Overview

Checkov is a static code analysis tool for infrastructure as code (IaC) and a software composition analysis (SCA) tool for container images and open-source packages. It reads the definitions you write to describe cloud infrastructure — Terraform, CloudFormation, Kubernetes manifests, Helm charts, Dockerfiles and more — and reports the security and compliance misconfigurations before anything is deployed. The project lives in the bridgecrewio organisation on GitHub and its README states it is maintained by Prisma Cloud (Palo Alto Networks); the same engine also powers Prisma Cloud’s Cloud Code Security product, but using Checkov itself needs no account.

Written in Python and installed in seconds with pip3 install checkov (or Homebrew, or the official Docker image), Checkov ships more than 1,000 built-in policies covering security and compliance best practice for AWS, Azure and Google Cloud. Its distinguishing feature is graph-based scanning: rather than checking each file in isolation, Checkov builds an in-memory graph of resources and their references across the whole directory, so a policy can reason about context — for example whether a key or policy is actually attached to the resource that needs it. The latest release at the time of writing is v3.3.29 (October 2026), and the repository has passed 9,000 stars.

Key Features

• Broad IaC coverage — Terraform, Terraform plan, Terraform JSON, CloudFormation, AWS SAM, Kubernetes, Helm charts, Kustomize, Dockerfile, Serverless Framework, Ansible, Bicep, Azure ARM templates, OpenAPI and OpenTofu.
• Pipeline and workflow files — Argo Workflows, Azure Pipelines, Bitbucket Pipelines, CircleCI, GitHub Actions and GitLab CI configuration are scanned with the same engine.
• More than 1,000 built-in policies — security and compliance checks for AWS, Azure and Google Cloud, catalogued in the project’s policy index.
• Graph-based, context-aware policies — cross-resource checks that a single-file linter cannot express, driven by a graph built from the scanned directory.
• Software composition analysis (SCA) — scans open-source packages and images for Common Vulnerabilities and Exposures, so one tool covers both the code you write and the dependencies you pull in.
• Secret detection — finds credentials with regular expressions, keywords and entropy heuristics, including AWS keys in EC2 user data, Lambda environment variables and Terraform provider blocks.
• Custom policies in Python or YAML — attribute policies in Python, attribute and composite (multi-resource) policies in YAML, so organisation-specific rules run in the same engine instead of a separate linter.
• Terraform provider awareness — provider settings are evaluated to govern the creation, management and updating of IaaS, PaaS and SaaS resources, and policy variables are resolved to their default values.
• Suppression controls — accepted risks and false positives can be skipped inline in the code or globally from the CLI, keeping recurring scan failures worth reading.
• Output for every pipeline — CLI, JSON, JUnit XML, CSV, SARIF, CycloneDX and GitHub-flavoured Markdown, with links to remediation guides; a non-zero exit code makes it a usable build gate.
• Docker image and Homebrew formula — docker run bridgecrew/checkov or brew install checkov alongside pip, plus bash autocompletion through register-python-argcomplete checkov.

Why Use Checkov?

The appeal is timing. A misconfigured bucket or an over-permissive security group is cheap to fix in a pull request and expensive to fix in production, and Checkov moves that class of finding as far left as it can go: it needs no cloud credentials, no account and no agent, because it only reads files. That makes it safe to run on a laptop, in a pre-commit hook, in a CI job with no cloud access at all, or against a Terraform plan that has not been applied yet.

It is also unusually broad for a free tool: the same command covers Terraform and OpenTofu, CloudFormation and ARM, Kubernetes and Helm, Dockerfiles and Ansible, CI workflow files, dependency CVEs and hard-coded secrets, and it can emit SARIF or CycloneDX for the dashboards that already exist. Policies live in the open repository and can be added to in Python or YAML, so the tool grows with an organisation’s own rules. It is Apache-2.0 licensed with no paid tier required, and it runs entirely on your own machine or your own runner. The honest caveats: it is a Python package, so it wants a virtual environment on distributions that mark the system interpreter as externally managed, and the project’s own README documents a supported range of Python 3.9–3.12 (we installed and ran 3.3.29 on Python 3.13.5 without trouble); and the v2→v3 transition changed some CLI and policy behaviour, so a migration guide is worth reading if you are coming from an older release.

Use Cases

• Fail a pull request that introduces a public S3 bucket, an unencrypted database or a world-open security group, using checkov -d . --compact in CI.
• Review a Kubernetes or Helm change before it reaches a cluster — manifests, charts and Kustomize overlays are parsed natively.
• Scan a Terraform plan rather than the source, so values that only exist after variable and module resolution are evaluated too.
• Catch hard-coded secrets and tokens in IaC files, complementing a dedicated scanner such as Gitleaks.
• Check container images and open-source packages for known CVEs as part of the same pipeline gate.
• Audit CI workflow files — GitHub Actions, GitLab CI, CircleCI and the rest — for unsafe defaults such as unpinned actions or over-broad permissions.
• Encode organisation-specific standards as custom Python or YAML policies and enforce them across every repository.
• Emit SARIF or CycloneDX into an existing code-scanning or supply-chain dashboard without buying anything.

Similar

• Trivy — the closest all-in-one alternative: one binary covering IaC misconfiguration, vulnerabilities, secrets and licences; Checkov remains stronger on IaC policy depth and Terraform context.
• Semgrep — pattern-based static analysis for application source code; the two are complementary, Semgrep reading the program and Checkov reading the infrastructure definition.
• Gitleaks — a dedicated secret scanner for repositories; Checkov’s secret detection covers IaC files specifically.
• Lynis and OSQuery — audit systems that are already running, rather than the definitions of systems that do not exist yet; CrowdSec, Suricata and ClamAV work at the traffic and runtime layers.
• KICS and tfsec — two other IaC-focused scanners: KICS keeps its own policy set, while tfsec’s checks were folded into Trivy.

Platform

Linux · macOS · Windows · Docker — distributed as a Python package on PyPI (pip3 install checkov), a Homebrew formula, and the official bridgecrew/checkov image on Docker Hub. Requires Python 3.9 or newer (the README documents 3.9–3.12) and Terraform 0.12+ when scanning Terraform. Debian and similar distributions may need Checkov installed into a virtual environment.

Licence

Apache-2.0 — permissive, with no paid tier required to use the open-source scanner. The licence badge is set from the LICENSE file in the project repository, and the PyPI metadata declares the same Apache License.

Website

checkov.io · documentation · source on GitHub · PyPI · Docker Hub