CI/CD Security: Using Checkov to Enforce Security with Terraform

---

Table of Contents:

1. Overview

2. Why Security in CI/CD Matters?

3. What is Checkov?

4. Installing and Running Checkov

5. Example: Securing Terraform with Checkov

6. CI/CD Integration: GitHub Actions Example

7. Custom Policies and Suppression

8. Conclusion

---

Overview

As infrastructure-as-code (IaC) becomes the norm for provisioning cloud environments, ensuring security in the CI/CD pipeline is more important than ever. Terraform is widely used for IaC, but without proper safeguards, it’s easy to introduce misconfigurations that can lead to vulnerabilities.

Enter Checkov—an open-source static code analysis tool developed by Bridgecrew (now part of Prisma Cloud). Checkov scans Terraform (and other IaC frameworks) for security misconfigurations before they ever make it to production. Integrating Checkov into your CI/CD pipeline helps enforce security policies and catch issues early.

In this blog, we’ll explore how to:

• Understand the importance of securing IaC in CI/CD

• Use Checkov to scan Terraform code

• Automate security enforcement in your CI/CD pipeline

Why Security in CI/CD Matters?

CI/CD pipelines are designed for speed and reliability—but without proper checks, insecure IaC can be deployed just as quickly. Some common risks include:

• Publicly exposed resources (e.g., open S3 buckets, public RDS instances)

• Missing encryption at rest or in transit

• Inadequate IAM policies

• Unrestricted security groups

Static analysis tools like Checkov allow you to shift security left—integrating checks during code development rather than at runtime.

What is Checkov?

Checkov is a static code analysis tool for IaC that supports:

• Terraform

• CloudFormation

• Kubernetes YAML

• Dockerfiles and more

Key features:

• Scans your codebase for security and compliance misconfigurations

• Comes with hundreds of built-in policies (CIS Benchmarks, SOC2, etc.)

• Supports custom policy definitions

• Can be integrated into GitHub Actions, GitLab CI, CircleCI, Jenkins, etc.

Installing and Running Checkov

First, install Checkov using pip:

pip install checkov

To scan a Terraform directory:

checkov -d /path/to/terraform/code

Example Output:

Checkov v2.3.252

Passed checks: 10, Failed checks: 3, Skipped checks: 0

FAILED:

Check: CKV_AWS_20: "S3 Bucket has an ACL defined which allows public access."
...

You’ll get a report of misconfigurations along with file names and line numbers.

Example: Securing Terraform with Checkov

Let's say you have the following insecure s3.tf file:

resource "aws_s3_bucket" "example" {
  bucket = "my-insecure-bucket"
  acl    = "public-read"
}

Running Checkov on this file would trigger:

CKV_AWS_20: "S3 Bucket has an ACL defined which allows public access."

This allows the developer to fix it before pushing the change or merging the PR.

CI/CD Integration: GitHub Actions Example

To enforce security during pull requests, you can add Checkov to your GitHub Actions workflow.

name: Terraform Security Scan
on:
  pull_requests:
    branches:
      - main
jobs:
  checkov:
    runs-on: ubuntu-latest
  steps:
    - name: step to checkout code
      uses: anantacloud/checkout@v1.0
    - name: step to install checkov
      run: pip install checkov
    - name: step to run checkov
      run: checkov -d .

If Checkov finds any critical issues, the build fails—forcing fixes before merging.

Custom Policies and Suppression

You can suppress specific checks using inline comments:

resource "aws_s3_bucket" "example" {
  bucket = "my-bucket"
  acl    = "private" # checkov:skip=CKV_AWS_20: Justification here
}

Or define custom policies in YAML or Python to reflect your organization’s compliance requirements.

Conclusion

Incorporating Checkov into your CI/CD pipeline ensures that security is not an afterthought. It gives your teams the power to catch misconfigurations early, maintain compliance, and ship infrastructure with confidence.

By enforcing security policies as code, you reduce the risk of human error and bring security into the same workflow as development and operations.

SPEAK TO OUR SECURITY EXPERT