Checkov

What it checks

Checkov scans infrastructure code before it is applied. It reads Terraform, CloudFormation, Kubernetes manifests, Helm charts, ARM templates and Serverless Framework definitions, and tests them against more than a thousand built-in policies — public S3 buckets, unencrypted volumes, security groups open to 0.0.0.0/0, IAM policies with wildcard actions.

The graph analysis is what separates it from simple pattern matching. Checkov builds a model of resource relationships, so it can catch problems that only exist in combination: a security group that is fine in isolation but permissive once you follow which instances attach to it.

Running it

It runs as a Python package, which means it works in a pre-commit hook, in CI, or on a developer's machine before a commit. Findings carry policy IDs so suppressions can be specific — an inline checkov:skip comment with a justification rather than disabling a whole category.

Custom policies can be written in Python for logic that needs it, or YAML for simpler attribute checks. Most teams end up writing some, because organisational requirements rarely map cleanly onto a generic policy set.

Noise and tuning

Running Checkov unconfigured against an established Terraform repository returns a lot. Many findings are defensible as defaults but wrong for a given context — a policy wanting encryption on a bucket holding public assets, for instance. The first week with Checkov is mostly deciding which policies apply to you.

Graph analysis also costs time on large repositories. On a monorepo with hundreds of modules, a full scan is long enough that teams usually scope it to changed directories in CI rather than scanning everything on every push.

The commercial pull

Checkov is Apache 2.0 and genuinely usable standalone. It is also the open-source entry point to Prisma Cloud, and features around centralised policy management, drift detection and cross-repo reporting live on the commercial side. Nothing is removed from the open-source tool, but the product roadmap serves a platform you may eventually be asked to buy.

Coverage is also uneven across frameworks. Terraform support is the most mature; Kubernetes and CloudFormation are solid; the longer tail is thinner.