Checkov

Static analysis tool for IaC scanning across Terraform, CloudFormation, Kubernetes, and more.

Free and open-source (Apache 2.0), Prisma Cloud paid

Checkov by Bridgecrew is a static analysis tool for scanning infrastructure as code (IaC) for security misconfigurations. Supports Terraform, CloudFormation, Kubernetes, Dockerfile, ARM templates, Serverless, and Ansible. Includes 1000+ built-in policies for CIS, SOC2, PCI-DSS, and HIPAA compliance. Integrates with CI/CD and IDE.

Best for: Policy & Governance
Pricing: Free and open-source (Apache 2.0), Prisma Cloud paid

Disclosure: We may earn a commission if you click this link and make a purchase, at no additional cost to you.

Visit Checkov

Checkov Hub

Explore Checkov

Compare Checkov With

vs Kyverno vs Open Policy Agent (OPA)

Features

✗

Audit Mode

Report violations without blocking

✗

CI/CD Integration

Policy checks in pipelines

✗

Cost Estimation

Estimate cloud costs before deployment

✗

Custom Policies

Write organization-specific policies

✗

Enforce Mode

Block non-compliant resources

✗

Infrastructure Policy

Enforce policies on Terraform/CloudFormation

✗

Kubernetes Admission Control

Validate/mutate resources at API server admission

✗

Policy Reporting

Dashboard and reports on compliance

✗

Policy as Code

Define policies in version-controlled code

✗

Regulatory Compliance

Pre-built policies for SOC2, HIPAA, PCI-DSS

Best For

Find the right DevOps tools for your specific needs. Checkov is featured in these buying guides:

Best CI/CD Platforms Best for Startups Best for Enterprise Best Free Options Best Open Source Best Security