Checkov

Checkov is an open source tool that checks infrastructure as code for misconfigurations before it is deployed. It was built by Bridgecrew and is released under the Apache-2.0 license.

Checkov reads your infrastructure definitions and checks them against a library of policies. It uses one command line interface across several formats, so one tool can cover a large part of a stack. Policies can be written as Python code, and graph-based checks look at how resources connect to each other.

• Scans Terraform, CloudFormation, Kubernetes and Helm
• Covers ARM templates, Serverless and AWS CDK
• Attribute-based and graph-based policy checks
• Write custom checks in Python
• Fits into developer workflows and CI pipelines

Checkov suits DevOps and platform engineers who write Terraform or similar templates and want checks in the build. Teams that do not use infrastructure as code will not get much from it.

Checkov is licensed under Apache-2.0, so the core tool is free to use and modify. The project's site links to a developer guide for contributing new checks and to a Slack community for questions. Check the license text for the full terms before you embed the tool in a commercial product.