Checkov¶

# Installation (Python pip)
pip install checkov

# Or via Homebrew (macOS/Linux)
brew install checkov

# Or use Docker
docker pull bridgecrew/checkov

# Scan Terraform directory
checkov --directory ./terraform

# Scan specific file
checkov --file main.tf

# Scan CloudFormation
checkov --framework cloudformation --file template.yaml

# Scan Kubernetes manifests
checkov --framework kubernetes --directory ./k8s

# Scan Dockerfile
checkov --framework dockerfile --file Dockerfile

# Scan Helm charts
checkov --framework helm --directory ./charts

# Multiple frameworks
checkov --framework terraform kubernetes dockerfile --directory .

# Specific checks only
checkov --check CKV_AWS_20,CKV_AWS_21 --directory .

# Skip specific checks
checkov --skip-check CKV_AWS_20 --directory .

# Output formats
checkov --directory . --output json
checkov --directory . --output junitxml  # For CI/CD
checkov --directory . --output sarif     # GitHub Code Scanning

# Soft fail mode (warnings only, exit 0)
checkov --directory . --soft-fail

# Compact output (summary only)
checkov --directory . --compact

# Show suppressed checks
checkov --directory . --show-suppressed

# Baseline file (suppress existing issues)
checkov --directory . --baseline baseline.json

# Pre-commit hook integration
# .pre-commit-config.yaml
repos:
  - repo: https://github.com/bridgecrewio/checkov
    rev: 3.0.0
    hooks:
      - id: checkov
        args: [--quiet, --compact]

# GitHub Actions workflow
name: IaC Security Scan
on: [push, pull_request]
jobs:
  checkov:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run Checkov
        uses: bridgecrewio/checkov-action@master
        with:
          directory: terraform/
          framework: terraform
          output_format: sarif
          soft_fail: false  # Block on failures
      - name: Upload results to GitHub
        uses: github/codeql-action/upload-sarif@v2
        if: always()
        with:
          sarif_file: results.sarif

# GitLab CI integration
checkov:
  stage: security
  image: bridgecrew/checkov:latest
  script:
    - checkov --directory terraform/ --output junitxml > checkov-report.xml
  artifacts:
    reports:
      junit: checkov-report.xml
  allow_failure: false

# Terraform workflow (local development)
# 1. Write Terraform
# 2. Run Checkov
checkov --directory .

# 3. Fix issues or suppress with inline comments
# main.tf
resource "aws_s3_bucket" "example" {
  # checkov:skip=CKV_AWS_20:Bucket is private, public access not needed
  bucket = "my-bucket"
}

# 4. Terraform plan and apply
terraform plan
terraform apply

# CI/CD pipeline (Jenkins example)
stage('Security Scan') {
  steps {
    sh 'pip install checkov'
    sh 'checkov --directory terraform/ --output junitxml > checkov.xml'
    junit 'checkov.xml'
  }
}

# Docker scan workflow
# Scan Dockerfile before building image
checkov --framework dockerfile --file Dockerfile
docker build -t myapp:latest .

# Kubernetes manifest validation
checkov --framework kubernetes --directory k8s/ --compact
kubectl apply -f k8s/

# Multi-cloud IaC scan
checkov \
  --framework terraform \
  --directory . \
  --check CKV_AWS_*,CKV_AZURE_*,CKV_GCP_* \
  --output json \
  --output-file-path results.json

# Generate baseline (first-time adoption)
checkov --directory . --output json > baseline.json
# Edit baseline.json to suppress known issues
checkov --directory . --baseline baseline.json