Checkov IaC Security

Catch infrastructure-as-code misconfigurations before they ship with Checkov by Prisma Cloud. Scans Terraform, CloudFormation, Kubernetes, Helm, Dockerfile, and ARM for insecure defaults, writes custom policies, suppresses false positives, and gates CI on policy violations.

Checkov is a static analysis tool that scans IaC for thousands of security and compliance misconfigurations. This skill helps you run scans across Terraform, Kubernetes, Helm, CloudFormation, and Dockerfiles, author custom policies in Python or YAML, manage baselines and skips, and enforce results in CI.

When to use

Use to scan Terraform, Kubernetes, Helm, CloudFormation, or Dockerfiles for insecure defaults, write custom policies, and block misconfigured infrastructure in CI.

Examples

Scan Terraform for issues

Find insecure defaults

Run Checkov on my Terraform and explain each failed check with the fix

Write a custom policy

Enforce a team standard

Write a custom Checkov policy that fails any S3 bucket without encryption and versioning enabled

Gate CI on IaC security

Block risky infra changes

Add Checkov to my pipeline so pull requests fail when they introduce high-severity misconfigurations