Exploring Checkov

Checkov is an open source static code analysis tool maintained by Prisma Cloud designed for infrastructure-as-code (IaC).

It helps developers and DevOps teams identify misconfigurations in their files before deployment to cloud environments. By scanning the code for tools such as Terraform, CloudFormation, Kubernetes, and others, including Ansible, Checkov checks against best practices and compliance guidelines, ensuring your infrastructure deployments are secure, efficient, and compliant with industry standards before it is deployed.

Important note

You may have noticed that Ansible is mentioned as “others” in the preceding description; that is because support for Ansible was only just introduced at the time of writing this in early 2024. Because of this, while we will be looking at Checkov during this chapter, we will not be going into as much detail about Checkov or the second tool, Kics.

Before we run our scan, we need a playbook; open...