Trivy is an open-source security scanner that finds vulnerabilities, misconfigurations, secrets and SBOM data in containers, filesystems, Git repos, VM images and Kubernetes.
38.5K774GoApache-2.0Updated 2 days ago
bridgecrewio/checkov
Static analysis tool that scans infrastructure as code, container images and open source packages for cloud misconfigurations and CVEs.
Open-source alternative to:Prisma Cloud
- Stars
- 9,089
- Forks
- 1,445
- Open issues
- 208
- Last commit
- 8 hours ago
What is it?
Checkov checks infrastructure-as-code files such as Terraform, CloudFormation, Kubernetes manifests, Helm charts, Dockerfiles and GitHub Actions workflows against more than 1000 built-in policies covering AWS, Azure and Google Cloud. It runs before deployment, so misconfigurations like public storage buckets or unencrypted resources can be caught during build or in CI.
Beyond IaC, Checkov also performs software composition analysis, scanning container images and open source packages for Common Vulnerabilities and Exposures (CVEs). It can detect secrets such as AWS credentials in EC2 user data or Lambda environment variables, and supports graph-based context-aware policies, variable evaluation, and inline suppression comments for accepted risks.
Results can be printed to the CLI or exported as JSON, JUnit XML, CSV, SARIF and CycloneDX. Checkov is installed with pip or Homebrew and runs as a Docker image.
Key features
- 01Built-in policies for AWS, Azure and Google Cloud misconfigurations.
- 02Scans Terraform, CloudFormation, Kubernetes, Helm, Kustomize, Dockerfile, Bicep, ARM and many CI workflow formats.
- 03Software composition analysis for container images and open source packages.
- 04Detects secrets such as AWS credentials and high-entropy strings.
- 05Inline skip comments and CLI allow/deny lists for managing accepted findings.
- 06Exports results as CLI, JSON, JUnit XML, CSV, SARIF or CycloneDX.
Use cases
- Blocking insecure cloud resource definitions in a CI pipeline before terraform apply.
- Reviewing Kubernetes manifests and Helm charts for risky container settings.
- Scanning container images and dependencies for known CVEs during builds.
- Producing SARIF or JUnit reports for compliance and code scanning dashboards.
Quick start
- 1
Install Checkov with pip
pip3 install checkov - 2
Scan an infrastructure-as-code directory
checkov --directory /user/path/to/iac/code
Things to know
- Requires Python 3.9 to 3.12.
- Some features, such as the --check severity filters and container image scans, need a Bridgecrew/Prisma Cloud API key.
Topics
FAQ
- What is checkov?
- Static analysis tool that scans infrastructure as code, container images and open source packages for cloud misconfigurations and CVEs. Checkov checks infrastructure-as-code files such as Terraform, CloudFormation, Kubernetes manifests, Helm charts, Dockerfiles and GitHub Actions workflows against more than 1000 built-in policies covering AWS, Azure and Google Cloud. It runs before deployment, so misconfigurations like public storage buckets or unencrypted resources can be caught during build or in CI.
- Is checkov free to use? What license does it have?
- checkov is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
- Is checkov still maintained?
- Actively maintained. The last commit to checkov was on Oct 20, 2026.
- What can I use checkov for?
- Blocking insecure cloud resource definitions in a CI pipeline before terraform apply. Reviewing Kubernetes manifests and Helm charts for risky container settings. Scanning container images and dependencies for known CVEs during builds. Producing SARIF or JUnit reports for compliance and code scanning dashboards.
- How do I install checkov?
- Install Checkov with pip: pip3 install checkov Scan an infrastructure-as-code directory: checkov --directory /user/path/to/iac/code
- Where can I get checkov?
- The source code and installation instructions are on GitHub: https://github.com/bridgecrewio/checkov
Summary generated by AI from the project's README. GitHub stats refresh daily.
Related projects
Infrastructure as code CLI that plans and applies declarative configuration files to create, change, and version cloud and service resources.
50K10.6KGoOtherUpdated 13 hours ago
Self-hosted platform for cloud development environments and AI coding agents, with workspaces defined in Terraform.
17.1K1.6KGoAGPL-3.0Updated yesterday
Open-source TypeScript and Go backend framework where databases, Pub/Sub, buckets, caches and cron jobs are declared in code and run locally, then deployed to your AWS or GCP account.
12.5K638GoMPL-2.0Updated 2 days ago
An agent skill that turns natural language and real system sources like Terraform, Kubernetes, SQL and OpenAPI into editable draw.io architecture diagrams.
10.2K870PythonMITUpdated 10 days ago
A collection of open source MCP servers that give AI assistants access to AWS documentation, services, and tooling.
9.8K1.8KPythonApache-2.0Updated yesterday