An infrastructure change can look reasonable while leaving a security group open to the internet. A security scanner checks infrastructure code or planned changes against rules so that problems can be reviewed before they become routine deployments. It complements linters and tests as an automated quality-control safeguard. section 11.1.10 section 7.8
Checkov is an open-source scanner that can review Terraform code and plans, as well as IaC written for Helm and CloudFormation. It can run locally without a central service. Its command-line configuration makes a saved, repeatable command useful: a Make target can run `checkov --directory .` alongside other project checks. section 7.4.1 section 7.8
Listing 7.24 Checkov makefile targets
.PHONY: security
security: test_checkov #1
.PHONY: test_checkov
test_checkov:
checkov --directory . #2
The `security` target delegates to `test_checkov`, which scans the current directory. Keeping the command in the Makefile gives the team one place to update it when scanning options or policies change. section 7.4.1
Treat a finding as a decision to investigate, not an instruction to suppress every warning:
- Fix an unintended setting, such as encryption that should have been enabled. section 7.4.1
- If a flagged setting is intentional, add an exception for that specific rule and document why. Review other findings separately; an exception should not hide unrelated problems. section 7.4.1
Listing 7.25 Checkov adding exceptions
resource "aws_instance" "this" {
ami = "ami-867166b8518f055af"
instance_type = "t3.large"
#checkov:skip=CKV_AWS_88:This instance is meant to be publicly
accessible. #1
associate_public_ip_address = true
}
#1 Checkov exceptions should always include a reason.
The instance deliberately receives a public IP address. Its `checkov:skip` comment identifies the rule and gives a reason that reviewers can inspect later. section 7.4.1
A scanner can also be built around a planned change rather than an existing policy set. A Python command-line example uses Typer and `tofupy` to initialize a module, run a plan, and inspect its changes for a rule violation. The same kind of plan inspection can support rules beyond security, such as pricing checks. section 11.1.10
Find an ingress rule open to the internet
The test module defines an `aws_vpc_security_group_ingress_rule` with `cidr_ipv4 = "0.0.0.0/0"` for TCP port 443. After installing `typer` and `tofupy`, run `python scanner.py ./module`. The command identifies the ingress-rule resource and warns that its source is open to the internet. section 11.1.10
