---
id: checkov
version: "3.3.11"
license: Apache License 2.0
license_treatment: permissive
maintenance: active
---

# checkov — Infrastructure as code static analysis

License: permissive · Maintenance: active · Downloads: 21.2M/mo

## What it is and what it does

Checkov is a static analysis and software composition analysis (SCA) tool designed to catch security and compliance misconfigurations in infrastructure-as-code before deployment. It scans Terraform, CloudFormation, Kubernetes manifests, Dockerfiles, Helm charts, and several other IaC formats using graph-based analysis to understand context and relationships between resources. The tool also performs SCA scanning to detect known vulnerabilities (CVEs) in container images and open-source packages.

You run it as a command-line tool pointing to a directory or file, and it reports failures and passes against built-in policies covering AWS, Azure, and Google Cloud security best practices. Results can be output in multiple formats (CLI, JSON, JUnit XML, SARIF, CycloneDX) for integration into CI/CD pipelines or security dashboards. It supports policy suppression, variable evaluation, and secret detection using regex and entropy analysis.

Use it for:

- Scan Terraform configurations in CI/CD to block deployments with security misconfigurations before they reach cloud infrastructure.
- Validate Kubernetes manifests and Helm charts for compliance with security policies (e.g., pod security standards, RBAC rules).
- Detect hardcoded AWS credentials and secrets in infrastructure code and Lambda environment variables.
- Perform SCA scanning of container images and open-source dependencies to identify known CVEs.
- Generate compliance reports (SARIF, JUnit XML, CycloneDX) for security audits and regulatory requirements.
- Enforce organization-specific policies using custom YAML or Python policy definitions across all IaC files.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Checkov is a static code analysis tool that scans infrastructure-as-code files (Terraform, CloudFormation, Kubernetes, Dockerfile, and others) and container images to detect security misconfigurations and software vulnerabilities.

Yes. Checkov is actively maintained, widely adopted (top 5000 PyPI packages), has no known vulnerabilities, and low install friction. It is essential for teams managing infrastructure-as-code who want to catch security and compliance issues early. The permissive Apache 2.0 license and broad IaC format support make it suitable for most environments. Install it if you use Terraform, CloudFormation, Kubernetes, or Dockerfile in your infrastructure pipeline.

## Install

pip install checkov
uv add checkov
poetry add checkov

## Installing checkov

Before you install: Low install friction with a pure-wheel distribution. Actively maintained with a release just 1 day old and 8936 repository stars. Requires Python 3.9–3.12; some environments (e.g., Debian 12) may need a virtual environment for installation.

License in practice: Licensed under Apache License 2.0 (permissive), allowing free use, modification, and distribution with minimal restrictions—suitable for both open-source and commercial projects.

Quickstart:

pip install checkov
checkov --directory /path/to/iac/code
# or scan a specific file:
checkov --file /path/to/terraform.tf

Requires Python >= 3.9 and <= 3.12; Terraform >= 0.12 for Terraform scanning.

Verify before relying:

- Whether the 46 runtime dependencies introduce supply-chain risk or maintenance burden in your environment.
- Performance characteristics when scanning large IaC repositories or many files in parallel.

## Package facts

- License: Apache License 2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 21.2M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

infrastructure as code security scanning, terraform static analysis, IaC compliance checking, cloud misconfiguration detection, dockerfile security analysis, kubernetes manifest validation, CVE scanning for containers, security-scanning, infrastructure-as-code, compliance-automation

[View on SkillFed](https://skillfed.io/packages/checkov) · [View on PyPI](https://pypi.org/project/checkov/)