Checkov (IaC + code)

checkov -d <path>

Scans infrastructure as code (Terraform, CloudFormation, Kubernetes) with Checkov, detecting security misconfigurations.

Run it in the IaC pipeline when you want the infrastructure-as-code analysis: Checkov analyzes the files (Terraform, CloudFormation, Kubernetes, Helm, Dockerfile) and reports the findings — public buckets, open security groups, disabled encryption, excessive permissions — with the policy (CIS, baselines) and severity. It's the reference IaC SAST: misconfiguration detected before the apply. In DevSecOps, Checkov is the IaC pipeline gate: the plan with high-severity findings is blocked before deployment.

Don't use it as a complete infrastructure analysis: Checkov analyzes what's declared in the code — the real cloud state (drift) requires auditing tools (Prowler, 165). Generic policies generate false positives (legitimate contexts): they are triaged and adjusted with the team's baselines. And watch out: the policy framework (checks) gets updated — new checks (recent misconfigurations) require an up-to-date version. Checkov covers IaC; application code is SAST (semgrep, 001).