Checkov

Run a scan on infrastructure files

Install Checkov from PyPI, then point it at the directory containing the infrastructure you want to inspect. The official quick-start example is checkov -d /user/tf; replace that example path with your own directory. The GitHub repository also documents scanning an individual file or a Terraform plan in JSON form.

The input is your infrastructure configuration or plan. Checkov compares it with built-in policies for misconfigurations and security or compliance concerns, then reports results with file and resource context. The project lists support for formats including Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles, Bicep, and OpenTofu. It also supports scans in CI systems such as GitHub Actions and GitLab CI.

For a simple local infrastructure scan, the quick start shows installation and a directory path, with no account setup described. Some optional capabilities have different access requirements: the repository's examples for severity filtering and scans of images or packages show a Prisma Cloud API key; image and package examples also use a repository ID. Check those prerequisites for the specific scan you plan to use.

Checkov analyzes configuration and package or image data; it does not validate how an application behaves when running. Its repository notes the scope limitation of static analysis, including resources managed manually rather than through scanned configuration. The command above is the vendor's documented example, not a scan run for this listing.