checkov

Checkov is a static code analysis tool for infrastructure as code (IaC) and a software composition analysis (SCA) tool for container images and open source packages. It scans cloud infrastructure defined in Terraform, Terraform Plan, CloudFormation, AWS SAM, Kubernetes, Helm charts, Kustomize, Dockerfile, Serverless Framework, Ansible, Bicep, ARM Templates, OpenAPI, and OpenTofu, detecting security and compliance misconfigurations using graph-based scanning. Key capabilities include over 1000 built-in policies covering security and compliance best practices for AWS, Azure, and Google Cloud. It supports context-awareness policies based on in-memory graph-based scanning, detects AWS credentials in EC2 Userdata, Lambda environment variables, and Terraform providers, and identifies secrets using regular expressions, keywords, and entropy-based detection. The tool also evaluates Terraform Provider settings and supports variable evaluation to optional default values. Checkov provides multiple output formats including CLI, CycloneDX, JSON, JUnit XML, CSV, SARIF, and GitHub markdown, with links to remediation guides. It supports in-line suppression of accepted risks or false positives via code annotations, and offers allow/deny list filtering by check ID or severity threshold. Configuration can be managed through a YAML config file (.checkov.yaml) or command-line flags. Installation is available via pip, Homebrew, or Docker. The tool requires Python 3.9-3.13 and Terraform >= 0.12. It can be integrated into CI/CD pipelines (Jenkins, GitHub Actions, GitLab CI, CircleCI, etc.) and is also available as a VS Code extension. Checkov is maintained by Prisma Cloud and powers the Prisma Cloud Application Security platform.