CheckOps home

Tools directory

C

CheckOps

Checkov

Checkov is an Apache-2.0 static analysis tool for infrastructure as code (Terraform, CloudFormation, Kubernetes, Helm, Dockerfile and more) that also does SCA for images and open-source packages.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

Checkov is a static code analysis tool for infrastructure as code (IaC) and a software composition analysis (SCA) tool for images and open-source packages. It lives at bridgecrewio/checkov under Apache-2.0 with about 9,100 GitHub stars.

According to the README it scans infrastructure provisioned with Terraform, Terraform plan, CloudFormation, AWS SAM, Kubernetes, Helm charts, Kustomize, Dockerfile, Serverless, Bicep, OpenAPI, ARM templates and OpenTofu, among others.

Checkov uses graph-based scanning so a policy can reason about relationships between resources, not just single blocks of configuration. Policies can be written in Python or YAML.

In the quality loop, Checkov is a shift-left gate: run it in pre-commit and CI so misconfigured buckets, open security groups or privileged containers are caught before they reach a cloud account.

Features

  1. Broad IaC coverage: Terraform, CloudFormation, Kubernetes, Helm, Kustomize, Dockerfile, Serverless, Bicep, ARM and more.
  2. Built-in policies: A large library of policies covering common cloud misconfigurations.
  3. Graph-based checks: Policies that understand connections between resources.
  4. Custom policies: Write checks in Python or YAML.
  5. SCA: Scans open-source packages and images for known vulnerabilities.
  6. Secrets scanning: Detects secrets in IaC files.
  7. Output formats: CLI, JSON, JUnit XML, SARIF and more for CI tools.
  8. Suppressions: Inline skip comments with reasons for accepted risks.

Pros

  1. Wide coverage: One tool across many IaC formats.
  2. Free: Apache-2.0.
  3. CI friendly: SARIF and JUnit outputs.
  4. Extensible: Custom policies for your standards.
  5. Active: Commits in November 2026.

Cons

  1. Noise at first: Many findings on existing code; needs a baseline.
  2. Policy tuning: Some defaults may not fit your environment.
  3. Python install: Needs a Python environment or the container image.
  4. Static only: It cannot see drift in live cloud accounts; use Prowler for that.
  5. Commercial upsell: Some advanced features are in the commercial platform.

Install and scan a directory:

pip install checkov
checkov -d ./infra

Scan a Terraform plan and output SARIF:

terraform show -json tfplan > tfplan.json
checkov -f tfplan.json -o sarif

Tips: create a baseline (--create-baseline) for legacy code so only new issues fail the build, and require a reason on every inline suppression.

Resources:

Pricing

Checkov is free and open source under Apache-2.0.

  1. Platform and cloud teams reviewing Terraform and Kubernetes changes.
  2. DevSecOps adding IaC gates in CI.
  3. Organisations writing custom cloud guardrails.
  4. Not a fit for runtime cloud posture on its own.

Conclusion

Checkov is a mature, broad IaC scanner with graph-based policies and good CI outputs.

Baseline existing findings, tune policies, and pair it with runtime posture tools.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with Checkov side by side.