Lead Image © liudmilachernetska, 123RF.com

Infrastructure-as-Code Security with Checkov

Appraiser

Checkov [1] is an open source security scanner that checks infrastructure-as-code (IaC) files for insecure configurations, security vulnerabilities, and violations of best practices or compliance with such standards as Center for Internet Security (CIS), US Health Insurance Portability and Accountability Act (HIPAA), or EU General Data Protection Regulation (GDPR). It comes with more than 750 predefined policies that guide you in creating custom policies in Python or YAML. The tool also supports software composition analysis (SCA) for container images and open source packages to detect vulnerabilities (CVEs).

Checkov offers a wide range of capabilities:

• Scanning IaC files for security and compliance issues
• Detecting security vulnerabilities such as misconfigurations, open ports, unencrypted data, or excessive permissions in IaC
• Checking compliance with standards such as CIS, Payment Card Industry (PCI) data security, HIPAA, or AWS best practices
• Performing SCA scans for containers and packages to detect known vulnerabilities
• Python or YAML for custom policies
• Inclusion of continuous integration and continuous deployment (CI/CD) pipelines such as GitHub Actions, GitLab CI, or Azure DevOps
• Generating detailed scan reports
• Combining with integrated development environments (IDEs) such as Visual Studio Code

In addition to scanning Terraform code, Checkov supports a wide range of other technologies, including Helm, Kustomize, AWS serverless application model (SAM) configuration, Ansible, Argo Workflows, Azure Resource Manager (ARM) templates, Azure Pipeline configurations, Azure Bicep, Bitbucket, AWS Cloud Development Kit (CDK), CloudFormation, Dockerfile scanning, GitHub and GitLab configurations, and Kubernetes configurations.

Getting