Checkov

Overview

Checkov is an open-source scanner for infrastructure-as-code files, aimed at developers and infrastructure teams that want to catch security and compliance problems in configuration. Its coverage spans several cloud and deployment formats, while custom policies let teams express checks beyond the built-in library.

The free CLI is a strong fit for teams that need code-level checks without a software charge. Its limits matter: Alpine is not officially supported, and capabilities such as runtime scanning and drift detection belong to Prisma Cloud rather than the standalone Checkov plan.

Explore more Infrastructure as Code Security Software, Infrastructure Testing Tools, and Infrastructure Policy as Code Tools.

Key features

Broad configuration coverage

Checkov scans Terraform, CloudFormation, ARM, Serverless, Helm, Kubernetes, and Docker. That breadth is useful for teams with mixed infrastructure stacks; a library of more than 750 predefined policies gives them a substantial starting point. Checks also cover common standards such as CIS and the AWS Foundations Benchmark.

Custom policies and secrets checks

Teams can write custom attribute policies in Python or YAML, or combine checks into composite policies in YAML. This gives teams a way to encode their own requirements, though authoring and maintaining those policies takes ownership beyond simply enabling built-in checks. Checkov also looks for common credentials in IaC files, including AWS access keys, Azure service credentials, and private keys.

Fits into development workflows

Documented CI integrations include Jenkins, Bitbucket Cloud Pipelines, GitHub Actions, and GitLab CI. Visual Studio Code and JetBrains add-ons provide real-time scanning and inline fixes, bringing feedback closer to where configuration is written. Pull request scanning is supported, but teams seeking runtime scanning, drift detection, native VCS integrations, or pull request annotations need Prisma Cloud, which extends Checkov with those capabilities.

Pricing

Checkov: free. The plan is an open-source CLI under the Apache-2.0 license, making it suitable for individual developers and teams that can run and maintain their own code-scanning workflow. No paid tier or seat-based pricing is part of this plan; Prisma Cloud is a separate extension for broader cloud-security capabilities.

Platforms

Checkov supports Linux and macOS, with installation documented through pip and Homebrew. The project supports Python 3.9 through 3.13. Alpine users need Python 3.11 or later, and Checkov is not officially tested or supported on Alpine, so it is a less dependable choice for teams standardizing on that distribution.

Who it's for

Checkov suits developers and security or infrastructure teams that want a no-cost way to scan IaC across multiple formats, tune policies to their own standards, and connect checks to CI or IDE workflows. It is less suited to teams that need runtime coverage or drift detection in the same offering, or Alpine users who require an officially supported platform. The project directs users to its documentation for tutorials and examples; Prisma Cloud maintains it.

Pros and cons

• Pro: Broad support for IaC formats and more than 750 predefined policies provide a useful baseline across varied stacks.
• Pro: Custom Python and YAML policies, secrets checks, CI integrations, and IDE add-ons support checks from authoring through pull requests.
• Pro: The Apache-2.0 CLI is free, so teams can adopt code scanning without a license charge.
• Con: Runtime scanning and drift detection require Prisma Cloud, so Checkov alone does not cover those needs.
• Con: Alpine requires Python 3.11 or later and is not officially tested or supported.

Alternatives

• audytx is worth considering for teams looking for a freemium API and web option; its Plus plan is $20 a month and includes unlimited repositories, files, and users with 200 scans per month.
• Conftest is a free alternative for teams seeking a policy-testing tool that supports Linux, macOS, and Windows.
• Gomboc AI Code Security Platform may suit teams that want a web, API, or extension-based option with a free Community Edition offering unlimited scans and security fixes, GitHub pull-request remediations, default policy-as-code, basic GitHub reporting, and community support.
• KICS is another free option, with support for Linux, macOS, and Windows.
• AWS CloudFormation is a freemium alternative for teams focused on CloudFormation; the service itself is free, though underlying AWS resources are billed at their own rates.
• KloudSec IaC Security offers a free plan for teams that need a hosted option, with limits of one AWS account, one scheduled scan and one on-demand scan per day, and five code scans and five secrets scans per month.
• DryRun Security IaC Security may be relevant to teams seeking a paid option with pricing aligned to engineering and security team size.
• Trivy is a free, Apache-2.0 licensed scanner for teams that want another open-source option across Linux, macOS, self-hosted, and Windows environments.

Verdict

Choose Checkov if you want a free, customizable IaC scanner with broad format coverage and checks that fit CI and IDE workflows. Look elsewhere if runtime scanning or drift detection is central to your requirements, or if you need a platform officially supported on Alpine.