Checkov
Checkov, from Prisma Cloud, reads your IaC files before they are deployed and reports insecure settings, for example a public S3 bucket or an unencrypted volume, with the id of the policy that failed.
Key concepts #
- Policy: a rule such as
CKV_AWS_18. - Skip: suppress a rule with an inline comment and a reason.
- Runs in CI, next to TFLint and Trivy.
Learn it #
See Terraform security scanning with TFLint, Checkov and Trivy.
More tutorials that use Checkov
Related tutorials
Security
HashiCorp Vault
HashiCorp Vault is a secrets manager that stores, generates and encrypts credentials, tokens and keys with fine-grained access control and audit logs.
Security
Trivy
Trivy is an open source security scanner that finds vulnerabilities, misconfigurations and secrets in container images, code and infrastructure files.
Security
cert-manager
cert-manager is a Kubernetes add-on that issues and renews TLS certificates automatically, for example from Let's Encrypt.