Checkov
Static analysis for infrastructure as code. Scan Terraform, CloudFormation, Kubernetes, and Dockerfiles for misconfigurations.
45 commands
Browse by Topic
Install Checkov
Install Checkov infrastructure-as-code scanner using pip
Check Checkov version
Verify Checkov is installed and display the current version
Scan current directory
Run Checkov to scan all supported IaC files in the current directory
Scan directory
Scan current directory.
Scan specific file
Scan specific file.
Scan Terraform
Scan Terraform files only.
Scan Kubernetes
Scan Kubernetes manifests.
Scan Dockerfile
Scan Dockerfile.
Scan Helm chart
Scan Helm charts.
Scan CloudFormation
Scan CloudFormation templates.
Scan ARM templates
Scan Azure ARM templates.
Scan GitHub Actions
Scan GitHub Actions workflows.
Scan multiple frameworks
Scan with multiple frameworks.
Scan with repo ID
Tag results with repository ID.
Scan from Docker
Run Checkov scan via Docker.
Scan Serverless framework
Scan Serverless Framework config.
List checks
List all available checks.
Skip specific check
Skip a specific check.
Run specific checks
Run only specific checks.
Skip via comment
Skip check via inline comment.
Filter by severity
Run checks at specific severity levels.
Check by framework prefix
Run only Kubernetes-prefixed checks.
Skip entire framework
Skip all checks for a framework.
Run external checks
Run all external and custom checks.
Create baseline
Create baseline of current findings.
Scan with baseline
Skip findings already in baseline.
JSON output
Output results as JSON.
SARIF output
Output in SARIF format.
JUnit XML
Output as JUnit XML.
Compact output
Show compact output.
Soft fail
Exit 0 even with failures.
Output to file
Write output to a directory.
CSV output
Output results as CSV.
Multiple outputs
Output to console and JSON file.
Prisma Cloud integration
Send results to Prisma Cloud.
Hard fail on severity
Fail only on critical/high findings.
Soft fail on severity
Soft fail on low/medium findings.
External checks
Use custom policy directory.
YAML policy
Example YAML custom policy.
External Git checks
Load policies from Git repo.
Python custom check
Python-based custom check class.
Composite YAML policy
Composite policy with AND logic.
Connection policy
Check resource connections.
Pre-commit hook config
Add Checkov as pre-commit hook.
GitHub Actions integration
Run Checkov in GitHub Actions.
Discussion
Loading comments...