Configuring Checkov scans

Overview

Checkov is a static code analysis tool for infrastructure-as-code (IaC). It scans cloud configurations for security and compliance misconfigurations. It ensures:

  • Infrastructure-as-code is aligned with security best practices.
  • Scans for issues like open ports, hardcoded secrets, excessive privileges, and insecure configurations.
  • Works across cloud platforms and container orchestration systems, helping to avoid security risks in the deployment process.

This scan is part of the compliance checks stage available in the PR (app-preview), CI, and CC pipelines.

Enabling and configuring Checkov scans

You can run Checkov scans using two different frameworks:

  • Terraform Plan: Run Checkov scan on a computed Terraform plan. To enable this, add opt-in-checkov as a text property to your pipeline or trigger properties, with a value set to a non-empty string (except 0).
  • Kubernetes: Run Checkov scan on Kubernetes manifests. To enable this, add opt-in-checkov-kubernetes as a text property to your pipeline or trigger properties, with a value set to a non-empty string (except 0). Note: With Code Risk Analyzer (CRA) being deprecated, Checkov Kubernetes scan is an alternative for cra-deploy-analysis that produces com.ibm.code_cis_check evidences.

Enabling these features runs the following scripts from the compliance checks stage:

These scripts automatically install Checkov if it is not already present in the environment.

Checkov parameters

The pipeline environment properties and secrets listed in the following table are used to customize the Checkov scans.

Checkov parameters
Parameter name Description
checkov-args Additional arguments provided directly to the checkov command.
tf-dir Location or path in the source repository where main.tf is located. (Defaults to .)
checkov-version Checkov version to install if not already available in the environment. (Defaults to installing the latest version)
checkov-prisma-api-url The Prisma Cloud API URL. Must be a *.prismacloud.io, *.prismacloud.cn or *.bridgecrew.cloud domain.
checkov-bc-api-key Bridgecrew API key or Prisma Cloud Access Key. Retrieve this using get_secret.

Checkov evidence and attachments

The DevSecOps pipeline uploads evidence to the locker and includes the evidence in the evidence summary for Change Requests.

Checkov Terraform Plan Evidence

The following table lists the evidence details for the Terraform Plan checkov scan.

Checkov Terraform Plan evidence fields and values
Field Value
tool type checkov
evidence type com.ibm.code_vulnerability_scan
asset type repo
attachments Checkov results JSON file
Checkov Kubernetes Evidence

The following table lists the evidence details for the Kubernetes checkov scan.

Checkov Kubernetes evidence fields and values
Field Value
tool type checkov
evidence type com.ibm.code_cis_check
asset type repo
attachments Checkov results JSON file

Accessing your scan results

You can access your scan results by using the following method: