Checkov¶

# Install via mise
mise use -g checkov@latest                           # (1)!

# Scan the whole repo — auto-detects frameworks
checkov -d .                                         # (2)!

# Scan one framework only
checkov -d . --framework terraform                   # (3)!

# CI gate — fail the build on HIGH severity and above
checkov -d . --hard-fail-on HIGH                     # (4)!

# Report-only pass while baselining
checkov -d . --soft-fail

# SARIF output for GitHub Code Scanning
checkov -d . --output sarif > checkov.sarif

1. mise installs it in an isolated environment — no venv juggling; the bridgecrew/checkov image remains the container option.
2. Auto-detection is convenient; expect noise until suppressions are triaged.
3. Cuts scan time and noise on single-framework repos.
4. Start with --soft-fail for a sprint, then flip to hard-failing once the backlog is clean.

Real talk:

• Suppressions live inline in code: # checkov:skip=CKV_AWS_20:<reason> — greppable, reviewable, attributable.
• Output formats cover CLI table, JSON, JUnit, CycloneDX SBOM, and SARIF for the Security tab.
• Graph-based checks evaluate cross-resource relationships: a public S3 bucket attached to public-facing compute gets flagged as a compound finding, not two unrelated hits.

Suppression lives where the finding does:

resource "aws_s3_bucket" "public_assets" { # checkov:skip=CKV_AWS_20:The bucket is public on purpose
  bucket = "my-cdn-assets"
}

Custom policies come in declarative YAML or Python classes:

metadata:
  id: CUSTOM_AWS_001
  name: S3 buckets must use customer-managed KMS keys
  category: ENCRYPTION
  severity: HIGH
definition:
  cond_type: attribute
  resource_types:
    - aws_s3_bucket_server_side_encryption_configuration
  attribute: rule.apply_server_side_encryption_by_default.sse_algorithm
  operator: equals
  value: aws:kms

The 2026 open-source IaC scanner field (all three support OpenTofu):

Why this works:

• Inline skips appear in PR diffs with author and reason attached — no mystery suppressions.
• Declarative YAML covers most org policies; drop to Python classes when logic gets complicated.
• Graph checks catch compound exposure that per-resource scanners wave through.
• Trivy and KICS are fine tools too — pick on rule depth versus noise tolerance, not hype.

Tips:

• Baseline with --soft-fail for one sprint, then enforce with --hard-fail-on HIGH once the backlog is triaged.
• Upload SARIF so findings land in the GitHub Security tab next to CodeQL — one triage queue instead of two.
• Ship AI workloads? Add the AWS Bedrock, GCP Vertex AI, and Azure OpenAI policy packs (~47 AI-infrastructure checks added across 2025–2026).

Gotchas:

• The regex-based secrets scanner misses non-patterned credentials — pair it with trufflehog or gitleaks for verified detection.
• Cross-module data flow analysis is weak; checks stay module-local, so exposures spanning modules slip past graph evaluation.
• Pin bridgecrewio/checkov-action to a full commit SHA — the 2026 TeamPCP attack hit unpinned IaC-scanner actions.
• tfsec ignores are NOT auto-migrated into Trivy or Checkov — re-triage every old suppression by hand.