Freedom251 › Infrastructure Policy as Code Tools
Checkov
What Checkov is
Checkov is a free infrastructure-as-code scanner for finding misconfigurations that may create security or compliance problems. It documents scan support for Terraform, CloudFormation, ARM, Serverless, Helm, Kubernetes, and Docker, with more than 750 predefined policies. Checks include common standards such as CIS and the AWS Foundations Benchmark, and it can detect credentials such as AWS access keys, Azure service credentials, and private keys in IaC files. Users can write custom attribute policies in Python or YAML and composite policies in YAML. Documented CI integrations include Jenkins, Bitbucket Cloud Pipelines, GitHub Actions, and GitLab CI. Visual Studio Code and JetBrains add-ons provide real-time scanning and inline fixes. Installation is documented through pip and Homebrew; Homebrew is specified for macOS or Linux. The project supports Python 3.9 through 3.13 and uses the Apache-2.0 license. Prisma Cloud extends Checkov with runtime scanning, visibility, native VCS integrations, drift detection, and pull request annotations.
Who it suits
It suits teams scanning infrastructure-as-code for configuration issues, credentials, and compliance concerns. Developers can also use its IDE add-ons and CI integrations.
What it does well
- Scans seven documented IaC formats.
- Includes more than 750 predefined policies.
- Supports custom policies in Python or YAML.
- Integrates with four documented CI systems.
- Apache-2.0 licensed open-source CLI.
What to know first
- Alpine requires Python 3.11 or later.
- Alpine is not officially tested or supported.
- Runtime scanning is an extension of Prisma Cloud.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Checkov | Open-source CLI · Apache-2.0 license | Free |
As checkov.io lists them, read 29 Sept 2026. The maker's own page has the final word.
Getting started
- Choose pip or Homebrew for installation; Homebrew is specified for macOS or Linux.
- Install Checkov on Linux or macOS.
- Use the documentation for tutorials and examples.
- Connect scanning with a documented CI integration or use a Visual Studio Code or JetBrains add-on.
Verdict
Checkov offers broad infrastructure-as-code scanning, policy customization, and CI and IDE integrations at no cost. Alpine users should note the project’s stated testing and Python requirements.
Questions
How much does Checkov cost?
The Checkov plan is listed as free, as an open-source CLI under the Apache-2.0 license.
Which infrastructure formats can it scan?
Documented targets include Terraform, CloudFormation, ARM, Serverless, Helm, Kubernetes, and Docker.
Can teams create their own policies?
Yes. Attribute policies can be written in Python or YAML, and composite policies in YAML.
Which CI and IDE integrations are available?
Documented CI integrations include Jenkins, Bitbucket Cloud Pipelines, GitHub Actions, and GitLab CI. Visual Studio Code and JetBrains add-ons provide real-time scanning and inline fixes.
Which operating systems and Python versions are supported?
Checkov lists Linux and macOS platforms and supports Python 3.9 through 3.13. Alpine requires Python 3.11 or later and is not officially tested or supported.
Who maintains Checkov?
The project identifies Prisma Cloud as its maintainer.
Facts from Checkov's own pages
- CI integrations
- The documentation describes integrations with Jenkins, Bitbucket Cloud Pipelines, GitHub Actions, and GitLab CI. · checkov.io, 29 Sept 2026
- Compliance
- Checkov scans for common standards including CIS and the AWS Foundations Benchmark. · checkov.io, 29 Sept 2026
- Custom policies
- Users can create custom attribute policies in Python or YAML and composite policies in YAML. · checkov.io, 29 Sept 2026
- Developer tools
- Checkov offers Visual Studio Code and JetBrains add-ons for real-time IaC scanning and inline fixes. · checkov.io, 29 Sept 2026
- Installation
- The project documents installation through pip and Homebrew; Homebrew is specified for macOS or Linux. · checkov.io, 29 Sept 2026
- License
- The Checkov GitHub repository identifies its license as Apache-2.0. · github.com, 29 Sept 2026
- Platform limitation
- Checkov on Alpine requires Python 3.11 or later and is not officially tested or supported. · checkov.io, 29 Sept 2026
- Policy library
- The Checkov documentation says it includes more than 750 predefined policies. · checkov.io, 29 Sept 2026
- Prisma Cloud
- Prisma Cloud extends Checkov with runtime scanning, visibility, native VCS integrations, drift detection, and pull request annotations. · checkov.io, 29 Sept 2026
- Purpose
- Checkov scans infrastructure-as-code files for misconfigurations that can cause security or compliance problems. · checkov.io, 29 Sept 2026
- Python support
- The repository says it supports Python 3.9 through 3.13 inclusive. · github.com, 29 Sept 2026
- Secrets scanning
- Checkov can detect common credentials such as AWS access keys, Azure service credentials, and private keys in IaC files. · checkov.io, 29 Sept 2026
- Support
- The project directs users to its documentation for tutorials and examples and identifies Prisma Cloud as the maintainer. · github.com, 29 Sept 2026
- Supported IaC
- Documented scan targets include Terraform, CloudFormation, ARM, Serverless, Helm, Kubernetes, and Docker. · checkov.io, 29 Sept 2026
Where Checkov stands on Freedom251
- Infrastructure Policy as Code Tools#8 of 25
- Infrastructure Testing Tools#10 of 28
- IaC Security Scanners#6 of 16
- Infrastructure as Code Security Software#11 of 22