bridgecrewio/checkov
Checkov
Checkov is a static analysis tool and security scanner designed to identify misconfigurations in infrastructure as code, container images, and Kubernetes configurations. It functions as a cloud security posture tool, an SCA vulnerability scanner, and a secret scanning utility to prevent security breaches and version control leaks.
The project distinguishes itself through deep graph analysis and variable resolution, allowing it to map relationships between interconnected resources and evaluate the final state of infrastructure attributes. It provides extensibility for defining custom security policies using Python or YAML and includes a policy generation utility to create new static analysis checks.
The tool's capability surface covers a wide range of cloud templates, including Terraform plans, AWS SAM, CloudFormation, Azure ARM, and Bicep files. It also handles container security via Dockerfile and image auditing, and Kubernetes auditing through the analysis of manifests, Helm charts, and Kustomize files. Additionally, it performs software composition analysis to identify known CVEs in package dependencies and uses regex and entropy to detect hardcoded secrets.
Automation is supported via native integrations for CI/CD pipelines, git hooks, and IDEs, with results exportable in formats such as JSON, JUnit XML, SARIF, and Markdown.
Features
- Infrastructure as Code Scanners - Provides static analysis of infrastructure templates to detect security risks before deployment.
- Infrastructure as Code Security - Provides automated security scanning for infrastructure configuration files across various cloud providers.
- Static Code Analysis - Evaluates infrastructure code against Python and YAML rules to identify misconfigurations without executing the code.
- Manifest Scanning - Evaluates Kubernetes configuration files against security best practices to identify non-compliant settings.
- Dependency Graph Resolvers - Maps and traverses relationships between infrastructure resources to resolve complex variable connections.
- Infrastructure Attribute Resolution - Resolves infrastructure variable references and default values to determine the final state of resource attributes.
- Infrastructure Variable Resolution - Resolves infrastructure variable references and default values to accurately detect security misconfigurations.
- Vulnerability Analysis - Analyzes Dockerfiles and container images to identify known vulnerabilities and insecure configurations.
- Security Auditing - Inspects container images for known vulnerabilities and insecure settings to ensure security compliance.
- Manifest Template Engines - Processes Helm and Kustomize files into final manifests to resolve dynamic values before security scanning.
- Terraform Plan Analysis - Analyzes JSON-formatted Terraform plan files to identify security risks using execution context and dependencies.
- Dependency Vulnerability Scanners - Analyzes project dependencies and container images to detect known security vulnerabilities (CVEs).
- Dockerfile Security Scanning - Analyzes Dockerfiles and container image references to find security flaws and vulnerabilities.
- Cloud Compliance Auditors - Evaluates cloud infrastructure templates and runtime resources against regulatory frameworks and security benchmarks.
- Secret Detection - Identifies plaintext credentials and API keys using a combination of regex pattern matching and entropy analysis.
- Secrets Scanning - Detects and alerts on hardcoded credentials in source code and configuration files.
- Dependency Vulnerability Scanning - Analyzes package manager files and container images for known CVEs and vulnerability database matches.
- Cloud Security Posture Scanners - Audits cloud templates and runtime resources to detect misconfigurations and security risks.
- Software Composition Analysis Tools - Scans dependency trees and package files to identify known CVEs and license violations.
- Static Analysis Security Testing - Analyzes source code to find security vulnerabilities and logic flaws before deployment.
- Dependency Graph Resolution - Computes a graph of attribute references and parameters to analyze the final state of dependent infrastructure resources.
- Vulnerability Mapping - Traverses package manager files and container images to identify known vulnerabilities in third-party libraries.
- Relationship Analysis - Maps relationships between infrastructure components to detect complex security flaws spanning multiple resources.
- CI/CD Security - Inspects pipeline definition files to detect security flaws within the automated deployment process.
- Change Impact Analysis - Evaluates whether specific resource attributes have been modified in a plan to trigger conditional security checks.
- Git Hooks - Runs security scans automatically during the pre-commit phase to block insecure changes from being merged.
- IDE Integrations - Identifies misconfigurations and suggests fixes directly within the code editor during development.
- Scan Configurations - Manages the scope of analysis by excluding specific files, directories, or checks via regex and flags.
- Plan-to-Source Mapping - Combines plan file analysis with original source files to map security findings to specific code blocks.
- CI/CD Pipeline Integrations - Integrates with automated build pipelines to prevent misconfigured infrastructure from being deployed to production.
- Security Scanning - Provides security scanning for Helm charts by templating them into manifests to identify misconfigurations.
- Security Scanning - Analyzes live Kubernetes cluster configurations to identify security misconfigurations in deployed resources.
- Security Scanning - Templates Kustomize files into manifests and scans the resulting configuration against security policies.
- Infrastructure Policy Definition - Allows defining tailored security checks using Python or YAML to enforce specific requirements across infrastructure.
- Kubernetes Configuration Auditing - Evaluates Kubernetes manifests, Helm charts, and Kustomize files for security flaws and non-compliant settings.
- Misconfiguration Scanning - Evaluates AWS SAM templates against security benchmarks to identify structural misconfigurations.
- Scan Filtering Tools - Controls which policies execute during a run by including or excluding specific check IDs or severity levels.
- Security Finding Management - Provides mechanisms to ignore specific security findings via inline comments to handle false positives.
- Source Code Mapping - Merges JSON execution plans with source files to map security findings back to specific lines of code.
- Template Scanning - Evaluates serverless infrastructure templates against security best practices to identify misconfigurations.
- Sensitive Data Scanners - Scans code diffs for logging statements containing potentially sensitive variables to prevent accidental exposure.
- Security Rule Development - Supports writing custom Python logic to define specific security rules for organizational requirements.
- Rule Suppression Comments - Supports inline source code comments to disable specific security checks for intentional deviations.
- IaC Security - Static analysis tool for infrastructure-as-code.
- Infrastructure as Code Analysis - Scans Terraform, CloudFormation, and Kubernetes for insecure configurations.
- Workflow Automation - Static analysis tool for security and compliance.
- Workflow Utilities - Static analysis tool for security and compliance.
- Application Security - Prevents cloud misconfigurations in infrastructure-as-code.
- Application Security Testing - Static analysis tool for infrastructure as code security.
- Infrastructure Security - Static analysis for Terraform, CloudFormation, and Kubernetes.
- Security and Compliance - Static analysis for infrastructure-as-code security.
- सिक्योरिटी और हार्डनिंग - Static analysis for infrastructure-as-code security.
- Security Auditing - Static analysis tool for infrastructure-as-code security.
- Testing Tools - Static analysis tool for infrastructure-as-code security.
