Package: checkov
Checkovis a static code analysis tool for infrastructure as code (IaC) and also a software composition analysis (SCA) tool for images and open source packages.It scans cloud infrastructure provisioned usingTerraform,Terraform plan,Cloudformation,AWS SAM,Kubernetes,Helm charts,Kustomize,Dockerfile,Serverless,Bicep,OpenAPIorARM Templatesand detects security and compliance misconfigurations using graph-based scanning.It performsSoftware Composition Analysis (SCA) scanningwhich is a scan of open source packages and images for Common Vulnerabilities and Exposures (CVEs).Checkov also powersPrisma Cloud Application Security, the developer-first platform that codifies and streamlines cloud security throughout the development lifecycle. Prisma Cloud identifies, fixes, and prevents misconfigurations in cloud resources and infrastructure-as-code files.Table of contentsFeaturesScreenshotsGetting StartedDisclaimerSupportMigration - v2 to v3FeaturesOver 1000 built-in policiescover security and compliance best practices for AWS, Azure and Google Cloud.Scans Terraform, Terraform Plan, Terraform JSON, CloudFormation, AWS SAM, Kubernetes, Helm, Kustomize, Dockerfile, Serverless framework, Ansible, Bicep and ARM template files.Scans Argo Workflows, Azure Pipelines, BitBucket Pipelines, Circle CI Pipelines, GitHub Actions and GitLab CI workflow filesSupports Context-awareness policies based on in-memory graph-based scanning.Supports Python format for attribute policies and YAML format for both attribute and composite policies.DetectsAWS credentialsin EC2 Userdata, Lambda environment variables and Terraform providers.Identifies secretsusing regular expressions, keywords, and entropy based detection.EvaluatesTerraform Providersettings to regulate the creation, management, and updates of IaaS, PaaS or SaaS managed through Terraform.Policies support evaluation ofvariablesto their optional default value.Supports in-linesuppressionof accepted risks or false-positives to reduce recurring scan failures. Also supports global skip from using CLI.Outputcurrently available as CLI,CycloneDX, JSON, JUnit XML, CSV, SARIF and github markdown and link to remediationguides.ScreenshotsScan results in CLIScheduled scan result in JenkinsGetting startedRequirementsPython >= 3.7 (Data classes are available for Python 3.7+)Terraform >= 0.12InstallationTo install pip follow the officialdocspip3installcheckovor withHomebrew(macOS or Linux)brewinstallcheckovEnabling bash autocompletesource<(register-python-argcompletecheckov)Upgradeif you installed checkov with pip3pip3install-Ucheckovor with HomebrewbrewupgradecheckovConfigure an input folder or filecheckov--directory/user/path/to/iac/codeOr a specific file or filescheckov--file/user/tf/example.tfOrcheckov-f/user/cloudformation/example1.yml-f/user/cloudformation/example2.ymlOr a terraform plan file in json formatterraforminit
terraformplan-outtf.plan
terraformshow-jsontf.plan>tf.json
checkov-ftf.jsonNote:terraform showoutput filetf.jsonwill be a single line.
For that reason all findings will be reported line number 0 by Checkovcheck:CKV_AWS_21:"Ensure all data stored in the S3 bucket have versioning enabled"FAILEDforresource:aws_s3_bucket.customerFile:/tf/tf.json:0-0Guide:https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioningIf you have installedjqyou can convert json file into multiple lines with the following command:terraformshow-jsontf.plan|jq'.'>tf.jsonScan result would be much user friendly.checkov-ftf.json
Check:CKV_AWS_21:"Ensure all data stored in the S3 bucket have versioning enabled"FAILEDforresource:aws_s3_bucket.customerFile:/tf/tf1.json:224-268Guide:https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning225|"values":{226|"acceleration_status":"",227|"acl":"private",228|"arn":"arn:aws:s3:::mybucket",Alternatively, specify the repo root of the hcl files used to generate the plan file, using the--repo-root-for-plan-enrichmentflag, to enrich the output with the appropriate file path, line numbers, and codeblock of the resource(s). An added benefit is that check suppressions will be handled accordingly.checkov-ftf.json--repo-root-for-plan-enrichment/user/path/to/iac/codeScan result sample (CLI)PassedChecks:1,FailedChecks:1,SuppressedChecks:0Check:"Ensure all data stored in the S3 bucket is securely encrypted at rest"/main.tf:Passedforresource:aws_s3_bucket.template_bucket
Check:"Ensure all data stored in the S3 bucket is securely encrypted at rest"/../regionStack/main.tf:Failedforresource:aws_s3_bucket.sls_deployment_bucket_nameStart using Checkov by reading theGetting Startedpage.Using Dockerdockerpullbridgecrew/checkov
dockerrun--tty--rm--volume/user/tf:/tf--workdir/tfbridgecrew/checkov--directory/tfNote: if you are using Python 3.6(Default version in Ubuntu 18.04) checkov will not work, and it will fail withModuleNotFoundError: No module named 'dataclasses'error message. In this case, you can use the docker version instead.Note that there are certain cases where redirectingdocker run --ttyoutput to a file - for example, if you want to save the Checkov JUnit output to a file - will cause extra control characters to be printed. This can break file parsing. If you encounter this, remove the--ttyflag.The--workdir /tfflag is optional to change the working directory to the mounted volume. If you are using the SARIF output-o sarifthis will output the results.sarif file to the mounted volume (/user/tfin the example above). If you do not include that flag, the working directory will be "/".Running or skipping checksBy using command line flags, you can specify to run only named checks (allow list) or run all checks except
those listed (deny list). If you are using the platform integration via API key, you can also specify a severity threshold to skip and / or include.
Moreover, as json files can't contain comments, one can pass regex pattern to skip json file secret scan.See the docs for more detailed information about how these flags work together.ExamplesAllow only the two specified checks to run:checkov--directory.--checkCKV_AWS_20,CKV_AWS_57Run all checks except the one specified:checkov-d.--skip-checkCKV_AWS_20Run all checks except checks with specified patterns:checkov-d.--skip-checkCKV_AWS*Run all checks that are MEDIUM severity or higher (requires API key):checkov-d.--checkMEDIUM--bc-api-key...Run all checks that are MEDIUM severity or higher, as well as check CKV_123 (assume this is a LOW severity check):checkov-d.--checkMEDIUM,CKV_123--bc-api-key...Skip all checks that are MEDIUM severity or lower:checkov-d.--skip-checkMEDIUM--bc-api-key...Skip all checks that are MEDIUM severity or lower, as well as check CKV_789 (assume this is a high severity check):checkov-d.--skip-checkMEDIUM,CKV_789--bc-api-key...Run all checks that are MEDIUM severity or higher, but skip check CKV_123 (assume this is a medium or higher severity check):checkov-d.--checkMEDIUM--skip-checkCKV_123--bc-api-key...Run check CKV_789, but skip it if it is a medium severity (the --check logic is always applied before --skip-check)checkov-d.--skip-checkMEDIUM--checkCKV_789--bc-api-key...For Kubernetes workloads, you can also use allow/deny namespaces.  For example, do not report any results for the
kube-system namespace:checkov-d.--skip-checkkube-systemRun a scan of a container image. First pull or build the image then refer to it by the hash, ID, or name:tag:checkov--frameworksca_image--docker-imagesha256:1234example--dockerfile-path/Users/path/to/Dockerfile--bc-api-key...

checkov--docker-image<image-name>:tag--dockerfile-path/User/path/to/Dockerfile--bc-api-key...You can use --image flag also to scan container image instead of --docker-image for shortener:checkov--image<image-name>:tag--dockerfile-path/User/path/to/Dockerfile--bc-api-key...Run an SCA scan of packages in a repo:checkov-d.--frameworksca_package--bc-api-key...--repo-id<repo_id(arbitrary)>Run a scan of a directory with environment variables removing buffering, adding debug level logs:PYTHONUNBUFFERED=1LOG_LEVEL=DEBUGcheckov-d.OR enable the environment variables for multiple runsexportPYTHONUNBUFFERED=1LOG_LEVEL=DEBUG
checkov-d.Run secrets scanning on all files in MyDirectory. Skip CKV_SECRET_6 check on json files that their suffix is DontScancheckov-d/MyDirectory--frameworksecrets--bc-api-key...--skip-checkCKV_SECRET_6:.*DontScan.json$Run secrets scanning on all files in MyDirectory. Skip CKV_SECRET_6 check on json files that contains "skip_test" in pathcheckov-d/MyDirectory--frameworksecrets--bc-api-key...--skip-checkCKV_SECRET_6:.*skip_test.*json$One can mask values from scanning results by supplying a configuration file (using --config-file flag) with mask entry.
The masking can apply on resource & value (or multiple values, seperated with a comma).
Examples:mask:
-aws_instance:user_data
-azurerm_key_vault_secret:admin_password,user_passwordsIn the example above, the following values will be masked:user_data for aws_instance resourceboth admin_password &user_passwords for azurerm_key_vault_secretSuppressing/Ignoring a checkLike any static-analysis tool it is limited by its analysis scope.
For example, if a resource is managed manually, or using subsequent configuration management tooling,
suppression can be inserted as a simple code annotation.Suppression comment formatTo skip a check on a given Terraform definition block or CloudFormation resource, apply the following comment pattern inside it's scope:checkov:skip=<check_id>:<suppression_comment><check_id>is one of the [available check scanners](docs/5.Policy Index/all.md)<suppression_comment>is an optional suppression reason to be included in the outputExampleThe following comment skips theCKV_AWS_20check on the resource identified byfoo-bucket, where the scan checks if an AWS S3 bucket is private.
In the example, the bucket is configured with public read access; Adding the suppress comment would skip the appropriate check instead of the check to fail.resource "aws_s3_bucket" "foo-bucket" {
  region        = var.region
    #checkov:skip=CKV_AWS_20:The bucket is a public static content host
  bucket        = local.bucket_name
  force_destroy = true
  acl           = "public-read"
}The output would now contain aSKIPPEDcheck result entry:...
...
Check:"S3 Bucket has an ACL defined which allows public access."SKIPPEDforresource:aws_s3_bucket.foo-bucketSuppresscomment:ThebucketisapublicstaticcontenthostFile:/example_skip_acl.tf:1-25

...To skip multiple checks, add each as a new line.#checkov:skip=CKV2_AWS_6
  #checkov:skip=CKV_AWS_20:The bucket is a public static content hostTo suppress checks in Kubernetes manifests, annotations are used with the following format:checkov.io/skip#: <check_id>=<suppression_comment>For example:apiVersion:v1
kind:Pod
metadata:name:mypodannotations:checkov.io/skip1:CKV_K8S_20=Idon'tcareaboutPrivilegeEscalation:-Ocheckov.io/skip2:CKV_K8S_14checkov.io/skip3:CKV_K8S_11=IhavenotsetCPUlimitsasIwantBestEffortQoS
spec:containers:
...LoggingFor detailed logging to stdout set up the environment variableLOG_LEVELtoDEBUG.Default isLOG_LEVEL=WARNING.Skipping directoriesTo skip files or directories, use the argument--skip-path, which can be specified multiple times. This argument accepts regular expressions for paths relative to the current working directory. You can use it to skip entire directories and / or specific files.By default, all directories namednode_modules,.terraform, and.serverlesswill be skipped, in addition to any files or directories beginning with..
To cancel skipping directories beginning with.overrideCKV_IGNORE_HIDDEN_DIRECTORIESenvironment variableexport CKV_IGNORE_HIDDEN_DIRECTORIES=falseYou can override the default set of directories to skip by setting the environment variableCKV_IGNORED_DIRECTORIES.
Note that if you want to preserve this list and add to it, you must include these values. For example,CKV_IGNORED_DIRECTORIES=mynewdirwill skip only that directory, but not the others mentioned above. This variable is legacy functionality; we recommend using the--skip-fileflag.Console OutputThe console output is in colour by default, to switch to a monochrome output, set the environment variable:ANSI_COLORS_DISABLEDVS Code ExtensionIf you want to use Checkov within VS Code, give a try to the vscode extension available atVS CodeConfiguration using a config fileCheckov can be configured using a YAML configuration file. By default, checkov looks for a.checkov.yamlor.checkov.ymlfile in the following places in order of precedence:Directory against which checkov is run. (--directory)Current working directory where checkov is called.User's home directory.Attention: it is a best practice for checkov configuration file to be loaded from a trusted source composed by a verified identity, so that scanned files, check ids and loaded custom checks are as desired.Users can also pass in the path to a config file via the command line. In this case, the other config files will be ignored. For example:checkov--config-filepath/to/config.yamlUsers can also create a config file using the--create-configcommand, which takes the current command line args and writes them out to a given path. For example:checkov--compact--directorytest-dir--docker-imagesample-image--dockerfile-pathDockerfile--download-external-modulesTrue--external-checks-dirsample-dir--quiet--repo-idprisma-cloud/sample-repo--skip-checkCKV_DOCKER_3,CKV_DOCKER_2--skip-frameworkdockerfilesecrets--soft-fail--branchdevelop--checkCKV_DOCKER_1--create-config/Users/sample/config.ymlWill create aconfig.yamlfile which looks like this:branch:developcheck:-CKV_DOCKER_1compact:truedirectory:-test-dirdocker-image:sample-imagedockerfile-path:Dockerfiledownload-external-modules:trueevaluate-variables:trueexternal-checks-dir:-sample-direxternal-modules-download-path:.external_modulesframework:-alloutput:cliquiet:truerepo-id:prisma-cloud/sample-reposkip-check:-CKV_DOCKER_3-CKV_DOCKER_2skip-framework:-dockerfile-secretssoft-fail:trueUsers can also use the--show-configflag to view all the args and settings and where they came from i.e. commandline, config file, environment variable or default. For example:checkov--show-configWill display:CommandLineArgs:--show-config
EnvironmentVariables:BC_API_KEY:your-api-key
ConfigFile(/Users/sample/.checkov.yml):soft-fail:Falsebranch:masterskip-check:['CKV_DOCKER_3','CKV_DOCKER_2']Defaults:--output:cli--framework:['all']--download-external-modules:False--external-modules-download-path:.external_modules--evaluate-variables:TrueContributingContribution is welcomed!Start by reviewing thecontribution guidelines. After that, take a look at agood first issue.You can even start this with one-click dev in your browser through Gitpod at the following link:Looking to contribute new checks? Learn how to write a new check (AKA policy)here.Disclaimercheckovdoes not save, publish or share with anyone any identifiable customer information.No identifiable customer information is used to query Prisma Cloud's publicly accessible guides.checkovuses Prisma Cloud's API to enrich the results with links to remediation guides.
To skip this API call use the flag--skip-download.SupportPrisma Cloudbuilds and maintains Checkov to make policy-as-code simple and accessible.Start with ourDocumentationfor quick tutorials and examples.Python Version SupportWe follow the official support cycle of Python, and we use automated tests for all supported versions of Python. This means we currently support Python 3.7 - 3.11, inclusive. Note that Python 3.7 is reaching EOL on June 2023. After that time, we will have a short grace period where we will continue 3.7 support until September 2023, and then it will no longer be considered supported for Checkov. If you run into any issues with any non-EOL Python version, please open an Issue.