Project: Checkov (Provisioning / Security & Compliance)
File: CHANGELOG.md

terraform: handle module source tag ref when it is not the first parameter - sast: fix random test sast js - general: Double-Encode URI for RelayState Parameter - sast: CDK TypeScript policies - terraform: add check for tf module versioned tag - secrets: secretfilterblock_list filter by file name and suffixes - secrets: secretfilterblock_list filter by file name and suffixes 2 - general: Fix policy.name to use the spaces as specified on CLI. - secrets: bump bc-detect-secrets to 1.5.10 - general: Add deep-analysis to GHA - terraform: Add more hype policies - ansible: fix ansible definitions raw type - ansible: add set definitions raw to ansible runner - general: Handle SAST suppressions (suppressions V2) - general: add RENDEREDGESDUPLICATEITERCOUNT to docs - general: Update README links for PyPi - ansible: add missing arg to ansible runner - sast: Enable cdk ts integraion test - secrets: add files for secret to skip - terraform: Update CKVAWS31 for RBAC - github: add summary message in githubfailedonly output - sast: add ts checks to python pack - sast: run all cdk integration test - general: fix changed serif path - sast: Add 10 TS CDK - sast: add typescript - DONT MERGE - sast: Filter js files generate by ts - secrets: bump bc-detect-secrets 1.5.9 - terraform: Add GCP policy - terraform: Add resource attributes to jsonify - terraform: Ensure dedicated data endpoints are enabled - terraform: support provider in tf_plan graph - terraform: Update CloudArmorWAFACLCVE202144228.py - general: add print to random test - general: fix integration test in build - general: fix integration tests - kubernetes: Update checkov-job.yaml - sca: remove old test for the depracated workflow github-action - terraform_plan: Edges not created because of indexing in resource terraform: CKVAWS23 rule description fixed for clarity - terraform: Fix CKVAWS358 to handle plan files - ansible: add create_definitions function for ansible framework - general: Fix docs html brackets - general: Remove Python 3.7 - general: Update range includes to handle lists of ranges and lists of values - sast: TypeScript cdk policies p7 - bicep: Add bicep version of policy - sca: support licenses custom policies enforcement rules - sast: Add 5 cdk for TS - sast: fix skipped_checks paths before upload to the platform - sast: adding extended code block - sca: using the new api license/get-licenses-violations instead of packages/get-licenses-violations (which is deprecated) - sca: Revert "feat(sca): using the new api license/get-licenses-violations - sast: save suppress_comment for sast inline suppressions - secrets: Azure Storage Key detector updates in bc-detect-secrets 1.5.7 - sast: CDK TS policies p2 - sast: Add TS CDK policies 1 - sast: CDK TS policies p3 - terraform: Fix conditional expression evaluation logic with compare - terraform: Fixed flaky test for CKVAWS356 - sast: Adding typescript cdk part 6 paz - sca: enabling suppression in the cli-output for IR-files and dockerfiles - terraform: support s3 bucket name for references in graph - general: Update the releases' zip file names to be generic - general: add policy metadata filter exception flag - general: remove limitation of resource and provider in tf.json file - general: pin the version of schema to

- secrets: bump manually bc-detect-secrets - terraform: add fix for when tf_def is a string - terraform: fix for_each resource handling - sca: Fix suppression integration crashing if licenseTypes is missing - terraform: Fixed bug in evaluateconditionalexpression and added zipmap support - sast: support sast skipped checks - secrets: ignore secret check in test file - general: handle API errors with more detail - secrets: fix entropy detector FP - terraform: prevent side effects when updating variable rendering - terraform: connect module resource to provider - gha: make sure to have prisma url - general: add policy name and guidelines to CSV output - sast: add attribute verification - terraform: Dont duplicate more vertices than needed for nested modules with large count/for each values + used cache to avoid extensive usage of os.path.realpath to drastically improve performance - general: improve upload failure logging and log size of failed files - sast: do not log warning when using skip framework - terraform: better handling of interpolation rendering in conditional expressions - terraform: Changed a couple of checks from negative to positive check, behavior is the same - sca: handling unknown severity - terraform: Add Condition exceptions CKVAWS70 - terraform: Add k8s 1.29 to CKVAWS339 - sast: fetch sast custom policieis - terraform: Added support for `try` function in evaluate_terraform - cloudformation: add CFN policies for MSK - terraform: support vertex reference based on foreach key - terraform: CKVAWS308 - checked if caching was enabled and only then check for encryption of cache - sast: fix cdk checks path - graph: remove SCA runner v1 - re-enable - general: Implement authentication retry mechanism - sast: add danger rule - general: downgrade botocore dependency - graph: remove SCA runner v1 - terraform: Deleted deprecated check CKVGCP19 - general: downgrade boto3 - terraform: fix check CKV2AZURE10 - secrets: bump bc-detect-secrets to version 1.5.4 - azure: create arm check StorageAccountMinimumTlsVersion CKVAZURE236 - sast: add dataflow to output - terraform: Correctly relace foreachvalue inside update_attributes for complex cases - terraform: find explicit lockout fail actions for s3 - sca: persist support logs for sub processes - sast: summarize errors - terraform: and cdk/cloudformation: inconsistent naming of AWS resources in checks - general: remove igraph - terraform: Manually fixed test for loading terraform registry to be with commit hash instead of version tag - sast: replaced TBD with owasp and removed "sast engine" - terraform: External module test - sast: Add policies to executable - sast: change the path for taint mode match - sast: fix report with only reachability - general: Change SAST enforcement rule to weaknesses - general: handle weaknesses rename - sast: Fix serialize for sast report with taint mode - general: allow colorama version >=0.4.3,<0.5.0 in setup - sast: fix relative paths in sast cdk reports - sast: fix sast cdk code location paths - terraform: CKVGCP79 Upgrade CloudSQL SQLSERVER major version to 2022 - terraform: Improved bad performance pathlib check - general: fix multiprocess abilities - general: fixing hidden dependencies & state breaking tests - general: Reenabling cdk-integration-tests - terraform: Support "passprefixlist" for SG ingress rules correctly - general: temporary disable runtime config - terraform: node pools should be configured separately from a cl - terraform: handle no action in awsdlmlifecycle_policy - no noteworthy changes sast: Add sast metadata to sast report - terraform: Add various vertex related policies - sast: persist empty sast report for cdk - terraform: Fix typo Customer Managed Key - terraform: CLI output - add indication if repository was discovered In a running environment - sast: add missing field in MatchMetadata - sast: add dataflow to checkov report from sast - terraform: add CKV2AZURE47, ensure storage account is configured without blob anonymous access - terraform: Ensure SES Configuration Set enforces TLS usage - terraform: pod security policy removed in GKE

- sast: Split sast and cdk reports - terraform: Fix CKVAzure234 - terraform_plan: Add PY graph checks for tf plan - terraform: Remove CKVAWS188 as dupe - sast: add integration test platform report - sast: python Cdk policies batch 3 - sast: python Cdk policies batch 4 - sast: add save local sast report to run integration script - terraform: Used parallel run to run all split_graph iterations - general: anchor cyclonedx to last non breaking version - general: Revert pipfile lock changes - sast: add back commented checks - sast: fix reachability with no regular matches - sca: not printing reachability data for lines without cves - terraform: fix for check VPCPeeringRouteTableOverlyPermissive and add tests - sast: fix sast report format - secrets: used 10 characters in secret violation - general: check both path types for suppression - terraform: Fix range issue in OCI RDP check - sca: Update the log level of specific logs - terraform: CKVGCP26 Added additional googlecomputesubnetwork purposes that do not support flow logs - terraform: Fix CKVGCP30 for unknown service account - terraform: Fixed todict of terraform block regarding sourcemodule_object - ansible: add CKVPAN17 - Check for src and dst zone any - sast: sast enabled from integration - terraform: Adding Python based build time policies for corresponding PC runtime policies - terraform: Adding YAML based build time policies for corresponding PC runtime policies - general: handle the updated on prem response from the platform - sca: Using alias data from assets.json for giving Package Used indication for aliased packages - terraform: Add sourcemoduleobject to blocks from_dict func - ansible: PAN-OS IPsec checks - ansible: add CKVPAN16 PAN-OS BPA Check for session log at start - sast: Add alias data to imports assets - bicep: Update AppServiceHttps20Enabled to consider newer ApiVersion - general: Policy metadata API fixes - gha: Update GitHub Actions Workflow

#5742 - terraform_plan: load terraform registry checks when using terraform plan - terraform: Ensure HTTPS in Azure Function App and App Slots - general: do not display an auth error when the runconfig endpoint returns a 500 - general: set default parallelization type to spawn and leverage Terraform downloaded module by default - terraform: Ensure ACR is zone-redundant - general: Revert parallelization commit - sast: remove SAST frameworks for OSS users - secrets: don't reinitialize the upload client without API key usage - general: properly escape CLI flags in the CLI command docs - terraform_plan: TF plan resources connection fix - terraform: Adding YAML based build time policies for corresponding PC runtime policies - terraform: fix valid value for aws keyspacestable encryptionspecification type - terraform: check min TLS version also on azure app slots - general: add possibility to change parallelization type - cloudformation: ignore unresolved references in CKVAWS45 - sast: Python cdk policies batch 2 - general: add option to pass `--skip-download` with github-action - general: print the log upload location if the --support flag is used - terraform: Adding both azurermlinuxwebappslot & azurermwindowswebappslot in scope of the test CKVAZURE153 - general: Switch references to Bridgecrew with Prisma Cloud - general: do not require a repo ID when using an API key and --list - sast: add new python CDK policies - terraform: Ensure that only critical system pods run on system nodes - terraform: Ensure App Service Environment is zone redundant - terraform: Ensure that Standard Replication is enabled - sca: Setting only relevant cves for the extracted reachable functions with risk factor of ReachableFunction as True - terraform: CKVAWS208 valid Amazon MQ versions - sca: adjusting the cli-output to support indicating of reachable functions - terraform: Adding YAML based build time policies for corresponding PC runtime policies - terraform: bigtable deletion protection terraform: drop and deletion checks for spanner - sast: add cveid to reachability report - sca: Extending reachability post-runner in checkov and enriching cves with ReachableFunction data - general: fix duplicate components in CycloneDX report - general: address python 3.12 SyntaxWarning - terraform: fix variable rendering for foreach resources with dot included names - sast: comment out SAST JS integration test - general: Fix sast & cdk integration tests - sast: Adding exit code in sast integration test - sast: adjust SAST file pattern search - sast: fix sast reachability report format - terraform: Fixing the typo within the name of the Terraform check CKVAZURE158 - general: Do not crash the run if S3 integration fails during setup, upload, or finalize - secrets: fix secret FP of clientsecretsetting_name - general: Add SAST enforcement rules and check severity thresholds - general: do not get fixes for on prem integrations - general: remove level up flow - general: remove multi_signature and adjust base check classes - general: v3 release - sast: fix error logs coming from SAST - general: add BC token deprecation notice and v3 migration guide - general: Adds GHA support for skip-frameworks, skip-cve-package & output-bc-ids flags - terraform: Ensure that the SQL database is zone-redundant - terraform: Ensure the Azure Event Hub Namespace is zone redundant - bicep: enforce encryption flag to be string for CKVAZURE97 - terraform_plan: Add provisioners to TF Plan parser - terraform: Support for merge func inside jsondecode - sca: make the abs path to be correcnt - arm: implement CKVAZURE103 for ARM - arm: implement CKVAZURE96 for ARM - arm: implement CKVAZURE97 for ARM - terraform: Added a check to make sure dynamic "blocks" are of the expected type - terraform: update CKVAWS339 valid EKS versions - sca: giving file path on relative the the current dir for cases there is no either specified root_folder and the is no repo scan dir - terraform: support scanning of Terraform managed modules instead of downloading them - terraform: Fixing issues with checks CKVAZURE226 & CKVAZURE227 - sca: support case where there are no cves suppressions - general: Remove code upload for on-prem integrations - arm: implement CKVAZURE95 for ARM - general: Added source and target to edge data - terraform_plan: add azurermportaldashboard to jsonify list - terraform: check if the dynamic name is one of the resources block - general: remove Python 3.7 - graph: remove CHECKOVCREATEGRAPH env var to control graph creation - dockerfile: fix Docker image scan - openapi: Take into account that security is at the root level of your OpenAPI specification. - terraform: stop CKVGCP43 crashing when not a string - terraform: fix upload resourcesubgraphmaps - terraform: Upload resource subgraph map - terraform: fix in subgraphs uploads - terraform: upload tf sub graphs - terraform: Ensure ephemeral disks are used for OS disks - terraform: Ensure that App Service plan is zone redundant - terraform: Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources - general: Add image referencer rustworkx support - general: Add rustworkx support - terraform: Adding 2 new AWS policies - terraform: simply IMDSv2 checks - arm: CKVAZURE88 convert to arm check - arm: implement CKVAZURE149 for ARM - terraform: Adding missing null checks - general: add rustworkx (#5511) - general: Revert add

(#5565)" - general: expose retry and timeout configuration for interaction with the platform - sca: creating alias mapping for javascript - sca: creating alias mapping for javascript - sca: revert creating alias mapping for javascript - general: fix print to encode in windows - terraform: Nested sourcemoduleobjects with missing foreach key - arm: implement CKV2AZURE27 for arm - terraform: Add new policy for deprecated runtimes - terraform: Ensure Event Hub Namespace uses at least TLS 1.2 - terraform: Ensure that the Ledger feature is enabled on database that requires cryptographic proof and nonrepudiation of data integrity - general: add rustworkx - terraform: Module from_dict func to static func - general: attempt to fix overload in loaders and add tests - general: remove 3.7 integ. test - general: remove line to force code change - terraform: add check Neptune DB clusters should be configured to copy tags to snapshots - terraform: add CKVAWS361 to ensure Neptune DB cluster has adequate backup retention - terraform: Fix externalmodulessource_map serialization - terraform: add check for Neptune DB clusters IAM database auth enabled - terraform: add CKVAWS360 to ensure backup retention period on AWS Document DB - terraform: add public network checks for Azure Function and Web Apps - arm: Implement CKVAZURE111 in ARM - arm: implement CKVAZURE134 for ARM - arm: implement CKVAZURE160 for arm - arm: implement CKVAZURE89 for ARM - terraform: CKVAWS208 bug fix - general: Check module download - general: Check module download and quit on failure - arm: Implement CKVAZURE101 for ARM - arm: implement CKVAZURE107 for arm - arm: implement CKVAZURE113 for ARM - arm: implement CKVAZURE112 for arm - arm: implement CKVAZURE40 for ARM - arm: implement CKVAZURE58 for ARM - arm: implement CKVAZURE94 for arm - helm: Changed error message to failure to better differentiate problems - terraform_json: correctly parse data blocks in Terraform JSON - terraform: continue processing of TF modules in the same file - terraform: fix error type - arm: implement CKVAZURE100 for arm - arm: implement CKVAZURE114 for arm - arm: implement CKVAZURE130 for arm - arm: implement CKVAZURE151 for arm - arm: correctly handle json files with comments and output parsing errors - arm: CKVAZURE66 implement config logging check for arm - arm: convert CKVAZURE65 to arm - arm: Implement CKVAZURE109 in arm - arm: implement CKVAZURE63 for arm - arm: implement CKVAZURE80 in arm - secrets: fix resource in git history scan - terraform: extend CKV2AWS5 to include awsappstreamfleet (#5487) - arm: migrate check CKVAZURE50 to arm - arm: translate tf CKVAZURE93 check to arm - kubernetes: Added new endpoint for both helm and kustomize - dockerfile: consider platform flag in CKVDOCKER7 - kustomize: support kubectl 1.28+ - secrets: handle non iac secrets FP - terraform: Replaced / with os.pathsep to support windows better in terraform runner - terraform: make jq default - terraform: Fix for-each/count updating inner for each index for every child resource - sca: Filter IR FW upload results by supportedIrFw list - dockerfile: Add CKV2DOCKER17 for chpasswd - kustomize: Fix kustomize ignoring external policy dir command line options - terraform: Remove old tf parser - terraform: ensure TFModule is created properly in definition context - terraform: Removed most usages of enablenestedmodules - sca: update spdx-tools dep to version 0.8.0 and lower bound it - terraform: Add address field on vertices even if render_variables is set to False - terraform: add new attached resource possibility to

#5424 - terraform: fix ordering issue in CKVAWS358 - arm: improve CKVAZURE24 check - general: Fix empty credentials file issue - secrets: Make non-entropy signatures take precedence over entropy signatures - terraform: Remove DMS S3 check CKVAWS299 - terraform: Github Actions OIDC trust policy check - general: allow `--var-file` to be passed as environment variable - terraform: Add new policy to ensure AWS Transfer server only allows secure protocols - general: remove obsolete run config fallback API call - gha: Update setup-python version in GitHub Actions.md - terraform: new serialization methods for module and block - terraform: pr for upgrade-checkov - terraform: add TFDefinitionKey to getentitycontextandevaluations - terraform: consider new domain attribute in CKV2AWS19 - sca: support composer.json - terraform: Use new function to create multi graph instead of single graph - general: Implement SSO Relay State Parameter in Checkov Output Links - sca: fix package line numbers - terraform: Fix CKVAWS104 to support new values - terraform: add new function to create module and definitions with tests - terraform: GCP Ensure IAM Workload identity is restricted - general: fix inline suppression collection inside lists - terraform: leverage readfilewithanyencoding to safely look for modules - general: Add resource code filter to all checkov loggers - general: Infrastructure for custom code logger filter - kustomize: Avoid index error when calculating file path - openapi: Add CKVOPENAPI21 - secrets: handle regex error in custom secrets gracefully - general: update docs about installation guidelines - github: Add ability for External checks with git branch - sca: add fix command and code for indirect deps - kubernetes: No dups when extracting images - sca: add fix code and command to cve report - sca: fix code block array structure - general: properly encode non supported chars in SARIF uri field - sca: Add SCA skip comments to docs - kustomize: Added support for case where no parents are found for the relative fie path - terraform: Update CKV2AWS12 for the new defaults - kustomize: Support child k8s resources inside kustomize origin annotations - kustomize: Checked for existence of callerfilepath in definitions_raw - openapi: Fix ws for CKVOPENAPI20 - terraform: CKVAWS342 - managed rules have predefined actions - general: support UTF-16 and other encodings in multiple frameworks - kustomize: add back reverted kustomize annotations and update build github action to use github runners - kustomize: Add origin annotations to calculate bases of kustomize checks - secrets: Improve the entropy keyword combinator secret scanner - openapi: Fix CKVOpenAPI20 - terraform: fix invalid value in CKVAWS304 - terraform: support new field in CKV2AWS3 - dockerfile: add ARM build for K8s container image - general: Add checkov.spec to enable PyInstaller - terraform: remove CKV2AZURE18 check and improve CKV2AZURE1 - general: use sca inline suppressions - openapi: New OpenAPI check CKVOPENAPI20 - terraform: remove deprecated check CKVGCP67 - general: Add csv to output - graph: add experimental debug output for graph check evaluation - general: revert add composer files to supported package files - general: add composer files to supported package files - terraform: add module check for commit hash revision usage - openapi: add security definition type validation into CKVOPENAPI9 - secrets: fix secrets omit crash when value is not string - terraform: ignore local modules in CKVTF1 - arm: consider encryption property in CKVAZURE2 - terraform: add missing AWS RDS CA certificate identifiers for awsdbinstance resource - general: remove log from parallel common - general: Fix local repo generated name if ends with / - terraform: ensure kms key policy is defined - sca: fix wrongly invoked Image Referencer scanning when scanning a single file - terraform_plan: add terraform plan vertices to terraform graph if not exist - dockerfile: negative `is_dockerfile()` lookup on

suffix - terraform: fix empty value issue for CKVGIT4 - graph: add jsonpath custom policy example - gha: add skippath flag to GHA and allow multiple values in varfile - sca: add root package name and version to csv sbom - arm: Handle another structure for SQL retention policy - secrets: limit line length for custom secrets - terraform: Update GCP checks for plan files - sca: removing the using of the constant CHECKOVDISPLAYREGISTRY_URL - general: add checkov_diff pre-commit hook for scanning all changed files - cloudformation: fix CKVAWS33 to consider deny statements - general: Update pre-commit.md - arm: and bicep: Ensure that Azure Front Door uses WAF in "Detection" or "Prevention" modes CKVAZURE123 - general: handle cloned checks filtered via labels - terraform: adjust CKVAZURE6 to comply with new provider version - arm: Handle arm db servers 2021 05 01 - terraform: Mark unresolved tf function calls as unresolved - general: Add Enforcement CLI Command - terraform_plan: Expose field changes to python checks - general: Check that the result is not None before extracting vars in cli multiprocess runs - general: Correctly handle cli graphs in case we run with multiprocessing - kubernetes: dont' fail if spec is missing and default value is set to the fix value. - arm: ARM and bicep checks for CKVAZURE121 - terraform: Ensure Application Gateway defines secure SSL protocols CKVAZURE217, 218 - terraform: Ensure Azure firewall sets threatintelMode to Deny - terraform: Ensure firewall defines a policy - terraform: Ensure Firewall policy has IDPS mode as deny - dockerfile: support platform flag in CKVDOCKER11 - terraform: support condition in IAM policy data blocks - terraform: Unable to download Terraform modules from JFrog Artifactory - ansible: add support of inline suppression for Ansible graph checks - terraform: Use just AWS regex to check EC2Credentials - cloudformation: fix evaluatedefaultrefs func in cfn - general: fix SARIF output related to security-severity field - terraform: adjust CKVAWS85 to only look for one log type to pass - terraform: update latest major version of Postgres to v15 - general: Add no upload flag and report contributors for all API key runs - kubernetes: fix extracting k8s nested resources - sca: suppression - fix unit testing - sca: suppression is not working on SCA packages - terraform: don't fail CKVAWS2 on un-rendered value - terraform: Foreach support resources edges - terraform: exclude unrestrictable actions in CKVAWS355 and CKVAWS356 - general: Update operators with examples - general: Added computation of gitrootpath to igraph serialization - sca: adding validation for the filelinenumber - terraform: foreach remove error from info log. - terraform: Should use UNKNOWN rather than skipped - terraform: extend CKV2AWS5 with new resources - terraform: IAM limit resource access - kustomize: fix empty kustomize file crash - general: SBOM lines numbers adjusting - sca: adding the risk factor v2 to the vulnerability details - sca: dockerfile image-referencer fixes - secrets: Add new pre-commit hook for secrets - terraform: add check to look at star resources - gitlab: Skipping image blocks without name attribute - terraform: fix terraform variable rendering for provider alias - general: Enhancing Sarif output with Security Severity Level - secrets: add jwt detector to the secret runner - terraform: Adding yaml based build time policies for corresponding PC runtime policies - terraform: AWS Ensure RDS performance insights uses a CMK - terraform: NACL should restrict port ingress - terraform: RDS Enable Performance insights - dockerfile: improve update searching in CKVDOCKER5 - general: Update CLI Command

- general: add SPDX output - kubernetes: seperate service acoount builder to improve performance - sca: showing line numbers in the cli output for csv - sca: showing line numbers in the cli output for licenses - dockerfile: Support docker graph check skips - sca: using the lines in the directly in the record, rather than in the "vulnerability_details" + having it in ExtraResources - kubernetes: Improve k8s perf - terraform: EMR - At rest local disk, EBS and in transit encryption checks - kubernetes: add mini k8s parser for invalid templates - terraform: handle false-positives for Route53ZoneEnableDNSSECSigning - general: Add lines to SBOM - graph: upload graphs to the platform - terraform: skip invalid multiple modules names - sca: only run image referencer with sca_image framework - kustomize: Support inline skips for Kubernetes graph checks - secrets: add filter for suppressed custom secret checks - secrets: exclude Kubernetes secretName from secret scanning - secrets: omit the code line - terraform: Added callerfilepath and callerfileline_range to reduced report - terraform: AWS IAM don't generate root credentials 348 - terraform: Ensure Neptune cluster is encrypted with a CMK CKVAWS347 - terraform: fix SQS encryption check CKVAWS27 - general: Fix some links - general: update Python custom checks docs - terraform: aws ensure delete protection for firewalls 344 - terraform: check that WAF rules have an action 342 - terraform: Ensure encryption for firewall uses a CMK CKVAWS345 - terraform: Ensure Network firewall policy defines a encryption configuration that uses a CMK - CKVAWS346 - kubernetes: Update ckvk8s31 - general: include missing files in save repository - terraform: launch config/template Ensure metadata hop =1 341 - terraform: Update CKVAZURE43 StorageAccountName.py VARIABLE_REFS - arm: enabled is not true - cloudformation: Enable ALB to support tls1.3

#4962 - secrets: add handling of unicode error - general: Catch None responses from BE - terraform: Elastic beanstalk uses managed updates and fixes the EB check while i 340 - secrets: don't scan images in git history - terraform: fix foreach render value for lookup - terraform: Handle entity context for for_each resources - secrets: open the feature - scan git history - terraform: Set TF Modules for_each env var to true - terraform: Set TF modules for_each env vars as True - secrets: add filter for suppressed custom secret checks - terraform: improve attribute performance - terraform: Update CKVAWS338 message and retention check for 0 - terraform: Update CKV2AZURE33 to remove checks on unrelated conditions - secrets: Adding quote to required secret in case needed - secrets: change color of invalid secret message - general: upload checks code_block to report - kubernetes: support suppressing custom K8s policies - terraform: AWS EKS Use only platform supported versions 339 - terraform: Azure APIm backend uses only HTTPS - terraform: Ensure Cloudwatch retention is a year or more 338 - terraform: remove redundant foreach deepcopy - secrets: fix missing history results when history store is used - terraform: secret- also check user data in launch config and template - gitlab: fix resource id parsing recursive - terraform: fix docs formatting - terraform: add support for private terraform registries - terraform: remove cross varaibles bad list comprehension - general: log all returned enforcement rules for debugging - general: remove invalid URLs in GitLab SAST output - secrets: change default value of secret values to empty strings - terraform: Added a condition to not override source module object for old parser - terraform: Ensure container defines a readonly root drive 336 - terraform: ensure pidmode is not set to host 335 - terraform: Ensure SSM params are encrypted using a CMK 337 - terraform: Network firewall must define a logging configuration CKV2AWS63 - terraform: Reduce module loading in TF Parser - kustomize: fix image_referencer paths - terraform: support TF provider v3 for lifecycle existence check - terraform_plan: Add Deep Analysis to docs - general: deserialize report & record from json - sca: fix extract fix version in sbom report - terraform: cross variable performance improvement - github: make GH Actions delimiter unique in multiline env vars - general: add policy-metadata-filter to gh action - secrets: support first commit results - terraform: Used generator instead of list comprehension to improve performance for large graphs - terraform: make the ECS cluster logging check more resilient - terraform: remove invalid Terraform module reference support - terraform: support null values in list of dicts - bitbucket: Update Bitbucket documentation to match the

- sca: Add more ways to skip CVEs - general: 3D policies syntax refactor - secrets: support scanning of secrets in hidden paths - secrets: Revert timeout in unix to work with signals - secrets: timeout in unix to work with signals - secrets: Add readme file for Git History - sca: add is public fix version to sbom report - secrets: add more files to ignore list in git history - terraform: Ensure that container definition is not privileged 334 - terraform: TF provider check support - general: Dedup results contain multiple identical images if using template syntax - general: fix wrong abs path in IR record - secrets: Save fetched policy destination from current work dir to temp - secrets: timeout in unix to work with signals - terraform: Fix for_each flow conditions - terraform: make sure K8s volume is a dict - arm: add Storage accounts disallow public access check for ARM - dockerfile: Add CKV2DOCKER16 for PIPTRUSTEDHOST - sca: add is private fix version to sca output - secrets: fix absolute file path cases - terraform: fix foreach count is none bug - terraform: limit RDS cluster audit logging to MySQL engine - terraform: remove duplicate call to convert graph vertices - terraform: remove local blocks with just line number - secrets: improve timing git history - terraform: add support for list of dicts in for loop - cloudformation: fix invalid fn sub param in cfn - secrets: fix error if writing to file when don't have access - secrets: fix None in file name - secrets: reduce false positives in yaml files - case of serverless and secretmanager - terraform: ECS Service should not auto assign public IPs 333 - terraform: EFS access points should define a user and a path 329-330 - terraform: Ensure ECS Fargate uses latest version 332 - terraform: Transit gateway should not be set up to autoaccept any VPC 331 - general: fix duplicate sarif output - secrets: fix slicing in githistory - terraform: exclude GCP asymmetric keys from key rotation - terraform: Paid is now standard - terraform: support empty filter in S3 lifecycle config - general: catch unexpected errors when querying OpenAI - secrets: Add fields to record of secrets in git history - terraform_plan: Handled TFDefinitionKey in plan runner as well - cloudformation: support inline suppression of CFN graph checks - terraform: Aurora DB should enable backtrack - terraform: Desync must be set to defensive or strictest - terraform: Ensure that RDS clusters are encrypted using a CMK - terraform: RDS Cluster - make sure rds cluster defined defaults for logging and audit logging - general: be more forgiving of skipped checks without comment - terraform: default case should pass for auto updates - terraform: False negative for CKVAZURE179 - terraform: Only update config if len is bigger than 0 - dockerfile: Add CKV2DOCKER15 for yum-config-manager sslverify - cloudformation: Security Group check now work for ranges and strings - terraform: Ensure APPService default action is to ignore not fail - terraform: Subnetworks with internal purpose can have privateipv6google_access - terraform: Adding yaml based build time policies for corresponding PC runtime policies - terraform: Fix for edge cases in for_each modules - kubernetes: support non-utf-8 encoded Kubernetes manifest files - terraform: ElasticCache for Redis cluster should automatically take minor updates - terraform: Ensure opensearch is configured for HA - terraform: Ensure Redshift specifies a DB name - terraform: Ensure Redshift uses enhanced vpc routing - terraform: Fix up ES logging check - general: don't add an invalid URL to helpUri field in SARIF output - graph: support string values for resource_types in graph checks properly - kubernetes: Don't require ImagePullPolicy when digest (#4776) - secrets: catch errors in middle of process of getting commit diffs - terraform: Fix addtoblock condition to support more edge cases - terraform: fix false positive CKV2GCP20 (fails for any non-MySQL instance) - terraform: Length resolvers evaluate length of `dict` as 1. - general: Save error lines in IR records - general: add OpenAI integration - terraform: Ensure that cloudwatch alarms are set on - general: fix scan all files entrypoint - terraform: Set back CHECKOVENABLEFOREACH_HANDLING to False to check perfomence - terraform: TF new parser - Check for tfvars block - ansible: PAN-OS policy and zone checks - terraform_plan: support data blocks in Terraform plan files - terraform: Set CHECKOVENABLEFOREACH_HANDLING as True - terraform: Correctly serialize/deserialize TFModule object - terraform: Fix nested

replacement in for_each handler - secrets: make git history scan run in parallel - terraform: Add sourcemoduleobject_ to block attributes - terraform: codebuild dont enable privilege mode - terraform: Fix nested statements in isstaticforeachstatement - terraform: AWS Use Launch templates in ASG - terraform: Codebuild defines and uses logs - terraform: Foreach - Fix regex on an empty list - general: Add scan all files to entrypoint - terraform: check routes are authorised - terraform: CloudDistribution set Failover origin - terraform: code build s3 logs are encrypted - terraform: Elasticbeanstalk should use enhanced health reporting - terraform: RDS cluster copy tags to snapshot - terraform: Support for_each/count statements in TF Modules - secrets: Don't show stack trace in failures when uploading secrets to verify - secrets: Compare abs paths in SecretsOmitter - terraform: refine IAM assume role check CKVAWS61 - terraform: refine S3 lifecycle check CKVAWS300 - terraform: external module from git fail - log warning - terraform: Document no private registry - general: fix default log levels for support stream - ansible: Ansible panos int mgmt checks - terraform: api gateway ensure api cache is encrypted - terraform: AWS ensure Sagemaker Notebook users are not Root - terraform: Sagemaker Notebook In Custom VPC - terraform: Terraform runner with the new TF parser - gitlab: fixing include scope that predominant all others - general: fix small typo - graph: Fix an issue in and connection solver - secrets: add option to get and set the secret store - graph: Ignore SyntaxWarning in variable rendering - general: add flag to skip cert verification - secrets: Override secrets validation flag with tenant config - terraform: AWS Ensure cloudfront has a default root - terraform: AWS ensure secret rotation is less than 90 days - terraform: AWS Secrets are rotated - terraform: ensure DB snapshots arent public - terraform: ensure SSM docs are private - terraform: lambda permission is not public - general: Custom policies integration correct check IDs filtering - sca: return empty result when using BC API key in IDE - terraform: add extra handling around private GitHub Terraform modules - ansible: Ansible panos security policy checks - terraform: s3 bucket has event notifications - terraform: s3 ensure failed uploads are deleted id=300!!!! - gitlab: indexoutof_range - terraform: Revert "feat(terraform): support provider blocks yaml policy checks ( - sca: filter twistcli results with empty package name and version - terraform: Support new TFParser in the local graph (under env var) - terraform: support provider blocks yaml policy checks - sca: fix unexpected maven packageName - cycloneDX - sca: skipping finding IsPrivateFixVersion by default - sca: support inline CVE suppression in requirements.txt - secrets: allow scanning just partial history of commits - terraform: Refactor Module mapping objects - terraform: s3 to have lifecycle policy - secrets: fix git history partial scan - secrets: support git history scan in multiline parsers - terraform: Definitions serialization with new definitions key/module objects - terraform: support variable rendering for default objects in vars - arm: Fix resource type check in SQLServerAuditingRetention90Days - general: check suppression id instead of policy id - gitlab: Modify GitLab CI resource ids - terraform: Fix for foreach subgraph rendering - terraform: new checks on new resources - general: skip uploading repo for VSCode source - general: add Terraform JSON support - terraform: Adding yaml based build time policies for corresponding PC runtime policies - arm: ignore incomplete resource in ARM templates - terraform: stop handle resource `for_each` as dynamic attribute - terraform: v2 settings valid for windows and linux web apps - ansible: add Ansible check for CKVPAN4 for PAN-OS DSRI - dockerfile: Add tdnf support for CKV2DOCKER9 - terraform: Check added for AWS Database instance deletion protection - terraform: CloudtrailEventDataStoreUsesCMK - bicep: handle malformed files in bicep parser - cloudformation: KMSKeyWildCardPrincipal modification - Check for wildcards inside of lists - terraform: in sg rules ignore self referencing - gitlab: fix wrong resource in gitlab-ci - terraform: Support the -1 protocol on SG checks - terraform: TF Parser support of new modules keys - bicep: extend CKVAZURE4 to consider omsAgent to be written in camelCase - general: refactor SARIF output - general: skip scanning invalid resources - sca: Added an error log for Twistcli failures - terraform: stop evaluating a string ... to the Ellipsis object - general: do not stop getting fixes if one attempt results in a 403 - gha: skip schema validity check if parsing returned None - secrets: Adjust output to include the additional Git History info - ansible: Add checks for the ansible builtin dnf module - dockerfile: Add new dockerfile checks - terraform: Create a new TF parser - secrets: only check secrets framework when scanning history - terraform: AWS - there's a new sg vpc ingress rule - terraform: Azurerm NSG UDP check should work for old style but still valid tf - terraform: Add foreach_attrs in saved graph - terraform: Set foreach_attrs directly under the block - terraform: TF foreach - Support updating

in nested dict - sca: Set prisma token and scan packages by v2 for IDE scans - terraform: fix CKVAWS70 test and add graph for coverage of data source - terraform: TF foreach - Avoid rendering in static statements - ansible: add Ansible policy docs generation - terraform: add not exists conditional to CKV2AWS16 to account for defaults - secrets: track complete file deletion and renaming - terraform: Adding yaml based build time policies for corresponding PC runtime policies - ansible: support skip check for Ansible Python-based checks - terraform: Handle unescaped lookup values - dockerfile: Add check for the environment variable NPMCONFIGSTRICT_SSL - terraform: TF Parser - Move funcs and consts to utils file - terraform_plan: Fix tf plan nested modules - terraform: fix for #4518 - terraform: Move get_module back to parser - terraform: remove dynamic warning exc_info - dockerfile: Add checks for disabling signature checks for apk, apt-get, rpm, yum, dnf - terraform: New classes for the TF module model - gha: Align GHA resource ids (Graph vs Python checks) - arm: add graph capabilities to ARM framework - secrets: add timeout for scan history checks - secrets: Support secret findings in git history - gitlab: fix gitlab ci yaml file processing - sca: adding isregistryurl and printing in the cyclonedx only private registries urls - sca: support also the key "registryUrl" when extracting registry_url for the report - terraform: Optional module content path - cloudformation: Update CKVAWS46 to handle base64 encoded userdata - secrets: add flag for scan secrets history - terraform: Used parentheses in key for foreach attributes but not count - gha: fix output flag for usage in checkov-action - terraform: add datasource option for headers check - terraform: optimize check CKV2AWS60 - general: Use new enforcement categories (#4456) - ansible: Add checks for the ansible builtin apt module - gha: now looks for GHA on windows - sca: adding registry-url to the cyclonedx output report - secrets: Add capability to iterate over git history - terraform: Adding yaml based build time policies for corresponding PC run time policies - secrets: import git - sca: add registry urls and description to the output report and to the csv report - ansible: skip unsupported Ansible resources - terraform: Fix an str split edge case in function - terraform: fix enforcement rules mapping - secrets: log and filter potential uuid case - terraform: Assign/override main vertices by the first new vertice. - terraform: Support for loops in foreach statements - terraform: Handle KeyError in hadleforloop func - terraform: Handle type error in `handleforloopin_dict` - terraform: skip loading module that calls to the same dir - general: Use new enforcement categories - general: update installation on Alpine docs - graph: Add UT as an example of not-exists for the nested

- secrets: Save secrets line number - terraform: AWS:check global DocDB cluster is encrypted - terraform: check msk nodes are private - terraform: support more json encoded objects as part of terraform resource and fix evaluation of true/false in json - ansible: support nested blocks and empty module values - cloudformation: Updated AWSCKV7 to not require rotation on asymmetric keys - secrets: limit multiline regex detector run - terraform: Add foreach_attrs to config objects + UTs - terraform: GCP: Ensure Basic role are not used at Org/Folder/Project level (CKVGCP115, CKVGCP116, CKVGCP117) - kustomize: fix kustomize file path cli - terraform: Allow different type of value in BaseResourceValueCheck - terraform: deny statements with wildcards are valid - gha: adjust the attribute reference for GitHub Actions graph checks - terraform: enable nested modules by default - general: Create 3d combinations post runner - gha: fix GHA getjobs edge case (string step) - graph: added graph init to igraph db connector - sca: Add support for Dotnet files - terraform: Create new resources for count/foreach resources - terraform: extend CKV2AWS5 to support awsec2spotfleetrequest - general: Correct BigQueryDatasetEncryptedWithCMK name field - kubernetes: Fix empty spec in k8s file - kustomize: Fix kustomize cli file path - secrets: remove CKVSECRET78 from SECRETTYPETO_ID - terraform: change module index separator in full path - cloudformation: support new default s3 encryption - graph: added indices to igraph nodes - secrets: Add args to analyze line is added and is removed for git history scan - secrets: Comment out checkob multiline regex detectors - terraform: Fix updating resource config - secrets: Add secrets custom regex on file - ansible: add support for Ansible blocks - general: Control check failure logging level - graph: add validation for graph checks - kubernetes: support inline skips for Kubernetes graph checks - secrets: remove secrets dependency in generic record - kustomize: remove redundant error in kustomize runner - general: fix graph check link in docs - kustomize: support kustomize v5 - terraform: general: Checks edge-cases fixes in terraform and openapi - general: Skip resources with no 'Type' defined + Checks containing wildcards for resource types leads to crash - terraform: fix getting the module for resource named 'module' - terraform: retire CKVAWS128 in favour of CKVAWS162 - terraform: SQS check was all types of wrong - cloudformation: Don't fail Aurora instances for MultiAZ not being set - general: fix compact json output - sca: Add a --support flag - sca: Add a --support flag --revert - secrets: add workdir info to secrets scanner - secrets: extract new detector_utils file from entropy keyword combinator - general: Remove empty links from GitLab SAST output - gha: add gha permissions lines - sca: add extract nodes igraph - sca: create bom report when extra_resources is not empty - secrets: add support for runnable secrets plugins - terraform: add CKVGCP114 to ensure that Public Access Prevention is enforced on GoogleCloudStorage bucket. - terraform: Add cloudsplaining checks to tf awsiampolicy CKVAWS287-290 - terraform: get static foreach/count values of resources - sca: Add a --support flag - sca: added extra supported package files to findscannablefiles - terraform: add reset edges function to terraform local graph - terraform: Added base class for cloudsplaining iam checks to be integrated between data and resource objects - terraform: Added basic check with test for tf resource with IAM privilege escalation - cloudformation: Skip SAM Global Tags propagation - sca: extend image name validation - terraform: simple check naming fix - sca: ignore package.json file when yarn.lock exists - terraform: GCP check kms policy does not define public access - terraform: GCP check policy isn't public - sca: support BCVULX IDs in GitLab SAST output - azure: fix container latest tag missing results - azure: Add `.*.` in azure checks to check in lists as well - azure: Azure checks fixes - azure: Azure checks fixes - azure: Support string functionapp mintls_version as well - kubernetes: k8s checks fixes - sca: Fix multiple issues related to IR - terraform: Terraform checks fixes - general: Add GitLab SAST output - kubernetes: skip extracting pods for custom resources - sca: require requests

- general: fix env var name to `CKVIGNOREHIDDEN_DIRECTORIES` - general: igraph library support - general: add missing header in --list output - kubernetes: extract pods only for supported resources - sca: catch exceptional error during SCA results polling - terraform: change terraform nested modules path separators - terraform: handle unexpected container definition type - azure: change detect image source - general: add empty azure image check - general: add logs for async license and image retrieval - sca: Support the new --image flag along the --docker-image flag - general: ignore repo_id setting when list flag is set - kubernetes: handle k8s resource with missing required data - secrets: Change s3 path for enriched secrets upload - terraform: handle unexpected container type - general: Update README for supported Python versions - terraform: new app service checks for azurerm - general: In case of a non-JSON response, log the response - terraform_plan: fix in deep analysis - terraform: fix default behaviour of CKVGCP19 - general: add Ansible framework - general: Allow using `--repo-root-for-plan-enrichment` flag in GitHub Actions - secrets: add new sanity test files for base64 entropy detector - terraform: Adding yaml based build time policies for corresponding PC run time policies - sca: fix dependency tree cli print - terraform: fix Exception in image ref - terraform: fix in variable rendering - terraform: Fix policy str in graph checks - general: add Image referencer igraph support - general: Support aiohttp for IR API calls - general: Enable running cloned policies in case the OOTB policy is suppressed - secrets: change default secret validation status to unavailable - terraform: fix error for pushskippedchecks_down with definition that not in the definition context - azure: Add image referencer in azure pipelines - gha: fix yaml parsing of multi files - secrets: fix to keyword combinator to reduce FPs - secrets: add guideline and severity to custom secret check metadata - gha: fix failing image retrieval in GHA IR - cloudformation: fix CloudFormation checks related to number values - general: Add normalization to change the name of nuget to dotNet lang - dockerfile: Add checks for PYTHONHTTPSVERIFY and NODETLSREJECT_UNAUTHORIZED - secrets: Skip invalid secrets checks + soft/hard fails - terraform: Azure search service checks - terraform: GCP checks for definition of a firewall resource for a network - general: Support encoding of function object - kubernetes: handle missing subjects in k8s cluster role binding - kubernetes: handle resources with incompatible selector - secrets: Change secret validation status message - terraform: default value for CKVAZURE5 - terraform: fix getcurrentmodule_index for path that contain .tf in them - general: fix circleci crash when cannot find image - general: fix circleci yaml-doc - kubernetes: set default k8s graph env vars to true - terraform: Add new checks for ensuring execution history logging and Xray for State Machine is enabled - cloudformation: Fix edge-cases in checks - kubernetes: removed env vars from tests - secrets: Change secret validation status message - secrets: Revert "fix(secrets): Change secret validation status message" - terraform: PC-Policy-Team - GCP PostgreSQL Instance Database Policies - secrets: Change verify secrets key to include relative path - terraform: improve cross-variable edges performance - general: Add resource attributes to omit arg - terraform: enable cross variable edges - secrets: add function to add the custom policies to the metadata integration not in the multiprocess - kubernetes: support more types of k8s pod template containers - secrets: Add secret validation status to reduced report - secrets: fix unquoted secret value - terraform_plan: support multiple references in one resource - kubernetes: allow filtering of custom with built-in Kubernetes check IDs - secrets: add long to see metadata_integration - terraform_plan: fix module resources ids - dockerfile: Add checks for unsafe wget and pip usages - secrets: Implement lower entropy threshold on a line with keyword - terraform: add CKV2AWS51 to Ensure AWS Managed IAMFullAccess IAM policy is not

- terraform: CDN and service bus checks for azure - secrets: add logs - secrets: add logs to secrets - secrets: Disable verify secrets if skip_download is specified - secrets: fix relative file path in secrets saved to coordinator - general: fix incorrect billing message when frameworks are removed from --framework list - dockerfile: Add check for unsafe curl usages - general: add logic to vcs scanning to prevent empty repo collabs failing check - terraform: Adding yaml based build time policies for corresponding PC run time policies - general: handle variable dependent values in policy - secrets: Fix api key condition in verify_secrets - secrets: Remove raw string modifier from re.compile - sca: enable CHECKOVRUNSCAPACKAGESCAN_V2 env var - secrets: Call secrets verify API - general: set newer jsonschema dependency bound- solves #2227 - general: Update exclude-patterns.txt - general: fix links in contributing docs - general: Skip check in json file - gha: add support for gha existing graph - secrets: change secretsCoordinator to dict format - terraform: added awsssoadminmanagedpolicyattachment resource to CKVAWS274 - general: add link to BaseGraphRegistry checks - general: change CODELINKBASE from master to main - kubernetes: remove unneeded context check - kustomize: fixed kustomize absfilepath - terraform: out of range error by checking if list is empty - sca: remove report_results from checkov, as it is not used at all - general: fix f-string log message - general: fix reference link in Contributing docs page - general: Make code blocks for json check results focused on the relevant part - openapi: Add v2 openAPI new checks - terraform: new azure storage checks - github: Handle entity configurations of type list - sca: Fix extra space in output of dependencies - azure: Add check - azure keyvalut public network access - terraform: fix edge-case in CKVAZURE183 check - terraform: fix graph checks nested modules - terraform: fix or connection graph checks nested modules - kubernetes: Support graph edges for nested (related) Pod resources. - secrets: Keep original secrets data in runtime for further validation - secrets: Keep original secrets data in runtime for further validation - general: fix excluded paths for path with special characters - terraform: add test path to exclude-patterns - terraform: fix edge-case in CKVAZURE37 check - terraform: fix getting graph entity config in terraform runner - terraform: remove redundant nested definitions - secrets: add support to conditionQuery - terraform: fix edge-case in CKVAZURE183 check - gha: support on directive in workflow files - sca: run old package scanning for IDE scan - secrets: expose maximum 6 characters of secret values - circleci: add resource to ir - general: Reformat PR template - kubernetes: move Kubernetes context error message - terraform: add awstransferserver to CKV2AWS5 check - terraform: Add some more supported keys to bigquery public acl check ignore list to avoid false positive - terraform: fix azure network address invalid value - general: add the stack trace to the error message when caught by

- sca: add GCP Terraform resources for Image Referencer - sca: protecting checkov with try/catch wrapping - kubernetes: removed obsolete error logging - terraform: fix azure dns invalid ip - general: move the jsonpath try/catch up a level to catch more errors - sca: returning exit code 2 in case of error for downloading twistcli - dockerfile: adjust the file abs path for Dockerfile graph results - openapi: fix an open API CKVOPENAPI6 check - sca: fixing integration tests - terraform_plan: use abs path for reporootforplanenrichment - terraform: CKV2AZURE21 changed blob access type to private - terraform: fix support for getting module-referenced resources context - terraform: add previous gettfdefinition_key function - general: Use --no-fail-on-crash to gracefully exit commitrepository and setupbridgecrew_credentials - terraform_plan: add check details to TF plan scan results - terraform: new azurerm checks - App config - terraform: Omit values from graph checks - general: change env var name for no-fail-on-crash flag - github: Fix GHA IR resource names in case of 2 identical images - terraform: azurerm storage defaults - fix for storage case #3516 - terraform: fix nested module resources ids in the report - general: Add no-fail-on-crash flag - gha: add fix for gha graphs and UT - kubernetes: inject k8s FF flags to instance instead of constructor - terraform: add a method for get the entity definition path from the entity itself - terraform: add address attribute to all scanned terraform blocks - kubernetes: Add kubernetes YAML checks to checkov packaging - kubernetes: move whorf to dedicated repo - terraform_plan: add Image Referencer for Terraform plan files - terraform: add CKV NCP rules about AutoScalingGroup, Load Balancer - terraform: add CKV NCP rules about Nat Gateways and Route - terraform: combine tf plan and tf graphs for nested modules - terraform: More azurerm checks for terraform - openapi: Fix in PathSchemeDefineHTTP opeAPI check - terraform: CKVAZURE43 add new test case - github: more CIS checks- part3 - terraform: Adding yaml based build time policies for corresponding PC run time policies - secrets: fix secrets crash when secret is non string - github: more CIS checks- part2 - kubernetes: added CKV2K8SEXAMPLE_1 only in tests as an example for k8s graph check for pod which is publicly accessible - kubernetes: added deployment name to pod resource id - sca: fix root packages fixed version - sca: invoke packaging.Version instead of parse - secrets: fix error when secret is None - terraform: checkov fix as resource container_group modified - terraform: fixed unexpected data for IAMPublicActionsPolicy - terraform: fixed unexpected data for MonitorLogProfileRetentionDays - general: Apply licensing from platform - gha: Add gha graph infra - gha: add infra for gha graphs - sca: fixed dependencies default value - sca: added indirect cves fix versions - secrets: Inject secrets omitter to runner registry - terraform_plan: support jsonpath queries in AWS IAM policy strings for Terraform plan - terraform: Extend secret attributes to omit mapping - terraform: tf plan combine graphs pass params - terraform: add missing resource awsroute53resolver_endpoint #3968 - terraform: fix getting local dest module path - terraform: Fix some errors in Dynamic Blocks rendering - graph: Added `not_within` attribute solver for graph checks - kubernetes: Add CKV2K8S2 graph check for potential privilege escalation in `nodes/proxy` or `pods/exec` with `create` permissions - kubernetes: Add CKV2K8S3 no `impersonate` permissions for `ServiceAccount/Node` - kubernetes: Added CKV2K8S4 check to not allow modifying of services/status - kubernetes: Added CKV2K8S5 check that no service account or node can read all secrets - secrets: Accepting json reports from bucket in secrets_omitter - terraform: add CKV NCP rules about Route Table Association - kubernetes: Corrected list format for yaml files in new k8s graph check tests - secrets: custom secret add support for value str and not only list - terraform: Fix in dot separator in the dynamic argument - general: Apply policy-level suppressions as skipped checks - github: Add 3 CIS checks: 1.1.3, 1.1.8,

- kubernetes: Added CKV2K8S1 to ensure RoleBinding do not allow privilege escalation to a ServiceAccount/Node - secrets: Omit secrets from reports based on secrets reports - secrets: Omit secrets from reports based on secrets reports - github: remove secrets from schema example - terraform: fix resource block address - sca: change sca packages output to include dependencies structure - secrets: Adding check length for secret - terraform: nested modules support in graph - circleci: fix executors in resource_id - secrets: Bump detect secrets version - terraform: Fix an issue in dynamic blocks - terraform: fix CKVAWS283 check - terraform: Fix CKVAZURE168 check - terraform: Fix some issues in dynamic blocks flow - terraform: Fix TF checks crashes - general: Report failed attempts at reporting contributor metrics - kubernetes: create simple resources id for pods; allow enabling k8s graph features using env vars - terraform: check for insecure protocols - terraform: Check resource-based policies for public access - terraform: Dynamic Blocks support for loop in for_each attribute - terraform: new aks checks for Azure - dockerfile: fix Dockerfile inline skip handling - secrets: fixRecordcodeblocksecrets - terraform: azurerm kusto cluster encryption - wrong attribute tested for - terraform: add CKV NCP rules about ncloud access control group rule - secrets: fix Issue with 'NoneType' error in the custom detectors load_detectors - terraform: remove redundant exc_info for module without source - dockerfile: add graph to Dockerfile - terraform: add CKV NCP rules about access control group Inbound rule. - terraform: Implement relative file path standard for tf plan file runs - general: fix doc links on windows - secrets: Fix omitting of secrets that are json encoded - terraform_plan: Fix k8s checks edgecases for terraform plan - terraform: OCI Security Group Control Problem - secrets: remove the use of enablesecretscanallfiles for custom secrets - terraform: update Terraform modules docs - no noteworthy changes terraform: add CKV NCP rules about Load Balancer Listener Using HTTPS - terraform: add CKV NCP rules about server instance and public IP - terraform: azurerm ACR check for retention policy - github: add CIS checks part 1. Most of the 1.1.x - terraform: Azure ACR Enable Image Quarantine - terraform: Azure use signed image in ACR - bicep: ignore unresolvable properties for Bicep storage account checks - gha: added test for step with no step name - no noteworthy changes circleci: add check for detecting images without check resource - terraform: ACR container scanning - terraform: add CKV NCP check about NKS(kubernetes) logging - terraform: Adding yaml based build time policies for corresponding PC run time policies - general: update checks_metadata structure - gha: and circleci resource names - kubernetes: Handle invalid helm chart meta - sca: fix related resource id for helm and kustomize - terraform: better check names to avoid confusion -

#3912 - terraform: CKVAZURE144 passes on defaults - terraform: Removed duplicate check CKVAZURE60 - secrets: Support custom detectors from the platform - terraform: add CKVAWS282 to ensure that Redshift Serverless namespace is encrypted by KMS - terraform: Remove cross variables edges duplications - general: sign and push checkov image to GitHub registry - secrets: Add Terraform multiline secrets handling - terraform: ensure snapshots use encryption - terraform: support cross-modules edges - terraform: add nested module address attribute - general: add output format cyclonedx_json - general: add source to contributor metrics report - terraform: Fix an edge case in AbsRDSParameter check - github: add output-file-path flag to checkov-action - terraform: Dynamic blocks - added support for lookup null/true/false values - sca: added dependency tree format - terraform: add CKV NCP rules about NKSPublicAccess - terraform: Censor secrets from tfplan graph - terraform: create cross-variable edges between resources from the same module - general: remove filter value validation - terraform: Fix dynamic blocks nested module - terraform: handle empty enabledclusterlog_types list - sca: add scaCliScanId parameter - terraform: test checks for any port access - terraform: Fixing some broke flow in dynamic blocks rendering - terraform: Not adding dynamic blocks attributes to attributes - general: Support s3 client config for govcloud - sca: Add repoId to GET request - sca: Fix bom report - sca: Poll sca scan results using Polling API - sca: remove src from repo path - general: number of words larger/less than or equal operators - general: remove env var for running contributor metrics report and add logs - terraform: add CKV NCP rules about Load Balancer Exposed to Internet - terraform: Mask secret values in Terraform plan file reports by resource - terraform: Support dynamic blocks with nested attributes - general: Fixed operator name for numberofwords_derivaties - terraform: Fix dynamic attributes override each other - general: add reporting contributor metrics - terraform: add CKV NCP rules about access key hard coding - terraform: NSGRulePortAccessRestricted - Remove the condition for dynamic blocks - kubernetes: handle empty spec object in k8s templates - openapi: fixed error in invalid openapi template - terraform: app_service Upgrade tests and add web app resources - terraform: Handled nested unrendered vars - terraform: fix an issue with dynamics replacing a whole block - terraform: Wrap render dynamic blocks flow with try except - bicep: make ARM AKS checks compatible with Bicep - cloudformation: only parse valid tag key-pairs in CloudFormation - general: Clear details before next check run to avoid duplications in output - secrets: add abstract multiline parser + implement multiline json parser - terraform: Support for nested dynamic modules - kubernetes: fixed unexpected list object - general: Added Number of Words operator - terraform: add CKV NCP rules about LBTargetGroupUsingHTTPS - terraform: add CKV NCP rules about NASEncrytionEnabled - terraform: Add Env Var for rendering Dynamic Blocks - terraform: Dynamic blocks breadcrumbs support - terraform: PC Policy Team Yaml Policies Check-in - terraform: PC-Policy-Team: Ensure GCP compute firewall ingress does not allow unrestricted access to all ports - sca: Run package scan using API - azure: Add get resource names for azure_pipelines - github: add graph to GitHub Actions - terraform: add CKV NCP rules about LBListenerUsesSecureProtocols - terraform: Dynamic Modules Support map type - terraform: include pods of kubernetesdeployment in kubernetespod checks (1/4) - terraform: include pods of kubernetesdeployment in kubernetespod checks (2/4) - terraform: include pods of kubernetesdeployment in kubernetespod checks (3/4) - terraform: include pods of kubernetesdeployment in kubernetespod checks (4/4) - arm: CKVAZURE9 & CKVAZURE10 - Scan fails if protocol value is a wildcard - azure: Remove redundant file path from resource name in azure pipelines - secrets: fix slow secrets scan in yaml files - secrets: fixed path of secrets tests to exclude - terraform: fix gke resource name not string - general: rationalize policy metadata error handling behavior - sca: add new sca package scan - sca: Extract checkov check links - kubernetes: Create keyword and network policy edge builders - general: add range_includes and inverted operator - secrets: Add multiline detection to entropy keyword combinator - terraform: render list entries via modules correctly - terraform: Add CKVAWS276 to ensure that API Gateway Method Settings datatraceenabled is not set to True - terraform: Fix `relatedresourceid` for ImageReferencer in `external_module` - general: Fix typo in docs - github: split repo and org webhooks to separate files - gitlab: Adding image detection check to gitlab ci - openapi: pre-validate OpenAPI JSON files - azure: Support

extension - github: print the result again in GHA - terraform: reduce parsing time for large TF plan files - terraform: add CKV2AWS40 to Ensure AWS IAM policy does not allow full IAM privileges - general: Get resources from platform and filter taggable resources for policies - graph: add support for modules in graph checks - terraform: add CKV NCP rules about Network ACL. - terraform: TF Dynamic Blocks support - `for_each` lists type - terraform: fix a TF plan issue with CKVAWS274 - terraform: fix false positive for write ACL yaml check - general: Update Jenkins page to use Checkov image - github: Change githubfailedonly output suffix to .md - terraform: adjust the check result return for dependant variables to unknown in Python based checks - terraform: return UNKNOWN for unrendered values in graph checks - terraform: add CKV NCP rule about block storage encryption. - terraform: add CKV NCP rule about vpc volume encryption. - terraform: add CKV NCP rules about Network ACL. - terraform: Create checks for aws managed admin policy - terraform: localauthenticationdisabled - cosmodb check to look at SQL Api only CKVAZURE140 - kubernetes: Create label selector edge builder - terraform: add CKV NCP rules about access control group Inbound rule. - terraform: add versioned kubernetes resources to terraform kubernetes checks (5/5) - general: skip scanning VCS configuration if only files are passed in - circleci: CircleCI Image Reference using Mixin class - kubernetes: fix in CPURequests check - github: fix GITHUBOUTPUT and GITHUBENV issues of checkov-action - gitlab: Modify gitlab ci resource id - graph: equals/notequalsignore_case operators (solvers) - github: Fix GHA off value error resulting in checkov hanging - gitlab: vcs gitlab groups retrieval - kubernetes: fix in ServiceAccountTokens check - terraform: Add debug logs to yaml parsing logic - general: Custom Policies integration must run before Suppresion integration - terraform: Add or condition for TLS 1.3 policy, supporting CKVAWS103 - terraform: Fix TF AbsGoogleComputeFirewallUnrestrictedIngress check - terraform: add CKV NCP rules about access control group outbound

- terraform: add versioned kubernetes resources to terraform kubernetes checks (2/5) - terraform: add versioned kubernetes resources to terraform kubernetes checks (3/5) - terraform: add versioned kubernetes resources to terraform kubernetes checks (4/5) - cloudformation: Fix ALBListenerTLS12 check - helm: undo fileabspath manipulation for helm files - kubernetes: Couple of fixes in Checks - terraform: Fix CloudArmorWAFACLCVE202144228 check - kustomize: stop kustomize run, if there is nothing to process - sca: Enable multiple image referencer framework results in the same scan - terraform: add versioned kubernetes resources to terraform kubernetes checks (1/5) - general: Fix broken links - terraform: Outdated check for googlecontainercluster binary authorization - terraform: Added new Terraform-AWS python IAMUserNotUsedForAccess(CKVAWS273) policy - argo: only scan Argo Workflows files - kubernetes: minor fix for getting entity type from template - kustomize: add --client=true to kubectl version command, to prevent checkov waiting for timeout if cluster is unreachable - terraform: update CKVAWS213 to also cover AWS predefined security policies - general: add Azure Pipelines framework - dockerfile: handle quoted absolute path in CKVDOCKER10 - kubernetes: handled missing field secretKeyRef in template - kubernetes: handled missing key in k8s templates - terraform: extend CKV2AWS15 to support awslbtarget_group - terraform: handle unexpected value for enabledcloudwatchlogs_exports - dockerfile: add Image Referencer for Dockerfile - cloudformation: Fixed unexpected null properties for LaunchConfigurationEBSEncryption - general: allow file destination mapping via output-file-path flag - github: GHA Image Referencer using IR Mixin class - graph: add support for guideline field to custom graph checks - sca: Add root path references to shorten file paths in Image Referencer results - sca: support Image referencer in CLI - github: bug fixes in CKVGITHUB6, CKVGITHUB7, CKVGITHUB9 - github: Fix resource id and file path for GHA IR - terraform: extend check for google cloud functions 2nd generation - terraform: fix port is bool ingress rule - general: added cli argument for extra resources in report - serverless: added extra resources for serverless and dockerfile - terraform: add CKVNCP1 about lb target group health check, CKVNCP2 about access control group description - cloudformation: fix lc ebs encryption - github: changed the schema to accept no description for org - secrets: Skip secrets from files encoded with special codecs - general: switch from black-list to block-list - kubernetes: added resources mappings for roles objects - github: fix variables initialization - kubernetes: Handle templates without name for PeerClientCertAuthTrue check - openapi: fix openapi schema bug - sca: fix CycloneDX output for Docker images - secrets: change entropy limit in Combinator plugin - terraform: fix external modules ids in graph report - terraform: Handle malformed database_flags for GCP DB checks - general: Add enforcement rules to entrypoint.sh - openapi: add CKVOPENAPI7 to ensure http is not used in path definition - sca: add Image Referencer for Kubernetes, Helm and Kustomize - terraform: add CKVAWS272 to validate Lambda function code-signing - terraform: add new gcp postgresql checks - terraform: allow resources without values in TF plan - kubernetes: general: use current branch name instead of master for the checkov-action - general: Multi skip docs - gitlab: GitlabCI ImageReferencer - secrets: Bump bc-detect-secrets - terraform: fix check CKV2AZURE8 - general: Fix TOC rendering issue on checkov.io - general: Improve ComplexSolver run time - kubernetes: create complex k8s vertices - general: only add `helpUri` to SARIF if it is non-empty - kubernetes: kubernetes: cloudformation: add CKVAWS197 for CFN - sca: Split `PRESENTCACHEDRESULTS` env var to 2 feature flag like vars - general: handle fixes for cloned OOTB policies - helm: fix helm signal abort handler - terraform: APIGatewayAuthorization check missing authorization - terraform: fix tfvars rendering -