checkov terraform

checkov -d <tf-dir>

Scans Terraform infrastructure as code with Checkov, detecting security misconfigurations before apply.

Run it in the IaC pipeline when you want the analysis of Terraform files: Checkov analyzes .tf (and .tfvars) and reports findings — public buckets, open security groups, disabled encryption, excessive permissions — with the policy (CIS, baselines) and severity. It's the reference IaC scanner (from Bridgecrew): misconfiguration detected before apply. In DevSecOps, Checkov is the gate of the Terraform pipeline: the plan with high-severity findings is blocked before deployment.

Don't use it as a complete analysis: Checkov analyzes what is declared — the real cloud state (drift) is covered by audits (Prowler). Generic policies generate false positives: they are triaged and adjusted (baselines, --skip-check). And note: Checkov covers IaC (Terraform, CloudFormation, K8s) — application code is SAST (001). For specific Terraform analysis, tfsec (045); Checkov is multi-format.