Checkov

Checks Commands

List, skip, and customize security checks with built-in and custom policies.

10 commands

Pro Tips

Use --skip-check for known false positives

Commands

List checks

$ checkov --list

List all available checks.

Skip specific check

$ checkov -d . --skip-check CKV_AWS_1

Skip a specific check.

Run specific checks

$ checkov -d . --check CKV_AWS_1,CKV_AWS_2

Run only specific checks.

Skip via comment

$ # checkov:skip=CKV_AWS_1:Reason for skipping

Skip check via inline comment.

Filter by severity

$ checkov -d . --check MEDIUM --check HIGH --check CRITICAL

Run checks at specific severity levels.

Check by framework prefix

$ checkov -d . --check CKV_K8S

Run only Kubernetes-prefixed checks.

Skip entire framework

$ checkov -d . --skip-framework dockerfile

Skip all checks for a framework.

Run external checks

$ checkov -d . --run-all-external-checks

Run all external and custom checks.

Create baseline

$ checkov -d . --create-baseline

Create baseline of current findings.

Scan with baseline

$ checkov -d . --baseline .checkov.baseline

Skip findings already in baseline.