Checkov IaC Security Scanner

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

Overview

Checkov is the open source static analysis and policy-as-code scanner that finds security and compliance misconfigurations in your infrastructure-as-code before it is ever deployed. It parses Terraform, CloudFormation, Kubernetes, Helm, Serverless, Bicep, ARM and Dockerfiles and reports where the declared infrastructure violates a policy: a storage bucket with no encryption, a security group open to the world, a container running as root. This image delivers Checkov fully installed in an isolated Python virtual environment with a wrapper on the system path, so an engineer can connect over SSH and run a real scan within moments of launch.

Shift Security Left

Catch insecure infrastructure at author time, in code review, and in CI, instead of in a post-incident review. Checkov ships thousands of built-in policies keyed to the common cloud frameworks and compliance benchmarks, so you get meaningful findings out of the box with no rule authoring. Run it against a single file, a whole module tree, or a plan file, and get a compact report naming each failed check and the resource it applies to.

Ready To Use

The virtual environment, the pinned Checkov release and the wrapper are all in place. Run checkov --version to confirm the toolchain, then point checkov at any path of infrastructure code. A deliberately insecure sample and a clean sample let you prove the scanner detects a real misconfiguration and passes clean code on your very first login.

Scheduled Scanning Built In

A daily systemd timer scans a drop-in target directory and logs the report, so you can leave infrastructure code in one place and have it re-checked automatically. Findings are the product working as designed: review each one, fix the code, or suppress it with an inline skip comment or a policy file. Wire the same command into your pipeline to gate merges on a clean scan.

Honest, Credential-Free Design

Checkov has no login, no web interface, no daemon and no network port. Its entire management surface is the command line plus SSH with your own key. There is nothing to rotate and nothing to leak, which is the strongest possible posture, reported plainly rather than papered over with a manufactured password.

cloudimg Support

24/7 technical support by email and chat. Help with running scans, interpreting findings, writing suppressions and custom policies, wiring Checkov into CI, and keeping your infrastructure code compliant.

Use Cases

A ready-to-run workstation for auditing infrastructure-as-code against security and compliance policy. A CI runner image that gates merges on a clean policy scan. A training and evaluation sandbox for teams adopting policy-as-code.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.