--- title: "IaC Scanning and Policy as Code with Checkov [Cheat Sheet] - Cybr" description: "IaC scanning and Policy as Code scanning, and why it's critical to run if you're deploying infrastructure using Terraform/Pulumi/etc..." url: https://cybr.com/cloud-security/iac-scanning-and-policy-as-code-with-checkov-cheat-sheet/ --- # IaC Scanning and Policy as Code with Checkov \[Cheat Sheet\] We posted a video introducing the benefits of Infrastructure as Code (IaC) scanning and Policy as Code scanning, and why you absolutely should be running… Christophe Published August 31, 2023 · Updated January 23, 2024 We [posted a video](https://www.youtube.com/watch?v=o2NkK4w_ZbM) introducing the benefits of Infrastructure as Code (IaC) scanning and Policy as Code scanning, and why you absolutely should be running some sort of solution if you are using any IaC tools for production (like Terraform). In this post, we’re sharing a cheat sheet that can help you get started with a tool named Checkov that can help you achieve that. Feel free to download it and share it with colleagues or on social media! Infrastructure as code · Security scanning ## Checkov: IaC and Policy as Code Scanning ![Christophe Limpalair](https://cybr.com/cloud-attack-simulations/christophe.png)[**Cybr**](https://cybr.com/) [Christophe Limpalair ↗](https://www.linkedin.com/in/christophelimpalair/) [@christophelimp ↗](https://x.com/christophelimp) ### What is Checkov? Checkov scans infrastructure as code (IaC) for misconfigurations and policy violations before deployment. Run it in your editor, in pre-commit hooks, or in CI/CD. Built-in checks cover common security requirements, and custom Python or YAML policies enforce your organization’s rules. Start a Terraform scan ```bash checkov --version checkov -d ./terraform --framework terraform checkov -d ./terraform --framework terraform --quiet ``` ### CLI quick reference #### Scan scope and output Help menu `--help, -h` Show available options for your installed version. Display version `--version, -v` Display only failed checks `--quiet` Also disables progress bars in CLI output. List checks `--list, -l` List available checks and their IDs. IaC root directory `--directory, -d ` Scan a directory. Frameworks to include `--framework ` Separate frameworks with spaces, e.g. `terraform cloudformation`. Frameworks to exclude `--skip-framework ` Skip the specified framework scanners. Scan a single file `--file, -f ` Use instead of `--directory`. #### Checks and configuration Skip a path `--skip-path ` A regular expression relative to the working directory. Run specific checks `--check, -c ` Separate check IDs with commas. Skip specific checks `--skip-check ` Exclude selected checks from the scan. Load custom policies `--external-checks-dir ` Load local custom checks. Run all loaded external checks `--run-all-external-checks` Evaluate variables and locals `--evaluate-variables ` For example, `--evaluate-variables true`. Load a configuration file `--config-file ` Read a Checkov YAML configuration. Create configuration from this command `--create-config ` Write the current command-line arguments to a configuration file. Print configuration settings `--show-config` Create a baseline `--create-baseline` Save findings to `.checkov.baseline`. Compare against a baseline `--baseline ` Report new failures relative to the baseline. #### Images and secrets Scan a Docker image `--docker-image ` Also available as `--image`. Requires platform credentials via `--bc-api-key`; this is different from scanning a Dockerfile. Dockerfile for the scanned image `--dockerfile-path ` Associate the scanned image with its Dockerfile. Scan commit history for secrets `--scan-secrets-history` Enable secret scanning of Git history. Scan all file types for secrets `--enable-secret-scan-all-files ` Expand secret scanning beyond the default file types. Exclude files from secret scanning `--block-list-secret-scan ` Filter files out of the secret scanner; this does not enable scanning. ### Custom Python policies Create an empty `__init__.py` and save the following Python files in `custom_policies/`. Replace `./terraform` with your IaC directory. ``` custom_policies/ ├── __init__.py ├── CustomVPCCIDRBlockCheck.py └── RestrictEC2InstanceType.py ``` Run the custom policies ```bash checkov -d ./terraform --framework terraform \ --external-checks-dir ./custom_policies \ --check CUSTOM_AWS_001,CUSTOM_AWS_002 ``` #### Example: Enforce a VPC CIDR prefix This policy checks that each VPC’s `cidr_block` starts with `10.0.`. For example, `10.0.0.0/16` passes and `192.168.0.0/16` fails. A VPC without a `cidr_block` also fails. CustomVPCCIDRBlockCheck.py ```python from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class CustomVPCCIDRBlockCheck(BaseResourceCheck): def __init__(self) -> None: name = "Ensure VPC CIDR block range is within the specified range (10.0.x.x)" id = "CUSTOM_AWS_001" supported_resources = ("aws_vpc",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if 'cidr_block' in conf.keys(): cidr_block = conf['cidr_block'][0] if cidr_block.startswith("10.0."): return CheckResult.PASSED return CheckResult.FAILED check = CustomVPCCIDRBlockCheck() ``` #### Example: Restrict EC2 instance types This policy flags EC2 instances that use the `t2.micro` instance type. For example, `t2.micro` fails and `t3.micro` passes. Change `t2.micro` in the check to block a different instance type. RestrictEC2InstanceType.py ```python from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AWSEC2InstanceTypeCheck(BaseResourceCheck): def __init__(self): name = "Ensure that EC2 instances are not t2.micro type" id = "CUSTOM_AWS_002" supported_resources = ['aws_instance'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): # Check if the instance_type attribute is set to t2.micro. if 'instance_type' in conf.keys(): if conf['instance_type'][0] == 't2.micro': return CheckResult.FAILED return CheckResult.PASSED check = AWSEC2InstanceTypeCheck() ``` ### Use this cheat sheet with AI Copy a ready-to-use prompt into your preferred AI assistant. Goal Preview prompt Prompt **Sources and more info** - [Checkov CLI reference ↗](https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html) - [Python custom policies ↗](https://www.checkov.io/3.Custom%20Policies/Python%20Custom%20Policies.html) - [Installing Checkov ↗](https://www.checkov.io/2.Basics/Installing%20Checkov.html) [More security cheat sheets →](https://cybr.com/cheat-sheets/) ## More cheat sheets & courses If you’d like to grab more AWS security cheat sheets, you can [check them out here](https://cybr.com/tag/aws-security-cheat-sheets/). If you’d like to get started with learning AWS Security, check out our [Introduction to AWS Security course](https://cybr.com/courses/introduction-to-aws-security/). ## Filed under - [Cloud Security](https://cybr.com/cloud-security/) - [Cybersecurity Fundamentals](https://cybr.com/cybersecurity-fundamentals-archives/) - [AWS](https://cybr.com/tag/aws/) - [AWS Security](https://cybr.com/tag/aws-security/) - [AWS Security Cheat Sheets](https://cybr.com/tag/aws-security-cheat-sheets/) - [Cheat Sheets](https://cybr.com/tag/cheat-sheets/) ## Comments Loading comments… Recommended resources [![Explore the AWS Certified Security Specialty course](https://media.cybr.com/2023/12/cybr-aws-security-specialty-banner-768x432.jpg)](https://cybr.com/courses/aws-certified-security-specialty-course/) ## Build practical AWS security skills Start with the core services, then prepare for the AWS Certified Security Specialty exam with guided lessons and hands-on practice. [Introduction to AWS Security](https://cybr.com/courses/introduction-to-aws-security/) [Security Specialty course](https://cybr.com/courses/aws-certified-security-specialty-course/)