Checkov

Checkov is a policy-as-code scanner for infrastructure definitions: Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles, GitHub Actions and others. It ships a large catalogue of checks with identifiers such as CKV_AWS_20 and is maintained by Palo Alto Networks as the open-source engine behind Prisma Cloud. In a pipeline it runs against the infrastructure directory before plan or apply, and its custom policies are the route by which a project’s own infrastructure conventions become blocking checks.

How it is conformant

Bespoke checks are first class (4.1) in two forms: a Python class extending the check base classes, or a YAML policy of attribute and connection conditions, both loaded with --external-checks-dir (Python custom policies, YAML custom policies). The author sets the id and it is printed with every finding, in the terminal output and in JSON, SARIF, JUnit, CSV and GitLab formats (CLI reference), satisfying 4.3 and 5.3. A single check runs against a single file with checkov -f <file> --check <id> together with the external checks directory, which is a harness in the sense the detector specification defines, one rule against supplied code with its findings observed and no other rule obscuring them (4.2), and it meets 5.2 outright; the Python documentation walks through running a new check against a sample file to see it fail, which is the red run. The core scanner needs no API key (5.1): with --skip-download it makes no network call at all, at the cost of omitting the “Guide” links and severities the platform supplies (CLI reference). checkov --list enumerates the bundled checks with identifier, name, resource type and framework, and the published policy index is keyed on the identifier, which is the online half of 6.1 for the bundled catalogue.

How it is not conformant

Clause 7.1 is failed, and it is the structural failure that decides the grade: the inline checkov:skip=<id>:<comment> form cannot be switched off by any documented option, and because custom checks see parsed resources rather than comments, the tool documents no rule or mechanical check by which a project could see the route being used (suppressing policies). The comment on a skip is optional, --skip-check and the configuration file take no reason, and --create-baseline writes a .checkov.baseline so that “future runs will not re-flag the same noise” with no reason per entry (CLI reference), so 7.2 is not met either; the baseline at least is opt-in, since a run only honours it with --baseline. Resolution of a bundled check is online only: each finding prints a “Guide” URL fetched from Prisma Cloud at run time, a custom policy’s optional guideline field is likewise a URL (YAML custom policies), and nothing on disk resolves CKV_AWS_20 to its documentation, so 6.2 and 6.3 are failed and with --skip-download the links vanish altogether. No release gate on check documentation is documented (6.4) and there is no rule over the checks (4.4). Platform policies and severity filtering are available only with a Prisma Cloud API key, so findings from that part of the catalogue exist only through a hosted service and 5.4 is partial.

Clause by clause

Notes for a practitioner

Checkov will run the six clauses for infrastructure code: write the check under --external-checks-dir, prove it red with -f on the offending file, sweep with -d over the whole infrastructure tree, and let the non-zero exit block. Run with --skip-download in the project entry point so the result is reproducible offline, keep a markdown file per identifier in the repository because the printed Guide link will not be there, and add a separate check outside Checkov, a grep in the same entry point will do, that fails on any checkov:skip comment, since the tool can neither disable them nor see them.