- Home
- Infrastructure Testing Tools
- Checkov
Checkov
What it is
Checkov is a free, open-source tool for finding infrastructure-as-code configuration problems that may create security or compliance risks. Its documented scan targets include Terraform, CloudFormation, ARM, Serverless, Helm, Kubernetes, and Docker. The policy library has more than 750 predefined policies, including checks for standards such as CIS and the AWS Foundations Benchmark. Checkov can also find common credentials in IaC files, including AWS access keys, Azure service credentials, and private keys. Teams can write custom attribute policies in Python or YAML, as well as composite policies in YAML. Documented CI integrations include Jenkins, Bitbucket Cloud Pipelines, GitHub Actions, and GitLab CI. Visual Studio Code and JetBrains add-ons provide real-time scanning and inline fixes. Installation is documented through pip and Homebrew, with Homebrew specified for macOS or Linux. The project supports Python versions 3.9 through 3.13 and uses the Apache-2.0 license. Prisma Cloud extends Checkov with runtime scanning, visibility, native VCS integrations, drift detection, and pull request annotations. The project directs users to its documentation for tutorials and examples.
For and against
For
- Scans seven listed IaC formats.
- Includes more than 750 predefined policies.
- Detects common credentials in IaC files.
- Integrates with several CI systems.
- IDE add-ons offer inline fixes.
Against
- Alpine is not officially tested or supported.
- Alpine requires Python 3.11 or later.
- Prisma Cloud is needed for listed extended capabilities.
The verdict
Checkov covers a range of infrastructure-as-code formats and offers custom policies, CI integrations, and IDE add-ons at no cost. Alpine users should note its support caveat, and teams considering the extended capabilities should review the Prisma Cloud dependency.
Who it suits
Checkov suits developers and teams scanning infrastructure-as-code for configuration issues, credentials, and compliance checks. It may also suit teams that want scanning in CI pipelines or supported IDEs.
Plans and prices
Checkov
Open-source CLI · Apache-2.0 license
Read 29 Sep 2026 · github.com
On the record
- CI integrations
- The documentation describes integrations with Jenkins, Bitbucket Cloud Pipelines, GitHub Actions, and GitLab CI.checkov.io · read 29 Sep 2026
- Compliance
- Checkov scans for common standards including CIS and the AWS Foundations Benchmark.checkov.io · read 29 Sep 2026
- Custom policies
- Users can create custom attribute policies in Python or YAML and composite policies in YAML.checkov.io · read 29 Sep 2026
- Developer tools
- Checkov offers Visual Studio Code and JetBrains add-ons for real-time IaC scanning and inline fixes.checkov.io · read 29 Sep 2026
- Installation
- The project documents installation through pip and Homebrew; Homebrew is specified for macOS or Linux.checkov.io · read 29 Sep 2026
- License
- The Checkov GitHub repository identifies its license as Apache-2.0.github.com · read 29 Sep 2026
- Platform limitation
- Checkov on Alpine requires Python 3.11 or later and is not officially tested or supported.checkov.io · read 29 Sep 2026
- Policy library
- The Checkov documentation says it includes more than 750 predefined policies.checkov.io · read 29 Sep 2026
- Prisma Cloud
- Prisma Cloud extends Checkov with runtime scanning, visibility, native VCS integrations, drift detection, and pull request annotations.checkov.io · read 29 Sep 2026
- Purpose
- Checkov scans infrastructure-as-code files for misconfigurations that can cause security or compliance problems.checkov.io · read 29 Sep 2026
- Python support
- The repository says it supports Python 3.9 through 3.13 inclusive.github.com · read 29 Sep 2026
- Secrets scanning
- Checkov can detect common credentials such as AWS access keys, Azure service credentials, and private keys in IaC files.checkov.io · read 29 Sep 2026
- Support
- The project directs users to its documentation for tutorials and examples and identifies Prisma Cloud as the maintainer.github.com · read 29 Sep 2026
- Supported IaC
- Documented scan targets include Terraform, CloudFormation, ARM, Serverless, Helm, Kubernetes, and Docker.checkov.io · read 29 Sep 2026
