checkov

What it is and what it does

Checkov is a static analysis and software composition analysis (SCA) tool designed to catch security and compliance misconfigurations in infrastructure-as-code before deployment. It scans Terraform, CloudFormation, Kubernetes manifests, Dockerfiles, Helm charts, and several other IaC formats using graph-based analysis to understand context and relationships between resources. The tool also performs SCA scanning to detect known vulnerabilities (CVEs) in container images and open-source packages.

You run it as a command-line tool pointing to a directory or file, and it reports failures and passes against built-in policies covering AWS, Azure, and Google Cloud security best practices. Results can be output in multiple formats (CLI, JSON, JUnit XML, SARIF, CycloneDX) for integration into CI/CD pipelines or security dashboards. It supports policy suppression, variable evaluation, and secret detection using regex and entropy analysis.

Use it for:

• Scan Terraform configurations in CI/CD to block deployments with security misconfigurations before they reach cloud infrastructure.
• Validate Kubernetes manifests and Helm charts for compliance with security policies (e.g., pod security standards, RBAC rules).
• Detect hardcoded AWS credentials and secrets in infrastructure code and Lambda environment variables.
• Perform SCA scanning of container images and open-source dependencies to identify known CVEs.
• Generate compliance reports (SARIF, JUnit XML, CycloneDX) for security audits and regulatory requirements.
• Enforce organization-specific policies using custom YAML or Python policy definitions across all IaC files.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Checkov is a static code analysis tool that scans infrastructure-as-code files (Terraform, CloudFormation, Kubernetes, Dockerfile, and others) and container images to detect security misconfigurations and software vulnerabilities.

Yes. Checkov is actively maintained, widely adopted (top 5000 PyPI packages), has no known vulnerabilities, and low install friction. It is essential for teams managing infrastructure-as-code who want to catch security and compliance issues early. The permissive Apache 2.0 license and broad IaC format support make it suitable for most environments. Install it if you use Terraform, CloudFormation, Kubernetes, or Dockerfile in your infrastructure pipeline.

Install

checkov on PyPI

pip install checkov

uv add checkov

poetry add checkov

Installing checkov

Before you install

Low install friction with a pure-wheel distribution. Actively maintained with a release just 1 day old and 8936 repository stars. Requires Python 3.9–3.12; some environments (e.g., Debian 12) may need a virtual environment for installation.

License in practice

Licensed under Apache License 2.0 (permissive), allowing free use, modification, and distribution with minimal restrictions—suitable for both open-source and commercial projects.

Quickstart

pip install checkov
checkov --directory /path/to/iac/code
# or scan a specific file:
checkov --file /path/to/terraform.tf

Requires Python >= 3.9 and <= 3.12; Terraform >= 0.12 for Terraform scanning.

Verify before relying

• Whether the 46 runtime dependencies introduce supply-chain risk or maintenance burden in your environment.
• Performance characteristics when scanning large IaC repositories or many files in parallel.

Package facts

Evidence: checkov-3.3.11-py3-none-any.whl

Tags

More Build Tools packages