How do I skip a false positive in Checkov?

Use in-code annotations like '#checkov:skip=CKV_AWS_20' in Terraform or annotations in Kubernetes manifests, as demonstrated in the suppression section. This allows you to specify checks to ignore with optional comments.

Checkov vs Terrascan for IaC security?

Checkov offers broader framework support and graph-based analysis, while Terrascan is lighter but may have fewer built-in policies. Checkov's integration with Prisma Cloud provides additional remediation guides, but Terrascan is fully open-source without external dependencies.

Does Checkov scan Kubernetes manifests for vulnerabilities?

Yes, Checkov scans Kubernetes files for security misconfigurations using built-in policies, and it supports Helm charts and Kustomize, as listed in the features. It focuses on configuration issues rather than runtime vulnerabilities.

How to integrate Checkov with GitHub Actions?

Checkov can be added as a step in GitHub Actions workflows using its CLI or Docker image, with output formats like SARIF for integration with security dashboards. The README mentions support for CI/CD pipelines including GitHub Actions.

What's the performance impact of running Checkov on large codebases?

Performance depends on file count and framework complexity; graph-based scanning can be memory-intensive but provides accurate results. Using flags like --skip-path or limiting checks can help optimize scans in CI/CD.

Can Checkov scan private container images without uploading them?

Yes, Checkov can scan local Docker images using the --docker-image flag, and it doesn't require uploading to external services unless using Prisma Cloud integrations for enhanced features.

Open-Awesome

checkov

Apache-2.0Python3.3.8

A static code analysis tool that scans infrastructure as code, container images, and open source packages for security misconfigurations and vulnerabilities.

Visit Website GitHub

8.9k stars1.4k forks0 contributors

What is checkov?

Checkov is an open-source static analysis tool that scans Infrastructure as Code (IaC) templates, container images, and open-source packages for security misconfigurations and vulnerabilities. It helps developers and DevOps teams identify risks in cloud resources and dependencies during the build phase, preventing insecure configurations from reaching production.

Target Audience

Cloud engineers, DevOps teams, security professionals, and platform engineers who manage infrastructure using Terraform, Kubernetes, CloudFormation, or similar IaC tools and need to enforce security and compliance policies.

Value Proposition

Checkov provides a unified, extensible scanner for multiple IaC frameworks and SCA, with a large built-in policy library and graph-based analysis for accurate detection. It integrates seamlessly into CI/CD pipelines and offers both CLI and API-driven workflows.

Overview

Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.

Use Cases

Best For

Scanning Terraform plans for AWS, Azure, or GCP security misconfigurations
Enforcing compliance policies in Kubernetes manifests and Helm charts
Detecting secrets and credentials in infrastructure code before commits
Identifying vulnerabilities in Docker images and open-source dependencies
Integrating security checks into GitHub Actions, GitLab CI, or Jenkins pipelines
Auditing CloudFormation templates for security best practices

Not Ideal For

Real-time security monitoring in production environments, as it's a static analysis tool for pre-deployment scanning.
Teams preferring fully offline, self-contained tools without external API dependencies for remediation guides.
Organizations using niche or proprietary IaC frameworks not in the supported list, like Pulumi with unsupported languages.

Pros & Cons

Pros

Broad Framework Support

Scans over a dozen IaC frameworks including Terraform, CloudFormation, Kubernetes, and Dockerfile, making it versatile for multi-cloud environments as per the multi-framework scanning feature.

Graph-Based Context Analysis

Uses in-memory graph scanning to detect complex misconfigurations across resources, improving accuracy over simple pattern matching, which is highlighted in the context-aware policies.

Extensive Policy Library

Includes over 1000 built-in policies covering AWS, Azure, and Google Cloud best practices, reducing the initial setup for common security checks.

Secrets and Credentials Detection

Identifies hardcoded secrets using regex patterns, keywords, and entropy analysis, helping prevent credential leaks in infrastructure code, as detailed in the secrets detection feature.

Cons

External API Dependency

Requires Prisma Cloud API for remediation guides and some advanced features, which can introduce vendor lock-in and internet dependency, as noted in the disclaimer about skipping downloads.

Python Version Constraints

Limited to Python 3.9-3.12, which may conflict with existing environments or necessitate virtual environments, as specified in the installation requirements.

Complex Suppression Management

Handling false positives requires in-code annotations or CLI flags, which can become tedious in large projects without centralized configuration, as shown in the suppression examples.

Frequently Asked Questions

Related Projects

trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Set up a personal VPN in the cloud

Stars30,329

Forks2,365

Last commit8 days ago

Grype

A vulnerability scanner for container images and filesystems

Stars12,629

Forks836