Checkov is a static code analysis tool for infrastructure as code that detects security and compliance misconfigurations across multiple cloud and container platforms.
The tool addresses the problem of cloud misconfigurations and vulnerabilities introduced during infrastructure provisioning. It works by scanning infrastructure-as-code files using graph-based analysis to identify security and compliance issues before deployment. Checkov also performs software composition analysis to scan open source packages and container images for known vulnerabilities, providing a unified approach to catching problems across both infrastructure definitions and their dependencies.
Teams should adopt Checkov if they provision cloud infrastructure using Terraform, CloudFormation, AWS SAM, Kubernetes, Helm, Kustomize, Dockerfile, Serverless Framework, Bicep, OpenAPI, ARM Templates, or OpenTofu. It suits projects where security and compliance validation needs to happen early in the development pipeline, catching misconfigurations at build-time rather than after deployment. The tool is particularly valuable for organizations managing infrastructure across AWS, Azure, and GCP that want to enforce consistent security policies across multiple infrastructure-as-code frameworks in a single scanning pass.
The project maintains active development with regular updates to support new infrastructure-as-code formats and scanning capabilities. The codebase shows ongoing refinement of its graph-based scanning engine and expansion of its rule coverage for emerging compliance frameworks. Community contributions are actively integrated, indicating sustained engagement with users reporting issues and proposing improvements.
