Skip to main content

Infrastructure as code static analysis

Project description

Checkov

Maintained by Bridgecrew.io build status code_coverage docs PyPI Terraform Version

Table of contents

Description

Checkov is a static code analysis tool for infrastructure-as-code. It scans cloud infrastructure provisioned using Terraform and detects security and compliance misconfigurations.

Checkov is written in Python and provides a simple method to write and manage policies. It follows the CIS Foundations benchmarks where applicable.

Features

  • 40+ built-in policies cover security and compliance best practices for AWS, Azure & Google Cloud.
  • Policies support variable scanning by building a dynamic code dependency graph (coming soon).
  • Supports in-line suppression of accepted risks or false-positives to reduce recurring scan failures.
  • Output currently available as CLI, JSON or JUnit XML.

Screenshots

Scan results in CLI

scan-screenshot

Scheduled scan result in Jenkins

jenikins-screenshot

Getting started

Start using Checkov by reading the Getting Started page.

Alternatives

For Terraform compliance scanners check out tfsec, Terrascan and Terraform AWS Secure Baseline.

For CloudFormation scanning check out cfripper and cfn_nag.

Support

Bridgecrew builds and maintains Checkov to make policy-as-code simple and accessible.

Start with our Documentation for a quick tutorial and examples.

If you need support contact us at support@bridgecrew.io or open a ticket.

Project details


Release history Release notifications | RSS feed

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

checkov-1.0.71.tar.gz (16.9 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

checkov-1.0.71-py3-none-any.whl (49.3 kB view details)

Uploaded Python 3

File details

Details for the file checkov-1.0.71.tar.gz.

File metadata

  • Download URL: checkov-1.0.71.tar.gz
  • Upload date:
  • Size: 16.9 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/3.1.1 pkginfo/1.5.0.1 requests/2.22.0 setuptools/41.6.0 requests-toolbelt/0.9.1 tqdm/4.40.2 CPython/3.7.5

File hashes

Hashes for checkov-1.0.71.tar.gz
Algorithm Hash digest
SHA256 9fca7e8fa73e1204dcc9f4136a58e826f62ae52b365d51fcc795980671f6711b
MD5 d6827a0c67ca6bf663714f50c0f455c4
BLAKE2b-256 65688720f0199b902065c1096ec4af52d92c402b0f074d50caa80ae4ee011322

See more details on using hashes here.

File details

Details for the file checkov-1.0.71-py3-none-any.whl.

File metadata

  • Download URL: checkov-1.0.71-py3-none-any.whl
  • Upload date:
  • Size: 49.3 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/3.1.1 pkginfo/1.5.0.1 requests/2.22.0 setuptools/41.6.0 requests-toolbelt/0.9.1 tqdm/4.40.2 CPython/3.7.5

File hashes

Hashes for checkov-1.0.71-py3-none-any.whl
Algorithm Hash digest
SHA256 1cb1c9f698fc4c1d1ab33c729fcadccd6bcf3b436ba685e3087506956507ff2c
MD5 d093ca73993e72bcf1f81d2be1baa4af
BLAKE2b-256 fb3cf901d8afa8d2129f7683e306d3faf0b3b7b48c355af32d6a7c750d80ff1d

See more details on using hashes here.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page