Project: Checkov (Provisioning / Security & Compliance)
File: Quick Start.md

layout: default published: true title: Quick Start nav_order: 3 This Quick Start guide shows how to install Checkov, run a scan, and analyze the results. For more advanced configuration, see the and the rest of this documentation. ```text pip install checkov ``` Use the command below to indicate the folder that contains your Terraform plan files and run a scan. ```text checkov -d /user/tf ``` Consider the configuration of an S3 bucket as represented in the Terraform sample below. ```yaml resource "awss3bucket" "foo-bucket" { region = var.region bucket = local.bucket_name force_destroy = true tags = { Name = "foo-${data.awscalleridentity.current.account_id}" } versioning { enabled = true } logging { targetbucket = "${awss3bucket.logbucket.id}" target_prefix = "log/" } serversideencryption_configuration { rule { applyserversideencryptionby_default { kmsmasterkeyid = "${awskms_key.mykey.arn}" sse_algorithm = "aws:kms" } } } acl = "private" } ``` The scan output would be: ```xml Passed checks: 4, Failed checks: 0, Skipped checks: 0 Check: "Ensure all data stored in the S3 bucket is securely encrypted at rest" PASSED for resource: awss3bucket.foo-bucket File: /example.tf:1-25 Check: "Ensure the S3 bucket has access logging enabled" PASSED for resource: awss3bucket.foo-bucket File: /example.tf:1-25 Check: "Ensure all data stored in the S3 bucket have versioning enabled" PASSED for resource: awss3bucket.foo-bucket File: /example.tf:1-25 Check: "S3 Bucket has an ACL defined which allows public access." PASSED for resource: awss3bucket.foo-bucket File: /example.tf:1-25 ``` The configuration complies with the policies for AWS S3 resources. Suppose that now the same bucket is configured to allow public access: ```text resource "awss3bucket" "foo-bucket" { acl = "public-read" } data "awscalleridentity" "current" {} ``` The output report would then contain a failed check: ```xml Passed checks: 3, Failed checks: 1, Skipped checks: 0 Check: "Ensure all data stored in the S3 bucket is securely encrypted at rest" PASSED for resource: awss3bucket.foo-bucket File: /example.tf:1-25 Check: "Ensure the S3 bucket has access logging enabled" PASSED for resource: awss3bucket.foo-bucket File: /example.tf:1-25 Check: "Ensure all data stored in the S3 bucket have versioning enabled" PASSED for resource: awss3bucket.foo-bucket File: /example.tf:1-25 Check: "S3 Bucket has an ACL defined which allows public access." FAILED for resource: awss3bucket.foo-bucket File: /example.tf:1-25 1 | resource "awss3bucket" "foo-bucket" { 2 | region = var.region 3 | bucket = local.bucket_name 4 | force_destroy = true 5 | 6 | tags = { 7 | Name = "foo-${data.awscalleridentity.current.account_id}" 8 | } 9 | versioning { 10 | enabled = true 11 | } 12 | logging { 13 | targetbucket = "${awss3bucket.logbucket.id}" 14 | target_prefix = "log/" 15 | } 16 | serversideencryption_configuration { 17 | rule { 18 | applyserversideencryptionby_default { 19 | kmsmasterkeyid = "${awskms_key.mykey.arn}" 20 | sse_algorithm = "aws:kms" 21 | } 22 | } 23 | } 24 | acl = "public-read" 25 | } ``` In addition to the various formats for seeing scan results (for example, CLI), you can also visualize Checkov results with a quick integration with a Prisma Cloud account. Read more about . In addition to integrating with your code repository, Checkov can also integrate with your automated build pipeline via CI/CD providers. When your build tests run, Checkov will scan your infrastructure as code files for misconfigurations. You can integrate Checkov with: To get real-time IaC scanning and in-line fixes directly from your IDE, check out the and the .