Checkov — Infrastructure as Code Security Scanner

Overview

Checkov (by Prisma Cloud / Bridgecrew, current release 3.3.x) parses IaC files and Terraform plans and evaluates them against 1,000+ built-in policies, with ids like CKV_AWS_18 or CKV_K8S_14. It needs no cloud account and no API key; results stay local unless you pass a Prisma/Bridgecrew key. Exit code is 1 when any check fails, which is what makes it a CI gate.

Instructions

Install and scan

brew install checkov                 # or: pipx install checkov  /  pip install checkov
docker run --rm -v "$(pwd)":/tf bridgecrew/checkov -d /tf   # no local Python needed