Checkov Explained: Scanning Terraform, Kubernetes and CI Configuration, Suppressions and Custom Policies

Most cloud misconfigurations are typed into a file long before they exist in the cloud. Checkov is an open-source scanner that reads those files, Terraform, CloudFormation, Kubernetes manifests, Helm charts, Dockerfiles and CI pipelines, and flags the public bucket or open security group while it is still a pull request.

What it is

Checkov describes itself as a static analysis tool for infrastructure as code and a software composition analysis tool for images and open-source packages. It was created by Bridgecrew, which Palo Alto Networks acquired in 2021; the project's README now says Prisma Cloud builds and maintains it, and Palo Alto lists it among the open-source projects behind Cortex Cloud. It is licensed Apache-2.0 and installed with pip install checkov.

Supported frameworks include Terraform and Terraform plan output, OpenTofu, CloudFormation and AWS SAM, Azure ARM and Bicep, Kubernetes, Helm and Kustomize, Dockerfiles, serverless configuration, GitHub Actions, GitLab CI, Bitbucket Pipelines, Argo Workflows and OpenAPI specifications, plus a secrets scanner. Dependency and image scanning (sca_package, sca_image) need a platform API key.

How it works

Checkov parses each file into resources, builds a graph of how they connect (a bucket and its policy, a security group and the instance it is attached to), then runs policies against it. Each policy has an ID such as CKV_AWS_20. Attribute policies check a single resource's settings; graph policies, written in YAML, check relationships between resources, which is how it can say "this bucket has no public access block attached" rather than only "this bucket's ACL is public".

How to use it

Day one: scan a directory

pip install checkov
checkov -d infra/                          # every framework found in the folder
checkov -d infra/ --framework terraform -o sarif --output-file-path results/
checkov -f main.tf --check CKV_AWS_20,CKV_AWS_57

Scanning terraform show -json output (--framework terraform_plan) evaluates the values Terraform will actually apply after variables and modules resolve, which catches problems a scan of raw .tf files can miss.

Week one: baseline and decide what blocks

A first scan of an existing repository usually returns hundreds of failed checks. Two options keep it adoptable:

1. Baseline. checkov -d . --create-baseline records today's findings in .checkov.baseline; later runs with --baseline report only new ones, so teams stop adding debt while they pay the old debt down.
2. Fail on what matters. --soft-fail reports without failing, and --hard-fail-on lists the IDs or severities that should block. Start by blocking a short list everyone agrees on: public storage, administrator access, unencrypted data stores, wide-open ingress.

Put shared settings in a .checkov.yaml file, which Checkov discovers automatically.

Every day: suppress with a reason, and write your own policies

Suppress inside the code, next to the resource, with a reason:

resource "aws_s3_bucket" "site" {
  #checkov:skip=CKV_AWS_20:Bucket serves the public marketing site
  bucket = "example-marketing-site"
}

For company rules, write a YAML custom policy and load it with --external-checks-dir:

metadata:
  id: "CKV2_CUSTOM_1"
  name: "Storage buckets must carry an owner tag"
  category: "GENERAL_SECURITY"
definition:
  cond_type: "attribute"
  resource_types: ["aws_s3_bucket"]
  attribute: "tags.owner"
  operator: "exists"

In GitHub Actions, the bridgecrewio/checkov-action wraps the CLI. Pin it, and every other third-party action, to a full commit SHA; the official example uses a branch reference, which is exactly the mutable reference attackers abused in the 2026 Trivy compromise.

Where it stops

• Only what is in code. Console changes, drift and resources created by other tools never reach Checkov; that is a CSPM's job.
• Static values. Variables resolved at apply time can hide the real setting unless you scan the plan.
• No context on reachability or data. It cannot tell whether a "public" bucket holds anything sensitive.
• Suppressions are trust. An inline skip without a reason, or approved by the same person who wrote it, is a hole.

How it comes up in interviews

• "Design IaC scanning for 200 Terraform repositories without blocking every team." Baselines, a short blocking list, reasons on suppressions, and CSPM behind it.
• "Why scan the Terraform plan and not just the files?" Modules and variables.
• "What does IaC scanning miss?" Drift, console changes, data sensitivity and runtime behaviour.

Sources

Checked on 13 November 2026: Checkov GitHub README (bridgecrewio/checkov), Checkov quick start and CLI command reference, Checkov YAML custom policy documentation, bridgecrewio/checkov-action README, Palo Alto Networks Cortex Cloud open-source projects page, Palo Alto Networks press release introducing Cortex Cloud (February 2025).