A static code analysis tool that scans infrastructure as code, container images, and open source packages for security misconfigurations and vulnerabilities.
Checkov is an open-source static analysis tool that scans Infrastructure as Code (IaC) templates, container images, and open-source packages for security misconfigurations and vulnerabilities. It helps prevent cloud security issues by identifying problems during build-time before resources are provisioned, supporting frameworks like Terraform, Kubernetes, and CloudFormation.
Cloud engineers, DevOps teams, platform engineers, and security professionals who write or manage infrastructure as code and need to enforce security and compliance policies in their CI/CD pipelines.
Developers choose Checkov for its extensive built-in policy coverage, support for a wide range of IaC frameworks, and its ability to provide fast, actionable security feedback directly in their development workflow, helping to shift security left.
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Includes over 1000 built-in policies covering AWS, Azure, and Google Cloud best practices, reducing the need for custom rule creation from scratch.
Scans Terraform, Kubernetes, CloudFormation, Dockerfile, Helm, and more, making it a one-stop tool for diverse infrastructure-as-code stacks.
Uses context-aware, in-memory graph scanning to detect complex misconfigurations by understanding resource relationships, unlike simpler static analyzers.
Allows inline suppression via code annotations (e.g., checkov:skip) to manage false positives and accepted risks, keeping scans actionable.
Requires Python 3.9 to 3.12, which can complicate installation in environments with older or newer Python versions, as noted in the README's virtual environment setup advice.
Maintained by Prisma Cloud and requires API calls for features like remediation guides, potentially leading to vendor lock-in and reliance on external services.
The README mentions that certain environments (e.g., Debian 12) may require virtual environment installation, adding steps compared to drop-in binaries.