categories,\n                         supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        # Check if the instance_type attribute is set to t2.micro.\n        if 'instance_type' in conf.keys():\n            if conf['instance_type'][0] == 't2.micro':\n                return CheckResult.FAILED\n        return CheckResult.PASSED\n\n\ncheck = AWSEC2InstanceTypeCheck()"
    }
  ],
  "sources": [
    {
      "label": "Checkov CLI reference",
      "href": "https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html"
    },
    {
      "label": "Python custom policies",
      "href": "https://www.checkov.io/3.Custom%20Policies/Python%20Custom%20Policies.html"
    },
    {
      "label": "Installing Checkov",
      "href": "https://www.checkov.io/2.Basics/Installing%20Checkov.html"
    }
  ]
}

More cheat sheets & courses

If you’d like to grab more AWS security cheat sheets, you can check them out here.

If you’d like to get started with learning AWS Security, check out our Introduction to AWS Security course.