Package: checkov2
Checkovis a static code analysis tool for infrastructure-as-code.It scans cloud infrastructure provisioned usingTerraform, Terraform plan,Cloudformation,Kubernetes, Dockerfile,ServerlessorARM Templatesand detects security and compliance misconfigurations.Checkov also powersBridgecrew, the developer-first platform that codifies and streamlines cloud security throughout the development lifecycle. Bridgecrew identifies, fixes, and prevents misconfigurations in cloud resources and infrastructure-as-code files.Table of contentsFeaturesScreenshotsGetting StartedDisclaimerSupportFeaturesOver 500 built-in policiescover security and compliance best practices for AWS, Azure and Google Cloud.Scans Terraform, Terraform Plan, CloudFormation, Kubernetes, Serverless framework and ARM template files.DetectsAWS credentialsin EC2 Userdata, Lambda environment variables and Terraform providers.EvaluatesTerraform Providersettings to regulate the creation, management, and updates of IaaS, PaaS or SaaS managed through Terraform.Policies support evaluation ofvariablesto their optional default value.Supports in-linesuppressionof accepted risks or false-positives to reduce recurring scan failures. Also supports global skip from using CLI.Outputcurrently available as CLI, JSON, JUnit XML and github markdown and link to remediationguides.ScreenshotsScan results in CLIScheduled scan result in JenkinsGetting startedRequrirementsPython >= 3.7 (Data classes are available for Python 3.7+)Terraform >= 0.12Installationpip3installcheckovInstallation on Alpine:pip3install--upgradepip&&pip3install--upgradesetuptools
pip3installcheckovInstallation on Ubuntu 18.04 LTS:Ubuntu 18.04 ships with Python 3.6. Install python 3.7 (from ppa repository)sudoaptupdate
sudoaptinstallsoftware-properties-common
sudoadd-apt-repositoryppa:deadsnakes/ppa
sudoaptinstallpython3.7
sudoaptinstallpython3-pip
sudopython3.7-mpipinstall-Ucheckov#to install or upgrade checkov)or using homebrew (MacOS only)brewinstallcheckovorbrewupgradecheckovUpgradeif you installed checkov with pip3pip3install-UcheckovConfigure an input folder or filecheckov--directory/user/path/to/iac/codeOr a specific file or filescheckov--file/user/tf/example.tfOrcheckov-f/user/cloudformation/example1.yml-f/user/cloudformation/example2.ymlOr a terraform plan file in json formatterraforminit
terraformplan-outtf.plan
terraformshow-jsontf.plan>tf.jsoncheckov-ftf.jsonNote:terraform showoutput  filetf.jsonwill be single line.
For that reason all findings will be reported line number 0 by checkovcheck:CKV_AWS_21:"Ensure all data stored in the S3 bucket have versioning enabled"FAILEDforresource:aws_s3_bucket.customerFile:/tf/tf.json:0-0Guide:https://docs.bridgecrew.io/docs/s3_16-enable-versioningIf you have installedjqyou can convert json file into multiple lines with the following command:terraformshow-jsontf.plan|jq'.'>tf.jsonScan result would be much user friendly.checkov-ftf.json
Check:CKV_AWS_21:"Ensure all data stored in the S3 bucket have versioning enabled"FAILEDforresource:aws_s3_bucket.customerFile:/tf/tf1.json:224-268Guide:https://docs.bridgecrew.io/docs/s3_16-enable-versioning225|"values":{226|"acceleration_status":"",227|"acl":"private",228|"arn":"arn:aws:s3:::mybucket",Scan result sample (CLI)PassedChecks:1,FailedChecks:1,SuppressedChecks:0Check:"Ensure all data stored in the S3 bucket is securely encrypted at rest"/main.tf:Passedforresource:aws_s3_bucket.template_bucketCheck:"Ensure all data stored in the S3 bucket is securely encrypted at rest"/../regionStack/main.tf:Failedforresource:aws_s3_bucket.sls_deployment_bucket_nameStart using Checkov by reading theGetting Startedpage.Using Dockerdockerpullbridgecrew/checkov
dockerrun--tty--volume/user/tf:/tfbridgecrew/checkov--directory/tfNote: if you are using Python 3.6(Default version in Ubuntu 18.04) checkov will not work and it will fail withModuleNotFoundError: No module named 'dataclasses'error message. In this case, you can use the docker version instead.Note that there are certain cases where redirectingdocker run --ttyoutput to a file - for example, if you want to save the Checkov JUnit output to a file - will cause extra control characters to be printed. This can break file parsing. If you encounter this, remove the--ttyflag.Running or skipping checksUsing command line flags you can specify to run only named checks (allow list) or run all checks except
those listed (deny list).List available checks:checkov--listAllow only 2 checks to run:checkov--directory.--checkCKV_AWS_20,CKV_AWS_57Run all checks except 1 specified:checkov-d.--skip-checkCKV_AWS_52Run all checks except checks with specified patterns:checkov-d.--skip-checkCKV_AWS*For Kubernetes workloads, you can also use allow/deny namespaces.  For example, do not report any results for the
kube-system namespace:checkov-d.--skip-checkkube-systemSuppressing/Ignoring a checkLike any static-analysis tool it is limited by its analysis scope.
For example, if a resource is managed manually, or using subsequent configuration management tooling,
a suppression can be inserted as a simple code annotation.Suppression comment formatTo skip a check on a given Terraform definition block or CloudFormation resource, apply the following comment pattern inside it's scope:checkov:skip=<check_id>:<suppression_comment><check_id>is one of theavailable check scanners<suppression_comment>is an optional suppression reason to be included in the outputExampleThe following comment skip theCKV_AWS_20check on the resource identified byfoo-bucket, where the scan checks if an AWS S3 bucket is private.
In the example, the bucket is configured with a public read access; Adding the suppress comment would skip the appropriate check instead of the check to fail.resource "aws_s3_bucket" "foo-bucket" {
  region        = var.region
    #checkov:skip=CKV_AWS_20:The bucket is a public static content host
  bucket        = local.bucket_name
  force_destroy = true
  acl           = "public-read"
}The output would now contain aSKIPPEDcheck result entry:...
...
Check:"S3 Bucket has an ACL defined which allows public access."SKIPPEDforresource:aws_s3_bucket.foo-bucketSuppresscomment:ThebucketisapublicstaticcontenthostFile:/example_skip_acl.tf:1-25

...To suppress checks in Kubernetes manifests, annotations are used with the following format:checkov.io/skip#: <check_id>=<suppression_comment>For example:apiVersion:v1
kind:Pod
metadata:name:mypodannotations:checkov.io/skip1:CKV_K8S_20=Idon'tcareaboutPrivilegeEscalation:-Ocheckov.io/skip2:CKV_K8S_14checkov.io/skip3:CKV_K8S_11=IhavenotsetCPUlimitsasIwantBestEffortQoS
spec:containers:
...LoggingFor detailed logging to stdout setup the environment variableLOG_LEVELtoDEBUG.Default isLOG_LEVEL=WARNING.Skipping directoriesTo skip a whole directory, use the environment variableCKV_IGNORED_DIRECTORIES.
Default isCKV_IGNORED_DIRECTORIES=node_modules,.terraform,.serverlessVSCODE ExtensionIf you want to use checkov's within vscode, give a try to the vscode extension availble atvscodeAlternativesFor Terraform compliance scanners check outtfsecandTerraform AWS Secure Baselinefor secured basline.For CloudFormation scanning check outcfripperandcfn_nag.For Kubernetes scanning check outkube-scanandPolaris.ContributingContribution is welcomed!Start by reviewing thecontribution guidelines. After that, take a look at agood first issue.Looking to contribute new checks? Learn how to write a new check (AKA policy)here.Disclaimercheckovdoes not save, publish or share with anyone any identifiable customer information.No identifiable customer information is used to query Bridgecrew's publicly accessible guides.checkovuses Bridgecrew's API to enrich the results with links to remediation guides.
To skip this API call use the flag--no-guide.SupportBridgecrewbuilds and maintains Checkov to make policy-as-code simple and accessible.Start with ourDocumentationfor quick tutorials and examples.If you need direct support you can contact us atinfo@bridgecrew.io.