Checkov is an open-source static code analysis and software composition analysis tool that scans infrastructure as code, container images and open source packages for security and compliance misconfigurations during the build, and it is aimed at developers, DevOps engineers and security teams who want those checks to run before anything is deployed to AWS, Azure or Google Cloud.

What it is

Checkov is a Python static analysis tool for infrastructure as code, published under the Apache-2.0 licence and maintained by Prisma Cloud under the bridgecrewio organisation. It reads the declarative files that define cloud infrastructure and evaluates them against security and compliance best practices. It also acts as a software composition analysis (SCA) tool, scanning container images and open source packages for Common Vulnerabilities and Exposures (CVEs). It is the analysis engine that powers Prisma Cloud Application Security, so the same checks run behind the commercial platform and in the open-source command line tool.

The problem it solves is timing. Misconfigurations in the infrastructure ecosystem are normally caught after deployment, when the resources already exist in an AWS, Azure or GCP account and the cost of correcting them includes an incident, an audit finding or a rewrite of Terraform state. Checkov moves that detection into the build pipeline, where a failing scan blocks a pull request or a deploy step instead of surfacing in a console. It covers the whole declaration surface a team actually writes, from Terraform and Terraform plan through OpenTofu, CloudFormation, AWS SAM, ARM Templates, Bicep, Kubernetes manifests, Helm charts, Kustomize overlays, Serverless framework output, Dockerfiles and OpenAPI definitions, using graph-based scanning rather than file-by-file pattern matching.

Key capabilities

• Scans Terraform (version 0.12.0 and above), Terraform plan output and OpenTofu, alongside CloudFormation, AWS SAM and Azure ARM Templates and Bicep.
• Scans Kubernetes manifests, Helm charts, Kustomize builds, Serverless framework definitions, Dockerfiles and OpenAPI specifications in the same run.
• Ships with over 1000 built-in policies covering security and compliance best practices for AWS, Azure and Google Cloud.
• Performs Software Composition Analysis (SCA) over open source packages and container images to report known CVEs.
• Detects misconfigurations using graph-based scanning, which follows relationships between resources rather than reading each file in isolation.
• Runs as a command-line tool distributed on PyPI as checkov and as the bridgecrew/checkov Docker image, so it drops into CI without a Python toolchain on the host.
• Feeds the same checks into Prisma Cloud Application Security, the developer-first platform that codifies cloud security across the development lifecycle.

Who uses it and how

• CI pipelines use it as a gate: the repository itself runs build and security GitHub Actions workflows, and the same pattern applies to any pull request that touches infrastructure files.
• Teams run the bridgecrew/checkov Docker image in build systems where installing Python packages is undesirable or impossible.
• Multi-cloud platform teams scan Terraform, CloudFormation, ARM Templates and Kubernetes manifests in one command rather than maintaining a separate linter per provider.
• Security teams fold container image and dependency CVE scanning into the same pipeline stage that checks infrastructure, instead of running two products.
• Organisations that want a hosted dashboard, policy management and organisation-wide reporting adopt Prisma Cloud Application Security, which Checkov powers underneath.

Getting started

Install from PyPI with the checkov package, or pull and run the bridgecrew/checkov Docker image. Documentation, including the policy index and per-framework scan examples, lives at https://www.checkov.io/.

How it compares

No list of paid products that Checkov replaces is given in the available facts, and no competing open-source scanner is named there either, so on the evidence provided it stands alone in this registry. The one commercial relationship the facts do describe is a supportive one: Checkov powers Prisma Cloud Application Security rather than competing with it, which means the open-source tool and the hosted platform share an engine and an organisation.

When to use it — and when not to

Checkov runs as a command-line scan over files and images, so there is no database, object store or mail server for a self-hoster to operate; the operational burden is the CI job itself and the discipline of acting on findings. It is a poor fit for teams that do not keep their infrastructure in code, for anyone wanting a hosted interface with organisational reporting and no pipeline integration, and for detection of drift or runtime state, because its analysis happens at build time against declared configuration rather than against live cloud resources. Teams that need a managed service with dashboards should look at Prisma Cloud Application Security, which is the commercial route to the same scanning engine.

pip3 install checkov

# Create and activate a virtual environment
python3 -m venv /path/to/venv/checkov
cd /path/to/venv/checkov
source ./bin/activate

# Install Checkov with pip
pip install checkov

# Optional: Create a symlink for easy access
sudo ln -s /path/to/venv/checkov/bin/checkov /usr/local/bin/checkov

brew install checkov

source <(register-python-argcomplete checkov)

pip3 install -U checkov

brew upgrade checkov

checkov --directory /user/path/to/iac/code

checkov --file /user/tf/example.tf

checkov -f /user/cloudformation/example1.yml -f /user/cloudformation/example2.yml

terraform init
terraform plan -out tf.plan
terraform show -json tf.plan  > tf.json
checkov -f tf.json

check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled"
	FAILED for resource: aws_s3_bucket.customer
	File: /tf/tf.json:0-0
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning

terraform show -json tf.plan | jq '.' > tf.json

checkov