Infrastructure as code makes security review proactive: Checkov scans Terraform code before deployment, helping catch misconfigurations before they become vulnerabilities. It complements human pull-request review and can be used alongside Trivy for additional coverage. section 7.4
Checkov is an open-source, local security scanner for Terraform code, Terraform plans, Helm, CloudFormation, and other infrastructure-as-code formats. It is normally controlled through command-line options rather than a configuration file, so standardized commands—often stored in a Makefile—are important. section 7.4.1
Listing 7.24 Checkov makefile targets
.PHONY: security
security: test_checkov #1
.PHONY: test_checkov
test_checkov:
checkov --directory . #2
A Makefile target provides a repeatable local entry point for running Checkov across a directory. section 7.4.1
Treat Checkov findings as decisions that require review:
- Fix ordinary findings by enabling a required security feature, disabling an unsafe feature, or changing an insecure option. section 7.4.1
- Document an exception only when the configuration is intentional, such as deliberately exposing a public instance or supporting older clients. section 7.4.1
- Review every finding even when one exception is added; ignoring a rule should not replace solving an unexpected problem. section 7.4.1
Intentional public access
An AWS instance that must be publicly accessible can carry a targeted exception such as `#checkov:skip=CKV_AWS_88:This instance is meant to be publicly accessible.` The reason makes the decision understandable to reviewers and auditable later. section 7.4.1
Custom policies extend the built-in checks. YAML is the preferred option for most rules: a policy can reject AWS instance families such as P and G through attribute conditions and regular expressions. Python is available when a policy needs an API call, but adds complexity for ordinary cases. section 7.5.2
Listing 7.31 Checkov YAML example policy
---
metadata: #1
name: "Disable the P and G families of AWS Instances." #2
id: "CKV2_CUSTOM_AWS_1" #3
category: "COST_SAVINGS" #4
definition:
and:
- cond_type: "attribute" #5
resource_types: #6
- "aws_instance"
attribute: "instance_type" #7
operator: "not_regex_match" #8
value: '^p\d\..*$' #9
- cond_type: "attribute" #10
resource_types:
- "aws_instance"
attribute: "instance_type"
operator: "not_regex_match"
value: '^g\d\..*$' #11
The policy listing demonstrates a YAML rule that blocks selected AWS instance families by inspecting the instance_type attribute. section 7.5.2
Listing 7.32 Checkov makefile with remote policies
CHECKOV_OPTIONS:=--external-checks-git https://github.com/ #1
YOUR_ORGANIZATION/custom_policies.git #2
.PHONY: test_checkov
test_checkov:
checkov --directory . $(CHECKOV_OPTIONS) #3
#1 All of the flags should be in a single line.
#2 It’s common to put customizable flags as variables so they can be overridden by users.
#3 Now we add in our options, including the link to our custom policies.
A shared Git repository can provide custom policies to multiple projects through a command-line option embedded in the standard Makefile command. section 7.5.2
