Skip to main content

Infrastructure as code static analysis

Project description


Maintained by build status code_coverage docs PyPI Downloads Terraform Version

Table of contents


Checkov is a static code analysis tool for infrastructure-as-code. It scans cloud infrastructure provisioned using Terraform and detects security and compliance misconfigurations.

Checkov is written in Python and provides a simple method to write and manage policies. It follows the CIS Foundations benchmarks where applicable.


  • 50+ built-in policies cover security and compliance best practices for AWS, Azure & Google Cloud.
  • Policies support variable scanning by building a dynamic code dependency graph (coming soon).
  • Supports in-line suppression of accepted risks or false-positives to reduce recurring scan failures.
  • Output currently available as CLI, JSON or JUnit XML.


Scan results in CLI


Scheduled scan result in Jenkins


Getting started


pip install checkov

Configure an input folder

checkov -d /user/tf

Or a specific file

checkov -f /user/tf/

Scan result sample (CLI)

Passed Checks: 1, Failed Checks: 1, Suppressed Checks: 0
Check: "Ensure all data stored in the S3 bucket is securely encrypted at rest"
	 Passed for resource: aws_s3_bucket.template_bucket 
Check: "Ensure all data stored in the S3 bucket is securely encrypted at rest"
	 Failed for resource: aws_s3_bucket.sls_deployment_bucket_name       

Start using Checkov by reading the Getting Started page.

Using Docker

docker pull bridgecrew/checkov
docker run bridgecrew/checkov -i -v /user/tf:/tf -d /tf


For Terraform compliance scanners check out tfsec, Terrascan and Terraform AWS Secure Baseline.

For CloudFormation scanning check out cfripper and cfn_nag.


Contribution is welcomed!

Start by reviewing the contribution guidelines. After that, take a look at a good first issue.

Looking to contribute new checks? Learn how to write a new check (AKA policy) here


Bridgecrew builds and maintains Checkov to make policy-as-code simple and accessible.

Start with our Documentation for quick tutorials and examples.

If you need direct support you can contact us at or open a ticket.

Project details

Release history Release notifications

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for checkov, version 1.0.127
Filename, size File type Python version Upload date Hashes
Filename, size checkov-1.0.127-py3-none-any.whl (60.2 kB) File type Wheel Python version py3 Upload date Hashes View hashes
Filename, size checkov-1.0.127.tar.gz (21.1 kB) File type Source Python version None Upload date Hashes View hashes

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page