Checkov - Prevent Cloud Misconfigurations During Build-Time For Terraform, CloudFormation, Kubernetes, Serverless Framework And Other Infrastructure-As-Code-Languages

Checkov is a static code analysis tool for infrastructure-as-code.

It scans cloud infrastructure provisioned using Terraform, Terraform plan, Cloudformation, AWS SAM, Kubernetes, Dockerfile, Serverless or ARM Templates and detects securi ty and compliance misconfigurations using graph-based scanning.

Checkov also powers Bridgecrew, the developer-first platform that codifies and streamlines cloud security throughout the development lifecycle. Bridgecrew identifies, fixes, and prevents misconfigurations in cloud resources and infrastructure-as-code files.

Features

Over 1000 built-in policies cover security and compliance best practices for AWS, Azure and Google Cloud. Scans Terraform, Terraform Plan, CloudFormation, AWS SAM, Kubernetes, Dockerfile, Serverless framework and ARM template files. Supports Context-awareness policies based on in-memory graph-based scanning. Supports Python format for attribute policies and YAML format for both attribute and composite policies. Detects AWS credentials in EC2 Userdata, Lambda environment variables and Terraform providers. Identifies secrets using regular expressions, keywords, and entropy based detection. Evaluates Terraform Provider settings to regulate the creation, management, and updates of IaaS, PaaS or SaaS managed through Terraform. Policies support evaluation of variables to their optional default value. Supports in-line suppression of accepted risks or false-positives to reduce recurring scan failures. Also supports global skip from using CLI. Output currently available as CLI, CycloneDX, JSON, JUnit XML and github markdown and link to remediation guides.

Screenshots

Scheduled scan result in Jenkins

Getting started

Requirements

Python >= 3.7 (Data classes are available for Python 3.7+) Terraform >= 0.12

Installation

Installation on Alpine:

Installation on Ubuntu 18.04 LTS:

Ubuntu 18.04 ships with Python 3.6. Install python 3.7 (from ppa repository)

or using homebrew (MacOS only)

or

Enabling bash autocomplete

Upgrade

if you installed checkov with pip3

Configure an input folder or file

Or a specific file or files

Or

Or a terraform plan file in json format

Note: terraform show output file tf.json will be a single line. For that reason all findings will be reported line number 0 by checkov

If you have installed jq you can convert json file into multiple lines with the following command:

Scan result would be much user friendly.

Alternatively, specify the repo root of the hcl files used to generate the plan file, using the --repo-root-for-plan-enrichment flag, to enrich the output with the appropriate file path, line numbers, and codeblock of the resource(s). An added benefit is that check suppressions will be handled accordingly.

Scan result sample (CLI)

Start using Checkov by reading the Getting Started page.

Using Docker

Note: if you are using Python 3.6(Default version in Ubuntu 18.04) checkov will not work and it will fail with ModuleNotFoundError: No module named 'dataclasses' error message. In this case, you can use the docker version instead.

Note that there are certain cases where redirecting docker run --tty output to a file - for example, if you want to save the Checkov JUnit output to a file - will cause extra control characters to be printed. This can break file parsing. If you encounter this, remove the --tty flag.

Running or skipping checks

Using command line flags you can specify to run only named checks (allow list) or run all checks except those listed (deny list).

List available checks:

Allow only 2 checks to run:

Run all checks except 1 specified:

Run all checks except checks with specified patterns:

For Kubernetes workloads, you can also use allow/deny namespaces. For example, do not report any results for the kube-system namespace:

Suppressing/Ignoring a check

Like any static-analysis tool it is limited by its analysis scope. For example, if a resource is managed manually, or using subsequent configuration management tooling, suppression can be inserted as a simple code annotation.

Suppression comment format

To skip a check on a given Terraform definition block or CloudFormation resource, apply the following comment pattern inside it's scope:

checkov:skip=<check_id>:<suppression_comment>

<check_id> is one of the [available check scanners](docs/5.Policy Index/all.md) <suppression_comment> is an optional suppression reason to be included in the output

Example

The following comment skips the CKV_AWS_20 check on the resource identified by foo-bucket, where the scan checks if an AWS S3 bucket is private. In the example, the bucket is configured with public read access; Adding the suppress comment would skip the appropriate check instead of the check to fail.

The output would now contain a SKIPPED check result entry:

To skip multiple checks, add each as a new line.

To suppress checks in Kubernetes manifests, annotations are used with the following format: checkov.io/skip#: <check_id>=<suppression_comment>

For example:

Logging

For detailed logging to stdout set up the environment variable LOG_LEVEL to DEBUG.

Default is LOG_LEVEL=WARNING.

Skipping directories

To skip files or directories, use the argument --skip-path, which can be specified multiple times. This argument accepts regular expressions for paths relative to the current working directory. You can use it to skip entire directories and / or specific files.

By default, all directories named node_modules, .terraform, and .serverless will be skipped, in addition to any files or directories beginning with .. To cancel skipping directories beginning with . override IGNORE_HIDDEN_DIRECTORY_ENV environment variable export IGNORE_HIDDEN_DIRECTORY_ENV=false

You can override the default set of directories to skip by setting the environment variable CKV_IGNORED_DIRECTORIES. Note that if you want to preserve this list and add to it, you must include these values. For example, CKV_IGNORED_DIRECTORIES=mynewdir will skip only that directory, but not the others mentioned above. This variable is legacy functionality; we recommend using the --skip-file flag.

VSCODE Extension

If you want to use checkov's within vscode, give a try to the vscode extension available at vscode

Configuration using a config file

Checkov can be configured using a YAML configuration file. By default, checkov looks for a .checkov.yaml or .checkov.yml file in the following places in order of precedence:

Directory against which checkov is run. (--directory) Current working directory where checkov is called. User's home directory.

Attention: it is a best practice for checkov configuration file to be loaded from a trusted source composed by a verified identity, so that scanned files, check ids and loaded custom checks are as desired.

Users can also pass in the path to a config file via the command line. In this case, the other config files will be ignored. For example:

Users can also create a config file using the --create-config command, which takes the current command line args and writes them out to a given path. For example:

Will create a config.yaml file which looks like this:

Users can also use the --show-config flag to view all the args and settings and where they came from i.e. commandline, config file, environment variable or default. For example:

Will display:

Contributing

Contribution is welcomed!

Start by reviewing the contribution guidelines. After that, take a look at a good first issue.

Looking to contribute new checks? Learn how to write a new check (AKA policy) here.

Disclaimer

checkov does not save, publish or share with anyone any identifiable customer information.
No identifiable customer information is used to query Bridgecrew's publicly accessible guides. checkov uses Bridgecrew's API to enrich the results with links to remediation guides. To skip this API call use the flag --no-guide.

Support

Bridgecrew builds and maintains Checkov to make policy-as-code simple and accessible.

Start with our Documentation for quick tutorials and examples.

If you need direct support you can contact us at [email protected].