Checkov Security Scanning Skill

This skill enables scanning Infrastructure as Code (IaC) for security misconfigurations and compliance violations using Checkov - an open-source static analysis tool by Bridgecrew/Palo Alto Networks that covers 20+ frameworks with 1000+ built-in security checks.

Key Distinction: Checkov detects IaC misconfigurations (insecure cloud resource configurations). For application source code vulnerabilities, use

bandit

(Python) or

graudit

(multi-language). For dependency audits, use

guarddog

or

dependency-check

.

Quick Reference

checkov -d /path/to/iac/

checkov -f main.tf

checkov -d . --framework terraform

checkov -d ./k8s --framework kubernetes

checkov -f Dockerfile --framework dockerfile

-o json

-o sarif

checkov --list

--skip-check CKV_AWS_1,CKV_DOCKER_7

--hard-fail-on HIGH,CRITICAL

When to Use This Skill

PRIMARY USE CASES:

• Audit Terraform configurations for AWS, Azure, GCP, and other cloud providers
• Scan Kubernetes manifests for container security issues
• Check Dockerfiles for security best practices
• Validate CloudFormation templates before deployment
• Scan Helm charts and Kustomize configurations
• Audit GitHub Actions, GitLab CI, and other CI/CD workflows
• Compliance scanning against CIS benchmarks, SOC2, HIPAA, PCI-DSS
• Pre-commit/pre-deployment security gates

DO NOT USE FOR:

• Application source code vulnerabilities → use

  bandit

  (Python) or

  graudit

• Dependency/package audits → use

  guarddog

  or

  dependency-check

• Shell script security → use

  shellcheck

• Runtime security scanning → use specialized runtime tools

Decision Tree: Choosing the Right Scan

What are you scanning?
│
├── Infrastructure as Code (IaC)?
│   ├── Terraform (.tf, .tf.json) → checkov -d . --framework terraform
│   ├── Kubernetes manifests → checkov -d . --framework kubernetes
│   ├── Dockerfile → checkov -f Dockerfile --framework dockerfile
│   ├── CloudFormation (.yaml/.json) → checkov -d . --framework cloudformation
│   ├── Helm charts → checkov -d . --framework helm
│   ├── ARM/Bicep → checkov -d . --framework arm,bicep
│   └── GitHub Actions → checkov -d . --framework github_actions
│
├── CI/CD configuration?
│   ├── GitHub Actions → checkov --framework github_actions
│   ├── GitLab CI → checkov --framework gitlab_ci
│   ├── Azure Pipelines → checkov --framework azure_pipelines
│   └── CircleCI/BitBucket → checkov --framework circleci_pipelines,bitbucket_pipelines
│
├── Python/JavaScript source code?
│   └── Use bandit or graudit instead
│
└── Third-party dependencies?
    └── Use guarddog or dependency-check instead

Prerequisites

Checkov must be installed. If not available, install it:

# Install via pip (recommended)
pip install checkov

# Or use pipx for isolated install
pipx install checkov

# Or use Homebrew (macOS/Linux)
brew install checkov

# Or use Docker (isolated, no local install)
docker pull bridgecrew/checkov
alias checkov='docker run --tty --rm --volume "$(pwd):/tf" --workdir /tf bridgecrew/checkov'

# Verify installation
checkov --version

Troubleshooting Installation:

# If pip install fails, ensure Python 3.8+
python --version

# If permissions issues occur
pip install --user checkov

# Check if checkov is in PATH
which checkov || echo "Add to PATH or use full path"

Core Scanning Commands

Scan a Directory

# Scan all IaC files in a directory (auto-detects frameworks)
checkov -d /path/to/infrastructure/

# Scan current directory
checkov -d .

# Scan with compact output (no code blocks)
checkov -d . --compact

Scan Specific Files

# Scan a single Terraform file
checkov -f main.tf

# Scan multiple files
checkov -f main.tf -f variables.tf -f outputs.tf

# Scan a Dockerfile
checkov -f Dockerfile --framework dockerfile

Framework-Specific Scans

# Terraform only
checkov -d . --framework terraform

# Kubernetes manifests
checkov -d ./k8s --framework kubernetes

# CloudFormation templates
checkov -d ./cfn --framework cloudformation

# Dockerfile
checkov -f Dockerfile --framework dockerfile

# Helm charts
checkov -d ./helm-chart --framework helm

# GitHub Actions workflows
checkov -d .github/workflows --framework github_actions

# Multiple frameworks
checkov -d . --framework terraform,kubernetes,dockerfile

Output Formats

# Default CLI output
checkov -d .

# JSON output for parsing
checkov -d . -o json

# SARIF for GitHub/GitLab Security
checkov -d . -o sarif

# JUnit XML for CI/CD test reporting
checkov -d . -o junitxml

# Multiple outputs simultaneously
checkov -d . -o cli -o json -o sarif --output-file-path console,results.json,results.sarif

# CycloneDX SBOM format
checkov -d . -o cyclonedx_json

Available Check Categories

Checkov includes 1000+ built-in checks across multiple categories.

Check ID Prefixes by Provider

CKV_AWS_*

CKV_AZURE_*

CKV_GCP_*

CKV_DOCKER_*

CKV_K8S_*

CKV_GHA_*

CKV_GITLABCI_*

CKV_SECRET_*

CKV_ALI_*

CKV_OCI_*

CKV_TF_*

CKV_OPENAPI_*

CKV_ANSIBLE_*

CKV_ARGO_*

Security Check Categories

Example Checks by Framework

Terraform (AWS):

CKV_AWS_1

CKV_AWS_2

CKV_AWS_3

CKV_AWS_18

CKV_AWS_19

CKV_AWS_20

CKV_AWS_21

CKV_AWS_23

CKV_AWS_24

CKV_AWS_25

Kubernetes:

CKV_K8S_1

CKV_K8S_2

CKV_K8S_3

CKV_K8S_8

CKV_K8S_9

CKV_K8S_21

CKV_K8S_22

CKV_K8S_28

CKV_K8S_35

Dockerfile:

CKV_DOCKER_1

CKV_DOCKER_2

CKV_DOCKER_3

CKV_DOCKER_7

CKV_DOCKER_8

CKV_DOCKER_9

CKV_DOCKER_10

CKV_DOCKER_11

GitHub Actions:

CKV_GHA_1

CKV_GHA_2

CKV_GHA_3

CKV_GHA_4

CKV_GHA_7

CKV2_GHA_1

Selective Check Scanning

# Run only specific checks
checkov -d . -c CKV_AWS_1,CKV_AWS_2,CKV_AWS_3

# Run checks by type
checkov -d . --check-type terraform

# Skip specific checks
checkov -d . --skip-check CKV_AWS_1,CKV_DOCKER_7

# Skip paths
checkov -d . --skip-path tests/ --skip-path .terraform/

# List all available checks
checkov --list

# Filter checks by framework
checkov --list --framework terraform

Severity Filtering

# Only fail on HIGH and CRITICAL severity
checkov -d . --hard-fail-on HIGH,CRITICAL

# Soft fail on LOW and MEDIUM (exit 0)
checkov -d . --soft-fail-on LOW,MEDIUM

# Show only failed checks
checkov -d . --quiet

# Always exit 0 (soft fail all)
checkov -d . --soft-fail

Configuration File

Create

.checkov.yaml

# Framework selection
framework:
  - terraform
  - dockerfile
  - kubernetes

# Skip specific checks
skip-check:
  - CKV_AWS_1
  - CKV_DOCKER_7

# Skip paths
skip-path:
  - tests/
  - .terraform/
  - examples/

# Output settings
output: cli
compact: true
quiet: false

# Severity configuration
soft-fail-on:
  - LOW
  - MEDIUM

hard-fail-on:
  - HIGH
  - CRITICAL

# Terraform settings
download-external-modules: true
external-modules-download-path: .external_modules
evaluate-variables: true
var-file:
  - variables.tfvars

# For CI/CD
soft-fail: false

Create config from CLI args:

checkov --create-config .checkov.yaml

Workflow for Security Audit

Quick Scan (1-2 minutes)

# Quick scan of IaC directory
checkov -d . --compact

# Focus on critical issues only
checkov -d . --hard-fail-on HIGH,CRITICAL --quiet

Comprehensive Audit (3-5 minutes)

# Step 1: Full scan with all frameworks
checkov -d . -o cli -o json --output-file-path console,full-report.json

# Step 2: Review critical findings
checkov -d . --hard-fail-on CRITICAL --quiet

# Step 3: Framework-specific deep dive
checkov -d ./terraform --framework terraform -o cli
checkov -d ./k8s --framework kubernetes -o cli
checkov -f Dockerfile --framework dockerfile -o cli

Pre-Deployment Validation

# Scan Terraform plan (most accurate for runtime config)
terraform init
terraform plan -out=tfplan
terraform show -json tfplan > tfplan.json
checkov -f tfplan.json --framework terraform_plan

# Scan with external modules
checkov -d . --download-external-modules true

CI/CD Integration

GitHub Actions

name: IaC Security Scan
on: [push, pull_request]

jobs:
  checkov:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Run Checkov
        uses: bridgecrewio/checkov-action@v12
        with:
          directory: .
          framework: terraform,dockerfile,kubernetes
          output_format: cli,sarif
          output_file_path: console,results.sarif
          soft_fail: false
          
      - name: Upload SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif

GitLab CI

checkov:
  image: bridgecrew/checkov:latest
  script:
    - checkov -d . -o cli -o gitlab_sast --output-file-path console,gl-sast-report.json
  artifacts:
    reports:
      sast: gl-sast-report.json

Pre-commit Hook

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/bridgecrewio/checkov
    rev: '3.2.500'
    hooks:
      - id: checkov
        args:
          - --framework=terraform,dockerfile

Interpreting Results

Output Format

Passed checks: 42, Failed checks: 3, Skipped checks: 0

Check: CKV_AWS_20: "Ensure S3 bucket is not publicly readable"
        FAILED for resource: aws_s3_bucket.public_bucket
        File: /main.tf:15-25
        Guide: https://docs.prismacloud.io/en/...

                15 | resource "aws_s3_bucket" "public_bucket" {
                16 |   bucket = "my-public-bucket"
                17 |   acl    = "public-read"  # <- Issue here
                18 | }

Severity Assessment

Verification Checklist

For each finding, verify:

• Is this a real misconfiguration, not intentional?
• What is the blast radius if exploited?
• Is there a compensating control?
• What compliance frameworks does this violate?

Combining with Other Security Tools

checkov -d .

bandit -r ./src

graudit -d secrets ./

guarddog pypi verify requirements.txt

shellcheck *.sh

trivy image myimage:latest

Recommended Full Audit Workflow

# 1. Scan IaC configurations (Checkov)
checkov -d . --framework terraform,kubernetes,dockerfile

# 2. Scan Python code for vulnerabilities (Bandit)
bandit -r ./src -f json -o bandit-results.json

# 3. Check for hardcoded secrets (Graudit)
graudit -d secrets ./

# 4. Audit dependencies (GuardDog)
guarddog pypi verify requirements.txt

# 5. Scan container images (Trivy)
trivy image --severity HIGH,CRITICAL myimage:latest

Environment Variables

BC_API_KEY

CKV_FRAMEWORK

CKV_CHECK

CKV_SKIP_CHECK

CKV_EVAL_VARS

DOWNLOAD_EXTERNAL_MODULES

CHECKOV_CREATE_GRAPH

Troubleshooting

Common Issues

command not found: checkov

pip install checkov

--external-modules-download-path

--skip-check

.checkov.yaml

--download-external-modules true

Performance Optimization

# Scan only changed files in CI
checkov -f $(git diff --name-only HEAD~1 | grep -E '\.(tf|yaml|yml|json)$')

# Use baseline for existing issues
checkov -d . --create-baseline
checkov -d . --baseline .checkov.baseline

# Cache external modules
checkov -d . --download-external-modules true --external-modules-download-path .modules_cache

Limitations

• Checkov performs static analysis - cannot detect runtime misconfigurations
• Some checks may produce false positives in complex configurations
• Terraform plan scanning requires

  terraform init

  to be run first
• External module scanning requires network access to download modules
• Does not scan application source code - use bandit/graudit for that
• Secrets detection is pattern-based - use dedicated secret scanners for comprehensive coverage
• Always validate critical findings with manual review

Additional Resources

• Misconfiguration Patterns Examples - Example IaC patterns Checkov detects
• Checkov GitHub Repository - Official documentation
• Bridgecrew Documentation - Enterprise features
• CIS Benchmarks - Compliance reference