Checkov

No entries match these filters. Clear filters

1. 3.2.499 Jan 25, 2026 · release notes

   Checkov 3.2.499 adds BC_CA_BUNDLE env var for custom CAs and allows secrets checks to be overridden by cortex specific logic

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.2.499 https://github.com/bridgecrewio/checkov.git
   # already have the repo? check out this version:
   $ git checkout 3.2.499

   • Adds BC_CA_BUNDLE environment variable support for custom CA certificates
   • Secrets: Override AWS generic check with cortex specific checks

   2 details in Everything

2. 3.2.466 Aug 25, 2025 · release notes

   Adds aws_vpc_endpoint to RESOURCE_TYPES_JSONIFY for expanded Terraform resource support

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.2.466 https://github.com/bridgecrewio/checkov.git
   # already have the repo? check out this version:
   $ git checkout 3.2.466

3. 3.2.424 May 15, 2025 · release notes

   Checkov 3.2.424 adds a new SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure. check for Terraform resources

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.2.424 https://github.com/bridgecrewio/checkov.git
   # already have the repo? check out this version:
   $ git checkout 3.2.424

4. 3.2.422 May 14, 2025 · release notes

   Checkov 3.2.422 adds --check-secrets-commit-list to scan secrets in a specific list of Git commits

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.2.422 https://github.com/bridgecrewio/checkov.git
   # already have the repo? check out this version:
   $ git checkout 3.2.422

   └──▷ USE IT
   Scan only specific commits for secret leaks without analyzing full history
   shell copy

   checkov --check-secrets-commit-list sha1,sha2,sha3 -d .

   • Adds support for scanning secrets by providing a specific list of Git commit hashes via the new --check-secrets-commit-list CLI flag.
   • Excludes __start_line__ and __end_line__ from the is empty solver in secrets detection.

   2 details in Everything

5. 3.2.420 May 13, 2025 · release notes

   Checkov 3.2.420 adds programmatic access to kustomize resource IDs via a new exported function.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.2.420 https://github.com/bridgecrewio/checkov.git
   # already have the repo? check out this version:
   $ git checkout 3.2.420

   • kustomize.resource_id is now exposed as an exported function, enabling callers to retrieve the Kustomize resource ID programmatically.

   1 detail in Everything

6. 3.2.411 Apr 28, 2025 · release notes

   Checkov 3.2.411 adds Git history secrets scanning and expands CKV2_AWS_5 coverage

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.2.411 https://github.com/bridgecrewio/checkov.git
   # already have the repo? check out this version:
   $ git checkout 3.2.411

   • Adds support for producer consumer patterns in Git history secrets scanning.
   • Extends CKV2_AWS_5 to cover aws_elasticache_serverless_cache.

   2 details in Everything

7. 3.2.408 Apr 24, 2025 · release notes

   Checkov 3.2.408 adds a new Terraform and CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. detection for overly permissive Lambda CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript. configurations.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.2.408 https://github.com/bridgecrewio/checkov.git
   # already have the repo? check out this version:
   $ git checkout 3.2.408

   └──▷ USE IT
   Scan a Terraform directory for the new Lambda CORS check.
   shell copy

   checkov -d ./terraform --check CKV_AWS_123

8. 3.2.390 Mar 19, 2025 · release notes

   Checkov 3.2.390 adds raw Terraform resource nodes to the internal dependency graph

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.2.390 https://github.com/bridgecrewio/checkov.git
   # already have the repo? check out this version:
   $ git checkout 3.2.390

   • terraform module now includes raw tf resources in the build graph

   1 detail in Everything

9. 3.2.383 Mar 11, 2025 · release notes

   Checkov 3.2.383 adds tags enrichment for Serverless scans

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.2.383 https://github.com/bridgecrewio/checkov.git
   # already have the repo? check out this version:
   $ git checkout 3.2.383

10. 3.2.377 Feb 25, 2025 · release notes

    Checkov 3.2.377 adds three new Terraform policies.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.377 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.377

11. 3.2.357 Jan 23, 2025 · release notes

    Checkov 3.2.357 adds initial support for Python 3.13

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.357 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.357

12. 3.2.355 Jan 22, 2025 · release notes

    Adds OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. claims analysis checks for GCP and Azure alongside AWS CKV_AWS_358 update.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.355 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.355

    └──▷ TRY IT
    Scan Terraform configs specifically for the new GCP and Azure OIDC checks.
    copy

    $ checkov -d ./ --check CKV_GCP_125,CKV_AZURE_249

    Ensure AWS OIDC claims meet the updated CKV_AWS_358 requirements.
    copy

    $ checkov -f main.tf --check CKV_AWS_358

    • Adds CKV_GCP_125 detection for OIDC claims in GCP terraform resources
    • Adds CKV_AZURE_249 detection for OIDC claims in Azure terraform resources
    • Updates CKV_AWS_358 rule to enhance OIDC claims analysis for AWS

    3 details in Everything

13. 3.2.350 Jan 7, 2025 · release notes

    Checkov 3.2.350 adds CKV_AZURE_248 detection for Azure Batch Account network access restrictions

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.350 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.350

    └──▷ TRY IT
    Scan Terraform configurations to ensure Azure Batch Accounts restrict public network access.
    copy

    $ checkov -d . --check CKV_AZURE_248

14. 3.2.345 Dec 31, 2024 · release notes

    Checkov 3.2.345 adds sensitive param detection in CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call., HTTP proxy support for Terraform scans, and a new Azure Cognitive Services detection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.345 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.345

    • Adds CKV_AZURE_1234 detection rule that flags Azure Cognitive Services resources with unrestricted outbound network access

    1 detail in Everything

15. 3.2.342 Dec 18, 2024 · release notes

    Checkov 3.2.342 adds serverless definitions context/graph integration and a Terraform block check

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.342 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.342

    • Adds serverless definitions context for serverless resources
    • Integrates a serverless graph to support relationship-based analysis
    • Adds a new terraform block check capability

    3 details in Everything

16. 3.2.336 Dec 16, 2024 · release notes

    Checkov 3.2.336 adds cortex:skip for suppressions

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.336 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.336

17. 3.2.334 Dec 8, 2024 · release notes

    Adds Serverless graph vertices for infrastructure analysis

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.334 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.334

18. 3.2.332 Dec 5, 2024 · release notes

    Checkov 3.2.332 adds multi-skip inline suppression for Terraform and a new Bedrock check.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.332 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.332

    • Adds support for multi-line skip comments to suppress multiple Checkov checks in Terraform configurations
    • Introduces a new detection rule for AWS Bedrock resources

    2 details in Everything

19. 3.2.326 Dec 2, 2024 · release notes

    Adds new CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. operator for resource ID generation in ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. templates

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.326 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.326

20. 3.2.322 Nov 28, 2024 · release notes

    Checkov 3.2.322 updates range value handling logic

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.322 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.322

    • Updates internal range logic to handle range values correctly

    1 detail in Everything

21. 3.2.317 Nov 26, 2024 · release notes

    Checkov 3.2.317 adds support for the Terraform resource_type attribute in rule evaluations

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.317 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.317

22. 3.2.305 Nov 19, 2024 · release notes

    Checkov 3.2.305 adds Java full dependency tree scanning and a new AWS CodeGuru CMK check

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.305 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.305

23. 3.2.300 Nov 17, 2024 · release notes

    Checkov 3.2.300 adds Azure Synapse ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. policies and enables secrets file masking

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.300 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.300

    • EnrichedSecret class now includes the check_id field, allowing downstream processing to identify which specific policy triggered a secret detection
    • Added support for new security policies covering Azure Synapse ARM templates
    • Helm and Kustomize resources now utilize the Kubernetes graph registry for improved dependency analysis

    3 details in Everything

24. 3.2.296 Nov 14, 2024 · release notes

    Checkov 3.2.296 adds Fn::Sub support for CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. pseudo parameters and a Terraform resource_type attribute

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.296 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.296

    • cloudformation: Support Fn::Sub in cases of using a pseudo parameter

    1 detail in Everything

25. 3.2.293 Nov 13, 2024 · release notes

    Adds resource_type attribute support for Terraform resources in Checkov 3.2.293

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.293 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.293

26. 3.2.286 Nov 10, 2024 · release notes

    Checkov 3.2.286 adds an npm secret detector for scanning package dependencies.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.286 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.286

    • npm detector is now available in the secrets engine

    1 detail in Everything

27. 3.2.275 Oct 30, 2024 · release notes

    Checkov 3.2.275 adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. definition context to improve Azure resource scanning depth

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.275 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.275

    • Adds arm definition context support, enabling deeper inspection of ARM template structures.

    1 detail in Everything

28. 3.2.270 Oct 28, 2024 · release notes

    Checkov 3.2.270 adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. graph edges and custom policy support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.270 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.270

    └──▷ TRY IT
    Scan an ARM template to visualize resource dependencies and validate against custom policies.
    copy

    $ checkov -f main.json --custom-checkov-folder ./custom_policies

    • Adds variable and parameters edges and rendering for ARM templates.
    • Enables custom policy support for Azure Resource Manager (ARM) templates.

    2 details in Everything

29. 3.2.262 Oct 14, 2024 · release notes

    Checkov 3.2.262 adds two new Terraform checks for S3 data transport

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.262 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.262

30. 3.2.256 Oct 1, 2024 · release notes

    Checkov 3.2.256 adds new Terraform checks

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.256 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.256

    • Extends CKV2_AWS_5 to include DMS Serverless resources.

    1 detail in Everything

31. 3.2.253 Sep 12, 2024 · release notes

    Checkov 3.2.253 adds a custom --name flag for scan runs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.253 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.253

    └──▷ USE IT
    Tag your scan output with a specific identifier for tracking across multiple runs or CI jobs.
    shell copy

    checkov --directory ./iac --name 'production-deploy-2023-10'

    • Adds --name CLI argument to customize the tool name field in output metadata

    1 detail in Everything

32. 3.2.245 Sep 4, 2024 · release notes

    Checkov 3.2.245 adds git-sync injection detection policy and terraform_plan provider support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.245 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.245

    • kubernetes: Adds a new policy to detect code injection via git-sync sidecar containers
    • terraform_plan: Enables provider resolution during evaluation of Terraform plan JSON files

    2 details in Everything

33. 3.2.238 Aug 27, 2024 · release notes

    Checkov 3.2.238 adds support for TF cloudsplaining evaluated_keys

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.238 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.238

    • Adds evaluated_keys to terraform's TF cloudsplining integration

    1 detail in Everything

34. 3.2.234 Aug 20, 2024 · release notes

    Checkov 3.2.234 adds SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. scanning support on Windows.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.234 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.234

35. 3.2.228 Aug 15, 2024 · release notes

    Adds --skip-build-policy logic for API methods lacking auth in Checkov 3.2.228

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.228 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.228

    • Enables matching Terraform build policies to run policies specifically for API Gateway methods without authentication

    1 detail in Everything

36. 3.2.219 Aug 5, 2024 · release notes

    Checkov 3.2.219 adds multi-framework support in custom policies and a new RDS encryption-in-transit run policy.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.219 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.219

    • Supports multiple frameworks in one custom policy

    1 detail in Everything

37. 3.2.213 Jul 29, 2024 · release notes

    Checkov adds CKV_AZURE_212 detection for ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. AppServiceInstanceMinimum and CKV_AWS check for AWS Bedrock Agent encryption with CMK

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.213 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.213

    • Adds CKV_AZURE_212 detection for ARM AppServiceInstanceMinimum resource configuration
    • Adds Terraform and CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. policy to ensure AWS Bedrock Agent is encrypted with a Customer Managed Key (CMK)

    2 details in Everything

38. 3.2.208 Jul 25, 2024 · release notes

    Adds --filter-by-provider capability and multiple metadata value support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.208 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.208

    • Adds the ability to filter resources by provider across all resource types (PR #6598)
    • Updates CKV_SECRET_192 check to include GENERIC_PRIVATE_KEY_CHECK_IDS for broader secret detection coverage

    2 details in Everything

39. 3.2.204 Jul 24, 2024 · release notes

    Checkov 3.2.204 adds CKV_AZURE_191 detection for Azure Event Grid Topic managed identity.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.204 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.204

40. 3.2.201 Jul 23, 2024 · release notes

    Checkov 3.2.201 adds 14 new Terraform rules for the TencentCloud provider

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.201 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.201

41. 3.2.199 Jul 22, 2024 · release notes

    Checkov 3.2.199 adds Azure Defender and VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. DNS checks plus prereun for secrets

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.199 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.199

    • Adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. VnetSingleDNSServer check to Validate virtual network single DNS server configuration.
    • Adds Azure key vault prereun option in secrets config to execute logic before multiline pattern scanning.
    • Adds new CKV_AZURE_87 detection to ensure Azure Defender is On for Key Vault.

    3 details in Everything

42. 3.2.196 Jul 21, 2024 · release notes

    Checkov 3.2.196 adds a metadata exception filter for GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. workflows.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.196 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.196

    • Adds metadata exception filter to GHA action
    • Refactors resource type handling internally

    2 details in Everything

43. 3.2.194 Jul 18, 2024 · release notes

    Checkov 3.2.194 adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. checks for AKSEncryptionAtHostEnable, AKSEphemeralOSDisks, and managed disks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.194 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.194

    └──▷ USE IT
    Verify that a VM in an ARM template uses managed disks via the new CKV_AZURE_92 check.
    shell copy

    checkov -f template.json --check CKV_AZURE_92

    • Adds AKSEncryptionAtHostEnable rule for Azure Resource Manager templates to check if AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. host disk encryption is enabled
    • Adds AKSEphemeralOSDisks rule for Azure Resource Manager templates to verify ephemeral OS disk usage in AKS
    • Adds CKV_AZURE_92 rule for Azure Resource Manager templates ensuring Virtual Machines use managed disks

    3 details in Everything

44. 3.2.189 Jul 14, 2024 · release notes

    Checkov 3.2.189 adds two new ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. checks (AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. Paid SKU, Windows VM auto-updates) and updates CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. audit_logs values

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.189 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.189

    └──▷ USE IT
    Enforce AKS paid SKU policy across your ARM templates to ensure SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. coverage.
    shell copy

    checkov -d . --check CKV_AZURE_169

    Verify Windows VMs in your infrastructure definitions have automatic updates enabled.
    shell copy

    checkov -d . --check CKV_AZURE_177

    • Adds CKV_AZURE_169 to enforce AKS clusters use the Paid SKU for SLA compliance
    • Adds CKV_AZURE_177 to ensure Windows VMs have automatic updates enabled
    • Updates valid values for audit_logs in CloudFormation template checks

    3 details in Everything

45. 3.2.186 Jul 11, 2024 · release notes

    Checkov 3.2.186 adds Azure Synapse policies and Bicep custom policy support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.186 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.186

    • bicep_custom_policy_dir config key to load custom policies for Bicep files
    • New detection rules covering Azure Synapse resources in Terraform (*.tf) and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. templates (*.json)

    2 details in Everything

46. 3.2.183 Jul 10, 2024 · release notes

    Checkov 3.2.183 adds tf_plan after_unknown enrichment for terraform_plan analysis.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.183 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.183

47. 3.2.179 Jul 9, 2024 · release notes

    Checkov 3.2.179 adds new Azure ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. checks for storage replication and Synapse Analytics policies.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.179 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.179

    └──▷ TRY IT
    Scan ARM templates for storage replication compliance using the new check ID.
    copy

    $ checkov -d . --check CKV_AZURE_206

    Validate Azure Synapse Analytics policies against the new BCE-33785 rule.
    copy

    $ checkov -d . --check BCE-33785

    • Adds CKV_AZURE_206 to enforce that Azure Storage Accounts use replication
    • Adds BCE-33785 check to validate Azure Synapse Analytics policies

    2 details in Everything

48. 3.2.174 Jul 4, 2024 · release notes

    Checkov 3.2.174 adds seven new Azure Resource Manager detection checks for AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations., API Management, App Service Plan, Azure Search, SQL Database, and Azure Synapse.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.174 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.174

    • Adds CKV_AZURE_172 check to ensure autorotation of Secrets Store CSICSIAn ambiguous acronym spanning Container Storage Interface, Crime Scene Investigation, and other expansions — without more context about which domain this tool operates in, a reliable definition cannot be given. Driver secrets for AKS clusters
    • Adds CKV_AZURE_173 check to ensure API Management uses at least TLS 1.2
    • Adds AppServicePlanZoneRedundant check for ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. templates
    • Adds AzureSearchSLAIndex check for ARM templates
    • Adds SQLDatabaseZoneRedundant check for ARM templates

    +1 more show less

    • Adds new policies for Azure Synapse in the azure detector

    6 details in Everything

49. 3.2.171 Jul 3, 2024 · release notes

    Checkov 3.2.171 adds eight new ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware./Azure security checks (CKV_AZURE and rule IDs)

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.171 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.171

    • Adds CKV_AZURE_171 check for AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. cluster upgrade channel selection
    • Adds CKV_AZURE_175 check for Web PubSub SKU with SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments.
    • Adds CKV_AZURE_178 check for Linux VM SSH key configuration
    • Adds CKV_AZURE_85 check for Azure Defender status on Kubernetes
    • Adds CKV_AZURE_99 check for Cosmos DB restricted access

    +3 more show less

    • Adds DataFactoryNoPublicNetworkAccess check for Data Factory public network access
    • Adds DataLakeStoreEncryption check for Data Lake Store encryption
    • Adds EventHubNamespaceMinTLS12 check for Event Hub Namespace minimum TLS version

    8 details in Everything

50. 3.2.163 Jul 1, 2024 · release notes

    Checkov v3.2.163 adds new ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. checks for API Management public access, App Service PHP version and public access, Key Vault purge protection, and Pub/Sub identity.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.163 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.163

    └──▷ TRY IT
    Scan ARM templates to detect if Azure API Management allows public access or lacks other new security controls.
    copy

    $ checkov -d ./infra --check CKV_AZURE_174,AppServicePHPVersion,AppServicePublicAccessDisabled,KeyVaultEnablesPurgeProtection,PubsubSpecifyIdentity

    • Adds CKV_AZURE_174 check to enforce Azure API Management public access is disabled
    • Adds AppServicePHPVersion check for Azure Resource Manager (ARM) templates
    • Adds AppServicePublicAccessDisabled check for Azure App Service in ARM templates
    • Adds KeyVaultEnablesPurgeProtection check for Azure Key Vault in ARM templates
    • Adds PubsubSpecifyIdentity check for Pub/Sub identity in ARM templates

    5 details in Everything

51. 3.2.156 Jun 27, 2024 · release notes

    Checkov 3.2.156 adds 11 new Azure ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. checks and changes secrets filtering behavior.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.156 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.156

    • Adds CKV_AZURE_129, CKV_AZURE_137, CKV_AZURE_139, CKV_AZURE_166, CKV_AZURE_168, CKV_AZURE_45, and CKV_AZURE_70 detections for Azure Resource Manager templates.
    • Adds ARM rule checks: AppServiceSlotDebugDisabled, AppServiceSlotHTTPSOnly, VnetLocalDNS, PostgressSQLGeoBackupEnabled, and StorageAccountName.

    2 details in Everything

52. 3.2.140 Jun 18, 2024 · release notes

    Checkov 3.2.140 introduces SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. JSON-with-comments parsing support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.140 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.140

    • sca parser now supports JSON files containing comments

    1 detail in Everything

53. 3.2.138 Jun 17, 2024 · release notes

    Checkov 3.2.138 adds resource type allow/deny lists via graph feature

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.138 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.138

54. 3.2.133 Jun 10, 2024 · release notes

    Adds AI_AND_ML category for checking AI and ML workloads in IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup..

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.133 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.133

    └──▷ TRY IT
    Filter checks to only include AI and ML related resources.
    copy

    $ checkov -d . --check-category AI_AND_ML

    • Adds AI_AND_ML to CheckCategories
    • Update CKV IDs for CDK policies

    2 details in Everything

55. 3.2.130 Jun 9, 2024 · release notes

    Adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. policies for Azure security and SageMaker image extraction to Checkov 3.2.130

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.130 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.130

    • Adds CKV_AZURE_135 check to detect missing Log4j2 message lookup prevention in Application Gateway WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server.
    • Adds CKV_AZURE_140 check to ensure Local Authentication is disabled on CosmosDB
    • Adds CKV_AZURE_163 check to verify vulnerability scanning for container images
    • Converts MariaDbPublicAccessDisabled policy to ARM support
    • Adds AKSLocalAdminDisabled check for ARM templates

    +6 more show less

    • Adds AppServiceFTPSState check for ARM templates
    • Adds AzureServiceFabricClusterProtectionLevel check for ARM templates
    • Adds CKV_AZURE_138 check to ensure ACR disables anonymous pulling of images
    • Adds KeyVaultDisablesPublicNetworkAccess check for ARM templates
    • Adds PostgreSQLServerPublicAccessDisabled check for ARM templates
    • Extracts image referencers for AWS SageMaker in Terraform

    11 details in Everything

56. 3.2.128 Jun 6, 2024 · release notes

    Checkov 3.2.128 introduces prioritise_secrets with 3 levels of severity and adds new Terraform policies.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.128 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.128

    • Adds _prioritise_secrets configuration to control secret detection by three levels of severity.
    • Terraform Image Referencer feature now skips CI workflow files by default.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Drop support for .NET v7.0 in Azure scanning.
57. 3.2.124 Jun 2, 2024 · release notes

    Checkov 3.2.124 adds Azure ML workspace and storage account network access policies.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.124 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.124

    └──▷ TRY IT
    Run checkov with the new Azure ML and storage policies enabled.
    copy

    $ checkov -d ./infrastructure --check CKV_AZURE_384,CKV_AZURE_385

    • Adds CKV_AZURE_384 policy to ensure AzureML Workspace network access is properly configured
    • Adds CKV_AZURE_385 policy to ensure Azure Storage Account storing ML workspace data is not publicly accessible

    2 details in Everything

58. 3.2.121 May 31, 2024 · release notes

    Checkov 3.2.121 adds three new Terraform checks for AWS SageMaker and Azure Cognitive Services.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.121 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.121

    • checkov now detects when an AWS SageMaker notebook instance lacks a configured KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. key (check CKV_AWS_...)
    • checkov now verifies that Azure Cognitive Services accounts have local authentication enabled
    • checkov now checks for Identity configuration in Azure Cognitive Services resources

    3 details in Everything

59. 3.2.119 May 30, 2024 · release notes

    Checkov 3.2.119 adds FunctionAppsEnableAuthentication ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. check and expands CKV_AWS_70/Terraf orm coverage

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.119 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.119

    • FunctionAppsEnableAuthentication detection added to the arm check engine

    1 detail in Everything

60. 3.2.112 May 29, 2024 · release notes

    Checkov 3.2.112 adds provider address to Terraform resources and supports count/for_each in data blocks

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.112 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.112

    • Adds provider address to resources in Terraform scan output
    • Supports count & for_each arguments within Terraform data blocks

    2 details in Everything

61. 3.2.106 May 23, 2024 · release notes

    Checkov 3.2.106 adds new Databricks Workspace detection rules and updates detect-secrets engine.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.106 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.106

    • Adds DatabricksWorkspaceDataPlaneToControlPlane check for ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. templates
    • Adds general TF/ARM checks to ensure Databricks Workspaces enable secure configurations

    2 details in Everything

62. 3.2.105 May 22, 2024 · release notes

    Checkov 3.2.105 adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. detections for TLS versions, App Service Java version, and Managed Identity; improves secrets false positives.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.105 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.105

    • Adds CKV_AZURE_145 detection to ensure function apps use the latest TLS encryption version
    • Adds CKV_AZURE_218 detection to ensure Application Gateway defines secure protocols for in-transit communication
    • Adds CKV_AZURE_54 detection to enforce a minimal TLS version for servers
    • Adds CKV_AZURE_71 detection to ensure managed identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. is enabled for web apps
    • Adds CKV_AZURE_72 detection to ensure remote debugging is not enabled for app services

    +5 more show less

    • Adds support for AppServiceJavaVersion check in ARM templates
    • Adds AzureDefenderOStorage check for Azure Defender configuration
    • Adds MySQLPublicAccessDisabled check for restricting public access on Azure MySQL
    • Adds StorageSyncPublicAccessDisabled check for restricting public access on Storage Sync
    • Improves secrets scanner to eliminate false positives in entropy keyword combinator detector

    10 details in Everything

63. 3.2.100 May 21, 2024 · release notes

    Checkov 3.2.100 adds TS-legacy-checks SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. support and entropy limit env variable for secrets scanning

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.100 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.100

    • Adds TS-legacy-checks SAST rule set to enable legacy TypeScript checks
    • Supports configuring the secrets scanning entropy limit via an environment variable

    2 details in Everything

64. 3.2.97 May 19, 2024 · release notes

    Checkov 3.2.97 adds six new ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. policy checks for Azure resources including Automation accounts and Function Apps.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.97 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.97

    • Adds CKV_AZURE_73 check to ensure Azure Automation account variables are encrypted
    • Adds CKV_AZURE_76 check to verify Azure Batch account uses Key Vault for data encryption
    • Adds CKV_AZURE_74 check to ensure Azure Data Explorer (Kusto) uses disk encryption
    • Adds MSSQLServerMinTLSVersion policy for SQL Server configurations

    4 details in Everything

65. 3.2.92 May 15, 2024 · release notes

    Checkov 3.2.92 adds CDK TypeScript policy scanning and Terraform module version tag checks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.92 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.92

    • Adds CDK TypeScript policies support to the SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. engine for new infrastructure-as-code analysis.

    1 detail in Everything

66. 3.2.90 May 9, 2024 · release notes

    Checkov 3.2.90 adds deep-analysis to GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. suppression support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.90 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.90

    • Adds deep-analysis capability to the GitHub Action integration for more thorough Terraform scanning
    • Adds more hype policies for Terraform resource coverage

    2 details in Everything

67. 3.2.84 May 7, 2024 · release notes

    Checkov 3.2.84 enables CDK TypeScript integration testing and fixes secrets/Terraform bugs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.84 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.84

    • Enables CDK TypeScript integration test coverage to the SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. engine

    1 detail in Everything

68. 3.2.82 May 6, 2024 · release notes

    Adds a summary message in the github_failed_only output format

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.82 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.82

69. 3.2.79 May 2, 2024 · release notes

    Checkov 3.2.79 adds TS CDK SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. scanning and Ansible framework support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.79 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.79

    • Adds TS CDK static application security testingstatic application security testingStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. (SAST) to detect issues in TypeScript Cloud Development Kit code.
    • Adds the create_definitions function to the Ansible framework for handling definition files.
    • Adds GCP policy coverage for Terraform resource scanning.

    3 details in Everything

70. 3.2.70 Apr 17, 2024 · release notes

    Checkov 3.2.70 adds TypeScript CDK analysis capability

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.70 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.70

    • sast: Add 5 cdk for TS

    1 detail in Everything

71. 3.2.68 Apr 16, 2024 · release notes

    Checkov 3.2.68 adds extended code block support in SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. scans

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.68 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.68

72. 3.2.60 Apr 10, 2024 · release notes

    Adds TypeScript CDK detection rules for new and existing patterns.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.60 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.60

    • Adds TS CDK policies for newly detected infrastructure-as-code patterns.

    1 detail in Everything

73. 3.2.55 Apr 8, 2024 · release notes

    Adds TypeScript CDK support (part 6), extending SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. coverage.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.55 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.55

    • Extends SAST scanning to include additional TypeScript CDK constructs.

    1 detail in Everything

74. 3.2.42 Mar 20, 2024 · release notes

    Checkov 3.2.42 adds support for SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. skipped checks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.42 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.42

75. 3.2.35 Mar 11, 2024 · release notes

    Adds policy name and guidelines fields to CSV output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.35 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.35

76. 3.2.7 Feb 4, 2024 · release notes

    Checkov 3.2.7 adds Azure storage TLS minimum version check and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. dataflow output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.7 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.2.7

    └──▷ USE IT
    Enforce minimum TLS version for Azure storage accounts during infrastructure scanning.
    shell copy

    checkov -d . --check CKV_AZURE_236

    Include dataflow traces in SAST reports for detailed vulnerability context.
    shell copy

    checkov -f app.py --output sarif --report-type sast --dataflow

    • Adds CKV_AZURE_236 to enforce StorageAccountMinimumTlsVersion for Azure Resource Manager (ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware.) templates
    • Adds dataflow information to SAST analysis output

    2 details in Everything

77. 3.1.50 Dec 31, 2023 · release notes

    Checkov 3.1.50 adds SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. metadata to reports and new Vertex policies

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.50 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.1.50

    • Adds SAST metadata fields to the SAST report output for CDK scans
    • Adds various policies for Google Cloud Vertex AI resources

    2 details in Everything

78. 3.1.46 Dec 28, 2023 · release notes

    Checkov 3.1.46 adds CLI output indication when a running environment repository is discovered.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.46 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.1.46

    └──▷ TRY IT
    Scan a local Terraform directory and explicitly see in the CLI output whether the repository was auto-discovered from the running environment.
    copy

    $ checkov --framework terraform ./tf-module --indicate-repo-in-running-env

79. 3.1.42 Dec 22, 2023 · release notes

    Checkov 3.1.42 splits SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and CDK reports into separate output files.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.42 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.1.42

    • Separates SAST (Source Code) and CDK (Cloud Development Kit) analysis results into distinct report files

    1 detail in Everything

80. 3.1.40 Dec 19, 2023 · release notes

    Checkov 3.1.40 adds PY graph checks for Terraform plan analysis.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.40 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.1.40

81. 3.1.38 Dec 13, 2023 · release notes

    Checkov 3.1.38 adds Python CDK policy detection (batches 3-4)

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.38 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.1.38

    • sast: Adds Python CDK policies batch 3 to the SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. engine

    1 detail in Everything

82. 3.1.33 Dec 11, 2023 · release notes

    Checkov 3.1.33 enables rescanning of commented-out code in SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. analyses

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.33 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.1.33

    • Anchors CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. integration to the last non-breaking version for stability

    1 detail in Everything

83. 3.1.21 Dec 4, 2023 · release notes

    Checkov 3.1.21 adds Ansible CKV_PAN_17 detection and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. integration enablement

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.21 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.1.21

    • Adds CKV_PAN_17 check to detect any source/destination zones in Ansible playbooks
    • Enables SAST scanning via the integration flag rather than requiring a separate mode
    • Adds support for Python-based build-time policies corresponding to PC runtime policies in Terraform
    • Adds support for YAML-based build-time policies corresponding to PC runtime policies in Terraform

    4 details in Everything

84. 3.1.15 Nov 26, 2023 · release notes

    Adds CKV_PAN_16 detection for PAN-OS session logs and exposes import alias data in SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. assets

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.15 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.1.15

    • Adds CKV_PAN_16 check to detect PAN-OS Best Practices Analyzer session log configuration

    1 detail in Everything

85. 3.1.4 Nov 20, 2023 · release notes

    Adds terraform check to ensure Azure Container Registry (ACR) is zone-redundant

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.4 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.1.4

    • Ensures ACR is zone-redundant

    1 detail in Everything

86. 3.0.34 Nov 12, 2023 · release notes

    Checkov 3.0.34 adds the ability to configure parallelization type via new flags or env vars.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.34 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.0.34

    • checkov now accepts configuration to change the parallelization strategy (e.g., threads vs processes) used for scanning.

    1 detail in Everything

87. 3.0.32 Nov 9, 2023 · release notes

    Adds batch 2 of Python CDK policies for SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and --skip-download support in the GitHub Action.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.32 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.0.32

    └──▷ TRY IT
    Run Checkov in a GitHub Action workflow without downloading external dependencies to improve CI speed.
    copy

    $ checkov github-action --skip-download

    • Allows passing --skip-download flag with the github-action

    1 detail in Everything

88. 3.0.24 Nov 6, 2023 · release notes

    Checkov 3.0.24 adds new Python CDK and Kubernetes SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. policies

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.24 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.0.24

89. 3.0.21 Nov 5, 2023 · release notes

    Checkov 3.0.21 adds two new Terraform compliance checks for App Service Environment and replication settings.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.21 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.0.21

    • Adds CKV_AZURE_36 to ensure Azure App Service Environments are configured as zone redundant

    1 detail in Everything

90. 3.0.19 Nov 2, 2023 · release notes

    Checkov 3.0.19 adds reachability function indicators to SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. CLI output and YAML-based buildtime policies for Terraform

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.19 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 3.0.19

    • Adds reachable_functions field to the SCA CLI output to indicate reachable functions in reachability reports
    • Supports YAML-based build-time policies that correspond to PC (Prisma Cloud) runtime policies for Terraform resources

    2 details in Everything

91. 2.5.18 Oct 22, 2023 · release notes

    Checkov 2.5.18 adds skip-frameworks, skip-cve-package & output-bc-ids support in GHA integration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.5.18 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 2.5.18

    └──▷ TRY IT
    Run a scan skipping specific frameworks and CVE packages, outputting Bridgecrew IDs in the GHA workflow
    copy

    $ - uses: bridgecrewio/checkov-action@master
    with:
      directory: .
      skip_framework: cloudformation
      skip_cve_package: openssl
      output_file_path: results.json
      output_file_format: json
      output_bc_ids: true

    • Adds skip-frameworks, skip-cve-package and output-bc-ids GitHub Action input flags

    1 detail in Everything

92. 2.5.15 Oct 19, 2023 · release notes

    Checkov 2.5.15 adds support for Terraform merge function inside jsondecode

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.5.15 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 2.5.15

93. 2.5.11 Oct 17, 2023 · release notes

    Checkov 2.5.11 adds SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. file path resolution relative to the current directory

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.5.11 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 2.5.11

94. 2.5.6 Oct 5, 2023 · release notes

    Checkov 2.5.6 adds CKV_AZURE_95 detection for ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. templates and includes edge data source/target in outputs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.5.6 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 2.5.6

    • Adds CKV_AZURE_95 check for Azure Resource Manager (ARM) templates.
    • Includes source and target fields in edge data output.

    2 details in Everything

95. 2.4.55 Sep 28, 2023 · release notes

    Checkov 2.4.55 adds rustworkx graph processing support to image referencer and core, plus new AWS Terraform policies.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.55 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 2.4.55

    • rustworkx is added as a supported graph processing backend for the general toolchain
    • Image referencer component gains rustworkx support for dependency graph analysis
    • New Terraform detection rules covering two additional AWS security policies are added to the core scan engine

    3 details in Everything

96. 2.4.51 Sep 27, 2023 · release notes

    Checkov 2.4.51 adds new ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware.-specific checks CKV_AZURE_88 and CKV_AZURE_149

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.51 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 2.4.51

    └──▷ TRY IT
    Scan ARM templates to ensure compliance with the new Azure-specific controls.
    copy

    $ checkov -d . --check CKV_AZURE_88,CKV_AZURE_149

    • Adds CKV_AZURE_88 check for Azure Resource Manager (ARM) templates
    • Adds CKV_AZURE_149 check for Azure Resource Manager (ARM) templates

    2 details in Everything

97. 2.4.39 Sep 14, 2023 · release notes

    Checkov 2.4.39 adds CKV2_AZURE_27 ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. policy, deprecated runtime check, and TLS/Ledger terraform policies

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.39 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 2.4.39

    • Implements CKV2_AZURE_27 for ARM templates
    • Adds new policy for deprecated runtimes in Terraform
    • Ensures Event Hub Namespace uses at least TLS 1.2
    • Ensures Ledger feature is enabled on databases requiring cryptographic proof

    4 details in Everything

98. 2.4.33 Sep 12, 2023 · release notes

    Checkov 2.4.33 adds two new Terraform checks for Neptune DB clusters

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.33 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 2.4.33

    └──▷ TRY IT
    Scan Terraform code to detect Neptune instances lacking proper backup retention configurations.
    copy

    $ checkov -d ./ --check CKV_AWS_361

    • Adds the CKV_AWS_361 check to ensure Neptune DB cluster has adequate backup retention

    1 detail in Everything

99. 2.4.32 Sep 10, 2023 · release notes

    Adds Neptune IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. DB auth check and Document DB backup retention detection (CKV_AWS_360)

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.32 https://github.com/bridgecrewio/checkov.git
    # already have the repo? check out this version:
    $ git checkout 2.4.32

    └──▷ TRY IT
    Verify that the check fires for a Neptune cluster without IAM auth enabled
    copy

    $ checkov -d . --check CKV_AWS_284

    Ensure Document DB clusters in your Terraform code have backup retention configured
    copy

    $ checkov -d . --check CKV_AWS_360

    • CKV_AWS_284 added: detects when iam_database_authentication_enabled is not set to true for aws_neptune_cluster resources
    • CKV_AWS_360 added: enforces backup retention period configuration on aws_docdb_cluster resources

    2 details in Everything

100. 2.4.29 Sep 6, 2023 · release notes

     Checkov 2.4.29 adds four new Azure ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. resource checks.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.4.29 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.4.29

     • Adds CKV_AZURE_111 detection for Azure Resource Manager templates
     • Adds CKV_AZURE_134 detection for Azure Resource Manager templates
     • Adds CKV_AZURE_160 detection for Azure Resource Manager templates
     • Adds CKV_AZURE_89 detection for Azure Resource Manager templates

     4 details in Everything

101. 2.4.27 Sep 5, 2023 · release notes

     Checkov now supports downloading modules on-the-fly with a fail-fast option.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.4.27 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.4.27

     • Adds on-the-fly module download capability to scan modules that are not yet present locally
     • Adds support for failing the scan immediately if module download fails

     2 details in Everything

102. 2.4.25 Sep 3, 2023 · release notes

     Adds CKV_AZURE_101, CKV_AZURE_107, and CKV_AZURE_113 detections for ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. template scanning

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.4.25 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.4.25

     • Adds CKV_AZURE_101 detection rule for ARM templates
     • Adds CKV_AZURE_107 detection rule for ARM templates
     • Adds CKV_AZURE_113 detection rule for ARM templates

     3 details in Everything

103. 2.4.22 Aug 31, 2023 · release notes

     Adds four new Azure ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. checks (CKV_AZURE_40, _58, _94, _112)

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.4.22 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.4.22

     • Implements CKV_AZURE_40 detection for Azure ARM resources
     • Implements CKV_AZURE_58 detection for Azure ARM resources
     • Implements CKV_AZURE_94 detection for Azure ARM resources
     • Implements CKV_AZURE_112 detection for Azure ARM resources

     4 details in Everything

104. 2.4.18 Aug 30, 2023 · release notes

     Checkov 2.4.18 adds four new Azure ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. resource detections (CKV_AZURE_100/114/130/151)

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.4.18 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.4.18

     • Adds detection CKV_AZURE_100 for ARM templates
     • Adds detection CKV_AZURE_114 for ARM templates
     • Adds detection CKV_AZURE_130 for ARM templates
     • Adds detection CKV_AZURE_151 for ARM templates

     4 details in Everything

105. 2.4.14 Aug 27, 2023 · release notes

     Checkov v2.4.14 adds new ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware.-based Azure compliance checks for logging and configuration.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.4.14 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.4.14

     • CKV_AZURE_66 implements config logging check for ARM templates
     • CKV_AZURE_65 converted to support ARM resource definitions
     • CKV_AZURE_109 implemented for ARM templates
     • CKV_AZURE_63 implemented for ARM resources
     • CKV_AZURE_80 implemented for ARM resources

     +1 more show less

     • Secrets scanning in git history now correctly identifies the specific resource field

     6 details in Everything

106. 2.4.10 Aug 24, 2023 · release notes

     Checkov 2.4.10 adds new ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. resource checks and a Kubernetes endpoint for Helm/Kustomize

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.4.10 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.4.10

     • Adds CKV_AZURE_50 check to the ARM scanner
     • Translates CKV_AZURE_93 from Terraform to the ARM check catalog
     • Adds new Kubernetes endpoint supporting Helm and Kustomize sources

     3 details in Everything

107. 2.3.358 Aug 6, 2023 · release notes

     Checkov 2.3.358 improves secrets detection precedence so non-entropy signatures take priority over entropy-based matches.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.358 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.358

     • Improves secrets scanning logic to prioritize non-entropy pattern matches over entropy-based detections

     1 detail in Everything

108. 2.3.354 Aug 2, 2023 · release notes

     Checkov 2.3.354 allows passing --var-file via env var and adds an AWS Transfer Server secure protocol policy

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.354 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.354

     └──▷ USE IT
     Inject Terraform variables into the scan process using environment variables instead of command-line arguments for cleaner CI/CD scripts
     shell copy

     export CHECKOV_VAR_FILE=variables.tfvars
     checkov -d .

     • Supports passing the --var-file argument as an environment variable to inject Terraform variables without CLI flags
     • Adds a new detection policy that ensures AWS Transfer server resources are configured to use only secure protocols

     2 details in Everything

109. 2.3.347 Jul 27, 2023 · release notes

     Checkov 2.3.347 adds composer.json SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. support and multi-graph Terraform parsing.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.347 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.347

     • Adds composer.json support to the Software Composition Analysis (SCA) scanner for PHP dependency checking
     • Switches Terraform graph creation to a new multi-graph implementation instead of the previous single-graph approach

     2 details in Everything

110. 2.3.340 Jul 24, 2023 · release notes

     Checkov 2.3.340 adds enrichment for the context key in Terraform definitions

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.340 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.340

     • Enriches the context key within Terraform definition objects to provide additional data for policies and checks.

     1 detail in Everything

111. 2.3.338 Jul 23, 2023 · release notes

     Checkov 2.3.338 adds GCP IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. check and Terraform test scaffolding

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.338 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.338

     └──▷ USE IT
     Use the new GCP check to validate workload identity configurations.
     shell copy

     checkov -d . --check checkov.GCP.IAM.WorkloadIdentityRestricted

     • terraform: add new function to create module and definitions with tests
     • GCP Ensure IAM Workload identity is restricted

     2 details in Everything

112. 2.3.334 Jul 19, 2023 · release notes

     Adds resource code filtering infrastructure to Checkov loggers

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.334 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.334

     • Adds infrastructure for custom code logger filters

     1 detail in Everything

113. 2.3.331 Jul 18, 2023 · release notes

     Checkov 2.3.331 adds CKV_OPENAPI_21 detection rule for OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. specs

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.331 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.331

     • Adds CKV_OPENAPI_21 check to detect issues in OpenAPI specifications

     1 detail in Everything

114. 2.3.329 Jul 17, 2023 · release notes

     Checkov 2.3.329 adds External checks for GitHub branches and a fix command for indirect SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. dependencies.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.329 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.329

     └──▷ USE IT
     Generate remediation code for indirect vulnerabilities identified by the static check analyzer (SCA).
     shell copy

     checkov fix --directory .

     • Adds External checks support in GitHub by enabling scans on specific git branches
     • Adds fix command to Checkov CLI for generating remediation code for indirect SCA dependencies

     2 details in Everything

115. 2.3.326 Jul 16, 2023 · release notes

     Checkov 2.3.326 adds fix code and command to the SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. CVE report output.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.326 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.326

     └──▷ USE IT
     Retrieve remediation commands directly from the SCA JSON/SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. scan results for automated patching.
     shell copy

     checkov -d . --output json | jq '.results.passed[] | select(.check_type == "sca") | .fix_code'

116. 2.3.318 Jul 10, 2023 · release notes

     Checkov 2.3.318 adds UTF-16 encoding support and kustomize origin annotations

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.318 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.318

     • Supports UTF-16 and other encodings in multiple frameworks via PR #5308
     • Adds origin annotations to calculate bases of kustomize checks (#5298)

     2 details in Everything

117. 2.3.316 Jul 9, 2023 · release notes

     Checkov 2.3.316 improves the entropy keyword combinator secret scanner

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.316 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.316

118. 2.3.314 Jul 6, 2023 · release notes

     Checkov 2.3.314 adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. builds for container images and a checkov.spec file for PyInstaller packaging.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.314 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.314

     • Adds ARM build support for the K8s container image, enabling Checkov to run natively on ARM-based Kubernetes clusters
     • Adds checkov.spec to enable building standalone executables using PyInstaller

     2 details in Everything

119. 2.3.309 Jun 29, 2023 · release notes

     Checkov 2.3.309 adds experimental debug output for graph check evaluation.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.309 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.309

     • Adds --graph-debug-output (experimental) to enable verbose logging during graph check evaluations
     • Expands supported package files to include Composer (composer.json, composer.lock) for platform analysis

     2 details in Everything

120. 2.3.306 Jun 27, 2023 · release notes

     Checkov 2.3.306 adds a Terraform module check for commit hash revision usage

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.306 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.306

121. 2.3.299 Jun 21, 2023 · release notes

     Adds KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. key policy validation for Terraform resources

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.299 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.299

     • Added check to ensure kms key policy is defined

     1 detail in Everything

122. 2.3.294 Jun 15, 2023 · release notes

     Adds --skip-path flag to Checkov CLI and includes root package info in SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. CSV SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.294 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.294

     • Includes root package name and version in CSV Software Bill of MaterialsSoftware Bill of MaterialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. (SBOM) output

     1 detail in Everything

123. 2.3.292 Jun 14, 2023 · release notes

     Checkov 2.3.292 adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. handling for SQL retention policy structure.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.292 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.292

124. 2.3.287 Jun 11, 2023 · release notes

     Adds checkov_diff pre-commit hook for scanning changed files

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.287 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.287

     └──▷ USE IT
     Scan only the changed files in a PR to fail CI fast.
     yaml copy

     repos:
       - repo: https://github.com/bridgecrewio/checkov
         rev: v2.3.287
         hooks:
           - id: checkov_diff

125. 2.3.283 Jun 7, 2023 · release notes

     Checkov 2.3.283 adds Azure ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. db servers 2021-05-01 support and marks unresolved Terraform function calls

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.283 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.283

     • Adds checks for ARM Microsoft.Sql/servers resources using the 2021-05-01 API version
     • Terraform parser now marks unresolved function calls as unresolved rather than failing silently

     2 details in Everything

126. 2.3.281 Jun 6, 2023 · release notes

     Adds ability to inspect resource field changes within Python checks for terraform_plan

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.281 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.281

127. 2.3.276 Jun 4, 2023 · release notes

     Checkov 2.3.276 adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. and bicep support for CKV_AZURE_121 and new Terraform checks for Azure Application Gateway and Firewall policies.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.276 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.276

     └──▷ USE IT
     Scan ARM and Bicep templates for the new Azure resource identifier check CKV_AZURE_121.
     shell copy

     checkov -d ./arm-templates --check CKV_AZURE_121

     Verify that Azure Application Gateway resources in your Terraform code enforce secure SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. protocols.
     shell copy

     checkov -d ./terraform-code --check CKV_AZURE_217,CKV_AZURE_218

     • Adds CKV_AZURE_121 check for ARM and bicep templates
     • Adds CKV_AZURE_217 and CKV_AZURE_218 checks to ensure Application Gateway defines secure SSL protocols
     • Adds Terraform checks to ensure Azure firewall sets threatintelMode to Deny
     • Adds Terraform check to ensure Firewall policy is defined
     • Adds Terraform check to ensure Firewall policy has IDPS mode set to deny

     5 details in Everything

128. 2.3.273 Jun 1, 2023 · release notes

     Checkov 2.3.273 adds inline suppression for Ansible graph checks and a --no-upload CLI flag.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.273 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.273

     └──▷ USE IT
     Run Checkov with an API key but prevent the results from being uploaded to the cloud platform.
     shell copy

     checkov -d . --api-key $BRIDGECREW_API_KEY --no-upload

     • Adds --no-upload flag to skip uploading results during API key runs
     • Adds contributor reporting for all API key runs

     2 details in Everything

129. 2.3.261 May 28, 2023 · release notes

     Checkov 2.3.261 adds git_root_path to igraph serialization and file_line_number validation for SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself..

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.261 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.261

     • Added computation of git_root_path to igraph serialization
     • Adding validation for the file_line_number in SCA

     2 details in Everything

130. 2.3.259 May 24, 2023 · release notes

     Checkov 2.3.259 extends CKV2_AWS_5 to new resources and adds IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. limit resource access checks.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.259 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.259

     • Extends CKV2_AWS_5 detection rule to cover additional AWS resources
     • Adds new check for limiting IAM resource access

     2 details in Everything

131. 2.3.257 May 23, 2023 · release notes

     Checkov 2.3.257 adds SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. risk factor v2, secrets pre-commit hook, star resource checks, and Sarif severity levels.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.257 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.257

     • sca: adding the risk factor v2 to the vulnerability details
     • terraform: add check to look at star resources

     2 details in Everything

132. 2.3.251 May 21, 2023 · release notes

     Checkov 2.3.251 adds a JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. detector and YAML-based build-time policies for Terraform.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.251 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.251

     • Adds a JWT detector to the secret runner

     1 detail in Everything

133. 2.3.247 May 18, 2023 · release notes

     Checkov 2.3.247 adds SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. output support and line numbers for CSV/Licenses SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. reports.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.247 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.247

     • Adds SPDX output format for scan results to enable SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation
     • Adds line numbers in CLI CSV output for Software Composition Analysis (SCA) findings
     • Adds line numbers in CLI output for License data in SCA scans

     3 details in Everything

134. 2.3.243 May 15, 2023 · release notes

     Checkov 2.3.243 adds EMR encryption checks and platform graph upload

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.243 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.243

     └──▷ TRY IT
     Scan Terraform code to verify that Amazon EMR clusters have disk and transit encryption enabled.
     copy

     $ checkov -d . --checks EMR-AtRest-LocalDisk-Encryption,EMR-EBS-Encryption,EMR-InTransit-Encryption

     • Adds EMR-AtRest-LocalDisk-Encryption, EMR-EBS-Encryption, and EMR-InTransit-Encryption Terraform detections for Amazon EMR resources.
     • Enables uploading analysis graphs to the Checkov platform via the new graph upload feature.

     2 details in Everything

135. 2.3.234 May 9, 2023 · release notes

     Checkov 2.3.234 adds caller_file_path/line info to reduced reports and two new Terraform detections

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.234 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.234

     • Adds caller_file_path and caller_file_line_range fields to the reduced report format for Terraform checks
     • Adds detection rule CKV_AWS_348: AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. don't generate root credentials
     • Adds detection rule CKV_AWS_347: Ensure Neptune cluster is encrypted with a CMK

     3 details in Everything

136. 2.3.231 May 8, 2023 · release notes

     Adds 2 new Terraform checks for AWS Network Firewall: delete protection and CMK encryption.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.231 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.231

     └──▷ USE IT
     Verify AWS Network Firewalls have delete protection enabled.
     shell copy

     checkov -d . --check CKV_AWS_344

     Audit network firewall encryption configuration for CMK usage.
     shell copy

     checkov -d . --check CKV_AWS_346

     • CKV_AWS_344 adds a check that ensures delete protection is enabled for AWS Firewalls
     • CKV_AWS_346 adds a check ensuring network firewall policies define an encryption configuration using a Customer Managed Key (CMK)

     2 details in Everything

137. 2.3.227 May 7, 2023 · release notes

     Adds support for including missing files in save repository

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.227 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.227

     └──▷ TRY IT
     Ensure repository scanning captures all relevant files, even those previously omitted.
     copy

     $ checkov -d ./tf --save-repository ./output

     • Include missing files when using the --save-repository flag

     1 detail in Everything

138. 2.3.223 May 4, 2023 · release notes

     Checkov 2.3.223 updates Elastic Beanstalk managed update checks for Terraform.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.223 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.223

139. 2.3.220 May 3, 2023 · release notes

     Adds --scan-secrets-history to scan git history for secrets in Checkov v2.3.220.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.220 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.220

     • terraform: Respect the TF_MODULES_FOREACH_ENV_VARS environment variable for module iteration

     1 detail in Everything

140. 2.3.212 Apr 30, 2023 · release notes

     Checkov 2.3.212 adds support for suppressing custom Kubernetes policies

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.212 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.212

141. 2.3.204 Apr 27, 2023 · release notes

     Checkov 2.3.204 adds support for scanning private Terraform registries

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.204 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.204

142. 2.3.194 Apr 23, 2023 · release notes

     Checkov 2.3.194 adds report deserializationdeserializationTurning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution. from JSON and fixes SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. version extraction.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.194 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.194

     • Adds capability to deserialize Checkov reports and records directly from JSON input.

     1 detail in Everything

143. 2.3.192 Apr 20, 2023 · release notes

     Checkov 2.3.192 adds GitHub Action policy metadata filtering and first-commit secrets support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.192 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.192

     └──▷ TRY IT
     Run Checkov in a GitHub Action and filter out policies tagged with experimental metadata.
     copy

     $ - uses: bridgecrewio/checkov-action@v2
       with:
         policy-metadata-filter: '!experimental'

     Scan a repository including secrets that were committed in the very first commit.
     copy

     $ checkov -d . --first-commit-results

     • Adds policy-metadata-filter option to the GitHub Action to allow filtering policies based on metadata labels.
     • Enables checking for secrets found in the repository's first commit via the --first-commit-results flag.

     2 details in Everything

144. 2.3.187 Apr 19, 2023 · release notes

     Checkov 2.3.187 adds support for scanning secrets in hidden file paths and refactors 3D policies syntax.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.187 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.187

     • Adds the ability to detect secrets embedded in hidden files and directories during scans
     • Introduces a refactored syntax structure for 3D policies to improve parsing and maintenance

     2 details in Everything

145. 2.3.183 Apr 18, 2023 · release notes

     Checkov 2.3.183 adds privileged container enforcement and TF provider checks

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.183 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.183

     • Adds terraform check ensuring container definitions are not privileged (PR #4779)
     • Adds support for Terraform provider checks in scanning (PR #4911)
     • Adds is public fix version to SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. reports in SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. analysis (PR #4915)

     3 details in Everything

146. 2.3.176 Apr 17, 2023 · release notes

     Checkov 2.3.176 adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. storage public access check, Dockerfile PIP_TRUSTED_HOST detection, and is private SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. output field

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.176 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.176

     • Adds CKV_AZURE_15 check to disallow public access for Azure Storage accounts in ARM templates
     • Adds new detection CKV2_DOCKER_16 for PIP_TRUSTED_HOST in Dockerfiles
     • Sca output now includes an is_private field indicating if a package is private

     3 details in Everything

147. 2.3.171 Apr 16, 2023 · release notes

     Checkov 2.3.171 adds Terraform for_loop list-of-dicts support; improves secrets scan timing.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.171 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.171

     • Adds support for Terraform for loops that iterate over a list of dicts

     1 detail in Everything

148. 2.3.165 Apr 13, 2023 · release notes

     Checkov 2.3.165 adds four new Terraform detections for ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping., EFS, Fargate, and Transit GatewayTransit GatewayAn AWS-managed network hub that connects VPCs and on-premises networks through a single gateway, replacing complex peering meshes and giving cyber tools a central point to route or inspect cross-network traffic..

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.165 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.165

     • Adds CKV_AWS_333 check to ensure ECS services do not auto-assign public IPs
     • Adds CKV_AWS_329 and CKV_AWS_330 checks to require EFS access points to define a user and a path
     • Adds CKV_AWS_332 check to ensure ECS Fargate tasks use the latest platform version
     • Adds CKV_AWS_331 check to prevent Transit Gateways from being set up to autoaccept any VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware.

     4 details in Everything

149. 2.3.158 Apr 10, 2023 · release notes

     Adds git history secret recording fields

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.158 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.158

     • Add fields to record of secrets in git history

     1 detail in Everything

150. 2.3.155 Apr 9, 2023 · release notes

     Checkov 2.3.155 adds inline suppression support for CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. graph checks and new Terraform detections

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.155 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.155

     └──▷ TRY IT
     Suppress inline graph check violations in a CloudFormation template without disabling the check globally.
     copy

     $ checkov -f cfn_template.yaml --checksuppression CFN_GRAPH_*

     • Adds --checksuppression ability to suppress inline CFN graph checks in CloudFormation templates
     • Adds detection for Aurora DB backtrack configuration requirement
     • Adds detection requiring Desync mode set to defensive or strictest
     • Adds check to ensure RDS clusters are encrypted using a CMK
     • Adds validation for default logging and audit logging settings in RDS cluster definitions

     5 details in Everything

151. 2.3.152 Apr 4, 2023 · release notes

     Checkov 2.3.152 adds CKV2_DOCKER_15 for yum-config-manager sslverify validation

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.152 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.152

     └──▷ USE IT
     Run Checkov against a Dockerfile to detect insecure yum configurations via the new check.
     shell copy

     checkov -f Dockerfile --check CKV2_DOCKER_15

152. 2.3.150 Apr 3, 2023 · release notes

     Adds --build-time-policies to enable yaml based build time policies linked to PC runtime policies

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.150 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.150

     └──▷ USE IT
     Run a scan using specific YAML policies linked to Prisma Cloud runtime rules.
     shell copy

     checkov -d . --build-time-policies /path/to/policies.yaml

     • Supports YAML-based build time policies for corresponding PC (Prisma Cloud) runtime policies

     1 detail in Everything

153. 2.3.148 Apr 2, 2023 · release notes

     Checkov 2.3.148 adds support for non-UTF-8 Kubernetes manifests and new Terraform security checks

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.148 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.148

     • Supports scanning Kubernetes manifest files that are not UTF-8 encoded
     • Adds a detection rule requiring Elasticache for Redis clusters to take minor updates automatically
     • Adds a detection rule ensuring OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. is configured for High Availability
     • Adds a detection rule ensuring Redshift databases specify a name
     • Adds a detection rule enforcing Enhanced VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Routing for Redshift

     5 details in Everything

154. 2.3.140 Mar 30, 2023 · release notes

     Checkov 2.3.140 adds OpenAI integration and a new Terraform check for CloudWatch alarms

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.140 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.140

     • Adds OpenAI integration to allow AI-assisted scanning capabilities.
     • Adds a new detection ensuring CloudWatch alarms are enabled.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The default behavior of CHECKOV_ENABLE_FOREACH_HANDLING is reverted to False, which may change scan performance characteristics for users who relied on the previous True setting.
155. 2.3.134 Mar 29, 2023 · release notes

     Checkov 2.3.134 adds PAN-OS checks, Terraform plan data block support, and foreach handling env var

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.134 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.134

     • Adds CHECKOV_ENABLE_FOREACH_HANDLING environment variable to enable foreach handling in Terraform configurations.
     • Adds ansible: coverage for Palo Alto Networks PAN-OS policy and zone checks.
     • Adds support for parsing data blocks within Terraform plan files.

     3 details in Everything

156. 2.3.128 Mar 28, 2023 · release notes

     Checkov v2.3.128 adds parallel git history scanning for secrets and new Terraform block attribute support.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.128 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.128

     • Run git history scans for secrets in parallel to improve performance.
     • Support the source_module_object_ block attribute in Terraform.
     • Ignore privilege mode enforcement in AWS CodeBuild resources.

     3 details in Everything

157. 2.3.124 Mar 27, 2023 · release notes

     Checkov 2.3.124 adds AWS ASG launch template and CodeBuild log detection for Terraform

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.124 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.124

     • Adds detection for AWS Auto Scaling Group Launch Templates in Terraform
     • Adds detection for AWS CodeBuild project log configuration in Terraform

     2 details in Everything

158. 2.3.121 Mar 26, 2023 · release notes

     Checkov 2.3.121 adds --skip-external-modules-fail warning logging and expands Terraform detection coverage

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.121 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.121

     • Adds a warning log when an external module fetched from Git fails to load, improving observability for complex module sources
     • New Terraform detection: validates that CloudFront distributions have Failover origin configurations defined
     • New Terraform detection: ensures CodeBuild S3 logs are encrypted with KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. keys
     • New Terraform detection: enforces enhanced health reporting for Elastic Beanstalk environments
     • New Terraform detection: requires RDS cluster tags to be copied to snapshots

     +2 more show less

     • New Terraform detection: checks that CloudFront route origins are explicitly authorized
     • Adds support for for_each and count statements within TF Modules, improving coverage of dynamic module usage

     7 details in Everything

159. 2.3.114 Mar 23, 2023 · release notes

     Checkov 2.3.114 adds Ansible panos checks, Terraform Sagemaker/API Gateway detections, and a new TF parser.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.114 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.114

     • Adds ansible integration with panos int mgmt checks for Palo Alto Networks management plane policies
     • Adds Terraform check ensuring API Gateway cache is encrypted
     • Adds Terraform check ensuring Sagemaker Notebook users are not Root
     • Adds Terraform check ensuring Sagemaker Notebook resources are deployed in a Custom VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware.
     • Switches the Terraform runner to use a new TF parser engine

     5 details in Everything

160. 2.3.108 Mar 21, 2023 · release notes

     Checkov 2.3.108 adds --secret-store options to manage external secret configuration via CLI

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.108 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.108

     • Adds --set-secret-store and --get-secret-store arguments to the CLI for configuring and retrieving the current secret store settings

     1 detail in Everything

161. 2.3.105 Mar 20, 2023 · release notes

     Checkov 2.3.105 adds --skip-cert-verify flag and tenant-configurable secrets validation override.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.105 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.105

     └──▷ USE IT
     Scan infrastructure in an environment with self-signed certificates to prevent verification failures.
     shell copy

     checkov --directory ./infra --skip-cert-verify

     • Adds --skip-cert-verify CLI flag to bypass SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. certificate verification when connecting to remote resources
     • Enables overriding the secrets validation setting via tenant configuration (tenant.config) for centralized policy control

     2 details in Everything

162. 2.3.96 Mar 16, 2023 · release notes

     Checkov 2.3.96 adds new security checks for Ansible panos policies and S3 event notifications.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.96 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.96

     └──▷ TRY IT
     Run Checkov against a directory to identify missing panos security policies in your Ansible configurations.
     copy

     $ checkov -d . --check ansible.pan_security_policy

     Scan Terraform code to ensure S3 buckets have event notifications defined.
     copy

     $ checkov -d . --check aws_s3_bucket_event_notifications_enabled

     Verify that S3 bucket failed uploads are configured for automatic deletion.
     copy

     $ checkov -d . --check aws_s3_bucket_failed_uploads_deleted

     • Adds detection of missing Ansible panos security policies via new ansible.pan_security_policy check
     • Adds detection of S3 buckets with event notifications via new aws_s3_bucket_event_notifications_enabled check
     • Adds detection of S3 buckets where failed uploads are not automatically deleted via new aws_s3_bucket_failed_uploads_deleted check

     3 details in Everything

163. 2.3.95 Mar 15, 2023 · release notes

     Checkov 2.3.95 adds environment-variable switch for new TFParser in local graph and YAML policy checks for provider blocks

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.95 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.95

     └──▷ USE IT
     Use the new TFParser for local graph analysis without changing existing defaults.
     shell copy

     CHECKOV_TF_PARSER_V2=1 checkov -d .

     • Adds CHECKOV_TF_PARSER_V2 environment variable to enable the new TFParser in the local graph

     1 detail in Everything

164. 2.3.92 Mar 14, 2023 · release notes

     Checkov 2.3.92 adds inline CVE suppression for requirements.txt and configurable commit history scanning for secrets

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.92 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.92

     • sca: support inline CVE suppression in requirements.txt
     • secrets: allow scanning just partial history of commits

     2 details in Everything

165. 2.3.85 Mar 13, 2023 · release notes

     Checkov 2.3.85 adds multiline git history scanning and new definitions serialization for Terraform.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.85 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.85

     • Adds secrets multiline parser support to scan secrets across git commit history
     • Introduces definitions key/module objects in the Terraform definitions serialization output

     2 details in Everything

166. 2.3.75 Mar 9, 2023 · release notes

     Checkov 2.3.75 adds Terraform JSON support and YAML build-time policies

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.75 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.75

     • Adds --tf-json flag to scan Terraform configurations written in JSON format instead of HCL
     • Adds support for loading build-time policies from YAML files for corresponding PC runtime policies

     2 details in Everything

167. 2.3.70 Mar 7, 2023 · release notes

     Checkov 2.3.70 adds new detection rules for Ansible PAN-OS DSRI, Docker tdnf, AWS RDS deletion protection, and CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. CMK.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.70 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.70

     • Adds CKV_PAN_4 check for Ansible to detect PAN-OS DSRI configurations
     • Adds tdnf support under CKV2_DOCKER_9 in Dockerfile checks
     • Adds AWS Database instance deletion protection check in Terraform
     • Adds CloudtrailEventDataStoreUsesCMK check for CloudTrail Event Data Store encryption

     4 details in Everything

168. 2.3.66 Mar 6, 2023 · release notes

     Checkov 2.3.66 adds -1 SG protocol support and new TF module keys.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.66 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.66

     • Terraform checks now support the -1 protocol for Security Group rules
     • TF Parser added support for new modules keys

     2 details in Everything

169. 2.3.57 Mar 2, 2023 · release notes

     Checkov v2.3.57 adds Ansible dnf checks, Dockerfile checks, and a new TF parser

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.57 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.57

     • Adds checks for the ansible builtin dnf module
     • Creates a new terraform (tf) parser

     2 details in Everything

170. 2.3.53 Mar 1, 2023 · release notes

     Checkov 2.3.53 adds graph support for Terraform foreach_attrs to improve iterator resolution.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.53 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.53

     • terraform: Add foreach_attrs in saved graph
     • terraform: Set foreach_attrs directly under the block
     • terraform: TF foreach - Support updating each.value in nested dict

     3 details in Everything

171. 2.3.48 Feb 27, 2023 · release notes

     Adds YAML build-time policy support in Checkov 2.3.48

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.48 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.48

     • terraform: Adds yaml based build time policies for corresponding PC runtime policies

     1 detail in Everything

172. 2.3.44 Feb 26, 2023 · release notes

     Adds Dockerfile check for NPM_CONFIG_STRICT_SSL environment variable

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.44 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.44

173. 2.3.39 Feb 23, 2023 · release notes

     Checkov 2.3.39 adds Dockerfile checks for package manager signature disabling and new Terraform module model classes

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.39 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.39

174. 2.3.36 Feb 22, 2023 · release notes

     Checkov v2.3.36 adds graph capabilities to ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. framework and secret finding in git history

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.36 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.36

     • Adds arm graph capabilities for infrastructure analysis
     • Supports secret findings within git history scans

     2 details in Everything

175. 2.3.28 Feb 19, 2023 · release notes

     Checkov 2.3.28 adds the --scan-secrets-history flag for CLI secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. history support.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.28 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.28

     └──▷ TRY IT
     Scan the secrets history for a repository instead of just current state.
     copy

     $ checkov --scan-secrets-history .

176. 2.3.23 Feb 18, 2023 · release notes

     Checkov 2.3.23 adds security checks for Ansible's builtin apt module.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.23 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.23

     • Adds detection checks for the Ansible apt built-in module to identify misconfigurations in package management tasks.

     1 detail in Everything

177. 2.3.22 Feb 16, 2023 · release notes

     Checkov 2.3.22 adds CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. registry-url support, git history iteration for secrets scanning, and YAML build-time policies for Terraform.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.22 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.22

     • Adds registry-url field to CycloneDX output reports for SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scans
     • Adds capability to iterate over git history when scanning secrets
     • Adds support for yaml based build time policies corresponding to PC run time policies in Terraform

     3 details in Everything

178. 2.3.18 Feb 15, 2023 · release notes

     Checkov 2.3.18 adds registry URLs and descriptions to SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. output and CSV reports

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.18 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.18

     • Adds registry urls and description fields to SCA output report
     • Adds registry urls and description fields to the csv report

     2 details in Everything

179. 2.3.14 Feb 14, 2023 · release notes

     Checkov 2.3.14 adds UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. filtering for secrets and foreach loop support in Terraform

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.14 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.14

     • Adds log and filter capabilities for potential UUID cases in the secrets detector (secrets)
     • Adds support for processing foreach loops in Terraform configurations (terraform)

     2 details in Everything

180. 2.3.7 Feb 13, 2023 · release notes

     Checkov 2.3.7 adds --secrets line number output, new AWS DocDB/MSK checks, and JSON object support in Terraform

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.7 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.7

     • secrets: Save secrets line number to aid remediation when using the --secrets flag.
     • terraform: Verify MSK nodes are private with a newly added check.
     • terraform: Support more JSON encoded objects in Terraform resource evaluation and fix true/false parsing.

     3 details in Everything

181. 2.3.3 Feb 9, 2023 · release notes

     Checkov 2.3.3 adds foreach_attrs to Terraform config objects and new GCP role checks

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.3 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.3

182. 2.3.0 Feb 9, 2023 · release notes

     Checkov 2.3.0 enables nested Terraform modules by default and refactors GHA graph checks

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.3.0 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.3.0

     • Terraform: nested modules are enabled by default without needing a specific flag.
     • GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. graph checks now use adjusted attribute references for graph-based evaluations.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The GitHub Actions graph check attribute reference has been adjusted, which may break existing custom graph rules that relied on the previous attribute paths.
183. 2.2.356 Feb 8, 2023 · release notes

     Checkov 2.2.356 adds .NET SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. support and expands Terraform resource coverage

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.356 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.356

     • Adds Dotnet file support to the SCA engine for software composition analysissoftware composition analysisSoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. of .NET projects
     • Introduces new resources in Checkov for count/foreach blocks in Terraform configurations
     • Extends CKV2_AWS_5 detection to cover aws_ec2_spot_fleet_request resources

     3 details in Everything

184. 2.2.348 Feb 7, 2023 · release notes

     Checkov 2.2.348 adds CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. S3 encryption support, graph indices, and secrets file config.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.348 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.348

     • Supports new default S3 encryption in CloudFormation templates
     • Adds indices to igraph nodes for graph analysis
     • Add args to analyze line is added and is removed for git history scan
     • Add secrets custom regex on file

     4 details in Everything

185. 2.2.341 Feb 6, 2023 · release notes

     Checkov 2.2.341 adds Ansible blocks support, in-line graph check skips for Kubernetes, and configurable check failure logging

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.341 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.341

     └──▷ USE IT
     Use the new CLI flag to reduce noise from check failures in automated pipelines
     shell copy

     checkov -d . --check-failure-logging-level warning

     • Introduces --check-failure-logging-level CLI flag to control the verbosity of check failure logs
     • Enables in-line skips for Kubernetes graph checks, allowing practitioners to bypass specific detections directly within manifest files
     • Adds validation logic for graph checks to ensure integrity before execution

     3 details in Everything

186. 2.2.335 Feb 5, 2023 · release notes

     Checkov adds support for Kustomize v5 and renders dynamic foreach/count statements in Terraform

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.335 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.335

     • Adds kustomize scanning engine support for Kustomize v5 resources
     • Adds rendering of dynamic foreach and count statements in Terraform configurations

     2 details in Everything

187. 2.2.330 Feb 2, 2023 · release notes

     Checkov 2.2.330 adds --support and --revert CLI flags to SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scanning

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.330 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.330

     └──▷ USE IT
     Use the new support flag to include supporting files or dependencies in your SCA scan.
     shell copy

     checkov --directory . --scan-sca `--support`

     Use the revert flag to undo previous SCA actions or state changes.
     shell copy

     checkov --directory . --scan-sca `--revert`

     • Adds --support flag to the sca command for software composition analysissoftware composition analysisSoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scanning
     • Adds --revert flag to the sca command
     • Enhances secrets scanner output to include working directory (workdir) information

     3 details in Everything

188. 2.2.327 Feb 1, 2023 · release notes

     Adds runnable secrets plugins support, SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. report generation, and GHA workflow permission injection.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.327 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.327

     • sca generates a Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (BOM) report when the extra_resources configuration is non-empty
     • Add support for runnable secrets plugins to extend the secrets detection engine
     • GHA integration automatically injects required permissions lines into GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. workflows
     • terraform: adds cloudsplaining checks CKV_AWS_287 through CKV_AWS_290 for aws_iam_policy resources
     • terraform: adds check CKV_GCP_114 to enforce Public Access Prevention on Google Cloud Storage buckets

     5 details in Everything

189. 2.2.320 Jan 31, 2023 · release notes

     Checkov 2.2.320 adds --support flag to SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. and extends scannable files for Terraform and CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.320 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.320

     • Extends find_scannable_files in SCA to recognize extra package file types

     1 detail in Everything

190. 2.2.316 Jan 30, 2023 · release notes

     Checkov 2.2.316 adds GCP KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. public access detection and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. ignore logic for yarn.lock.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.316 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.316

     • Adds GCP Terraform checks for 'kms policy does not define public access' (#4190)
     • Adds GCP Terraform check that verifies a policy isn't public (#4194)
     • Changes SCA behavior to ignore package.json files when yarn.lock exists

     3 details in Everything

191. 2.2.302 Jan 25, 2023 · release notes

     Checkov 2.2.302 adds igraph library support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.302 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.302

192. 2.2.299 Jan 24, 2023 · release notes

     Checkov adds --image flag for SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scans alongside existing Docker support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.299 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.299

     └──▷ USE IT
     Scan a container image for software composition analysissoftware composition analysisSoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. vulnerabilities using the new concise flag.
     shell copy

     checkov --directory . --image my-app:v1

     • --image: New CLI argument for SCA scanning that works alongside the existing --docker-image flag

     1 detail in Everything

193. 2.2.292 Jan 23, 2023 · release notes

     Adds new app service checks for azurerm in terraform

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.292 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.292

194. 2.2.289 Jan 22, 2023 · release notes

     Checkov 2.2.289 adds Ansible framework support and --repo-root-for-plan-enrichment CLI flag

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.289 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.289

     • Add --repo-root-for-plan-enrichment CLI flag to GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. workflows for deeper context.
     • Add support for the Ansible infrastructure-as-code framework.
     • Add YAML-based build-time policies for corresponding PC runtime policies.

     3 details in Everything

195. 2.2.281 Jan 19, 2023 · release notes

     Adds image referencer igraph support and aiohttp for IR API calls

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.281 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.281

     • Adds igraph support for the image referencer to enable graph-based analysis of container images
     • Supports aiohttp for Image Referencer (IR) API calls, replacing the previous synchronous HTTP client

     2 details in Everything

196. 2.2.278 Jan 18, 2023 · release notes

     Checkov 2.2.278 adds Azure Pipelines image referencer for azure checks

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.278 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.278

197. 2.2.271 Jan 16, 2023 · release notes

     Checkov 2.2.271 adds Dockerfile checks for HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. verification and Azure Search Service/GCP firewall detections

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.271 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.271

     • Adds checks for PYTHONHTTPSVERIFY and NODE_TLS_REJECT_UNAUTHORIZED environment variables in Dockerfiles
     • Adds validation logic to skip invalid secrets checks with support for soft and hard failures
     • Adds new Terraform checks for Azure Search Service resources
     • Adds Terraform checks to detect if a firewall resource is defined for a network in GCP

     4 details in Everything

198. 2.2.254 Jan 10, 2023 · release notes

     Checkov 2.2.254 adds --resource-attributes-to-omit for custom resource filtering

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.254 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.254

     └──▷ TRY IT
     Exclude sensitive or verbose fields like tags or labels from the scanned resource JSON to reduce output noise.
     copy

     $ checkov -f main.tf --resource-attributes-to-omit tags labels

     • Adds --resource-attributes-to-omit argument to omit specific attributes from resource metadata during scanning

     1 detail in Everything

199. 2.2.252 Jan 9, 2023 · release notes

     Checkov 2.2.252 adds secret validation status to reduced reports and improved Kubernetes/Terraform support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.252 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.252

     • kubernetes: support more types of k8s pod template containers
     • secrets: Add secret validation status to reduced report
     • terraform_plan: support multiple references in one resource

     3 details in Everything

200. 2.2.246 Jan 8, 2023 · release notes

     Checkov 2.2.246 adds Dockerfile checks for wget/pip, entropy-based secret detection, and new Terraform rules for AWS and Azure.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.246 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.246

     └──▷ TRY IT
     Detect secrets with lower entropy when they are near sensitive keywords
     copy

     $ checkov -d ./ --checks CKV_SECRET_6 --secret-entropy-threshold 0.5

     Prevent use of the overly permissive IAMFullAccess policy in Terraform plans
     copy

     $ checkov -d ./ --checks CKV2_AWS_51

     Scan Dockerfiles for unsafe wget or pip commands using the new checks
     copy

     $ checkov -d ./Dockerfiles --checks CKV_DOCKER_UNSAFE_WGET,CKV_DOCKER_UNSAFE_PIP

     • secrets engine now supports a configurable lower entropy threshold to trigger detections on lines containing specific keywords
     • Adds CKV_DOCKER_UNSAFE_WGET and CKV_DOCKER_UNSAFE_PIP checks for Dockerfiles that use unsafe wget or pip usages
     • Adds CKV2_AWS_51 check to ensure the AWS Managed IAMFullAccess IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policy is not used in Terraform configurations
     • Adds new Terraform checks for Azure CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. and Service Bus resources (PR #4059)

     4 details in Everything

201. 2.2.238 Jan 5, 2023 · release notes

     Checkov adds unsafe curl detection in Dockerfiles, VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. empty repo handling, and YAML-based build time policies for PC.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.238 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.238

     • Adds dockerfile check for unsafe curl usages
     • Supports YAML based build time policies corresponding to PC run time policies

     2 details in Everything

202. 2.2.234 Jan 4, 2023 · release notes

     Add CHECKOV_RUN_SCA_PACKAGE_SCAN_V2 environment variable and secrets verify API support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.234 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.234

     • Adds CHECKOV_RUN_SCA_PACKAGE_SCAN_V2 environment variable to enable the new SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. package scanning logic
     • Integrates secrets verification via the remote secrets verify API

     2 details in Everything

203. 2.2.229 Jan 1, 2023 · release notes

     Checkov 2.2.229 adds GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. existing graph support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.229 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.229

204. 2.2.217 Dec 28, 2022 · release notes

     Checkov v2.2.217 adds new Azure Storage and OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. checks

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.217 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.217

     • Adds new checks for Azure Storage resources in Terraform scans.
     • Adds checks for OpenAPI specification version 2 (swagger.json) files.

     2 details in Everything

205. 2.2.212 Dec 27, 2022 · release notes

     Checkov 2.2.212 adds Azure Key Vault public network access check

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.212 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.212

     └──▷ USE IT
     Scan Terraform templates to ensure no Azure Key Vaults allow public network access.
     shell copy

     checkov -d . --check azure.keyvault.public_network_access

206. 2.2.207 Dec 26, 2022 · release notes

     Checkov 2.2.207 adds Kubernetes graph edges for nested Pod resources and retains original secrets data at runtime.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.207 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.207

     • kubernetes: Support graph edges for nested (related) Pod resources
     • secrets: Keep original secrets data in runtime for further validation

     2 details in Everything

207. 2.2.199 Dec 22, 2022 · release notes

     Adds GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. directive support, IDE SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scanning via old package scan, and limited secret value exposure

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.199 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.199

     • Adds support for the on directive in GitHub Actions workflow files for Checkov integration
     • Enables running the legacy package scanning logic (sca) specifically during IDE scans
     • Exposes up to 6 characters of detected secret values in findings output

     3 details in Everything

208. 2.2.191 Dec 21, 2022 · release notes

     Checkov 2.2.191 adds GCP Terraform Image Referencer resources to SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scanning

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.191 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.191

209. 2.2.186 Dec 20, 2022 · release notes

     Checkov v2.2.186 improves JSONPathJSONPathA query language for extracting values from JSON documents, modeled after XPath for XML. Cyber tools use it to pinpoint specific fields in structured data without parsing the whole document manually. error handling and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. exit codes

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.186 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.186

     • jsonpath error handling moved to a higher level in Checkov to catch more exceptions

     1 detail in Everything

210. 2.2.180 Dec 19, 2022 · release notes

     Checkov 2.2.180 adds --no-fail-on-crash CLI flag and check details in Terraform Plan results.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.180 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.180

     • Adds the --no-fail-on-crash flag to gracefully exit on internal errors during commit_repository and setup_bridgecrew_credentials operations
     • Includes detailed check information in Terraform Plan scan output for better visibility into findings
     • Adds new Azure App Configuration checks (azurerm provider) in the Terraform scanning engine

     3 details in Everything

211. 2.2.172 Dec 18, 2022 · release notes

     Adds --no-fail-on-crash CLI flag to prevent exit code on internal errors

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.172 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.172

     └──▷ USE IT
     Allow CI pipelines to complete even if Checkov encounters an unexpected internal crash, ensuring downstream steps run.
     shell copy

     checkov -d ./infra --no-fail-on-crash

     • no-fail-on-crash: Add no-fail-on-crash flag

     1 detail in Everything

212. 2.2.168 Dec 15, 2022 · release notes

     Checkov 2.2.168 adds CKV NCP rules for Azure ASG/LB/Nat/Route and Image Referencer for Terraform plan files.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.168 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.168

     • terraform: add CKV NCP rules about AutoScalingGroup, Load Balancer
     • terraform: add CKV NCP rules about Nat Gateways and Route

     2 details in Everything

213. 2.2.158 Dec 14, 2022 · release notes

     Checkov 2.2.158 adds GitHub CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. checks and YAML-based build time policies

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.158 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.158

     • Adds more CIS checks for GitHub to the standard detection suite.
     • Enables yaml based build time policies to correspond with PC run time policies.

     2 details in Everything

214. 2.2.155 Dec 13, 2022 · release notes

     Checkov 2.2.155 expands CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. check coverage and enhances Kubernetes detection context

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.155 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.155

     • Adds more CIS checks for GitHub in the github framework

     1 detail in Everything

215. 2.2.148 Dec 12, 2022 · release notes

     Checkov 2.2.148 adds GHA graph infrastructure, JSONPathJSONPathA query language for extracting values from JSON documents, modeled after XPath for XML. Cyber tools use it to pinpoint specific fields in structured data without parsing the whole document manually. queries for Terraform plan IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policies, and indirect CVE fix versions in SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself..

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.148 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.148

     └──▷ USE IT
     Use JSONPath to query specific fields in AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. policies within a Terraform plan file.
     shell copy

     checkov -f plan.json --evaluate-variables --jsonpath "$.Resource[*].Policy.Statement[] | select(@.Effect == 'Allow')"

     • Supports jsonpath queries in AWS IAM policy strings when analyzing Terraform plans
     • Adds indirect CVE fix versions to Software Composition Analysis (SCA) results

     2 details in Everything

216. 2.2.139 Dec 11, 2022 · release notes

     Checkov 2.2.139 adds graph-based privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. checks for Kubernetes and not_within solver support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.139 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.139

     • Adds not_within attribute solver for graph checks to enable complex graph-based rule logic
     • Adds CKV2_K8S_2 detection for privilege escalation via nodes/proxy or pods/exec with create permissions
     • Adds CKV2_K8S_3 detection preventing impersonate permissions on ServiceAccount/Node resources
     • Adds CKV2_K8S_4 detection to block modification of services/status objects
     • Adds CKV2_K8S_5 detection to prevent service accounts or nodes from reading all secrets

     +1 more show less

     • Enables acceptance of JSON reports in the secrets_omitter feature

     6 details in Everything

217. 2.2.130 Dec 8, 2022 · release notes

     Checkov 2.2.130 adds policy-level suppressions as skipped checks, three new CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. checks, CKV2_K8S_1, and report-based secrets omission

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.130 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.130

     • Add CIS 1.1.3, CIS 1.1.8, and CIS 1.1.10 checks for GitHub configurations
     • Added detection rule CKV2_K8S_1 to ensure RoleBinding do not allow privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. to a ServiceAccount/Node
     • Omit secrets from reports based on secrets reports

     3 details in Everything

218. 2.2.124 Dec 7, 2022 · release notes

     Checkov 2.2.124 adds nested Terraform module graph support, SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. dependency structure output, and configurable secret check length.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.124 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.124

     • terraform: Support for nested modules is now built into the resource graph
     • sca packages output now includes the dependencies structure

     2 details in Everything

219. 2.2.116 Dec 6, 2022 · release notes

     Checkov v2.2.116 adds insecure protocol checks, K8s graph env vars, and dynamic block loop support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.116 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.116

     • Adds CKF_DISABLE_K8S_GRAPH, CKF_ENABLE_K8S_GRAPH, and other related environment variables to control Kubernetes graph features.
     • Adds checks for insecure protocols in Terraform configurations.
     • Adds checks for public access on resource-based policies in Terraform.
     • Adds support for dynamic blocks with loop logic in the for_each attribute for Terraform.

     4 details in Everything

220. 2.2.114 Dec 4, 2022 · release notes

     Adds CKV NCP rules for nCloud access control group rules in Checkov

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.114 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.114

221. 2.2.112 Dec 1, 2022 · release notes

     Checkov 2.2.112 adds Dockerfile graphing, relative path support for TF plan, and new NCP rules

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.112 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.112

     • Adds CKV_NCP_0XX detection coverage for cloud access control group inbound rules via Terraform scanning.
     • Enables use of a graph representation in Dockerfiles to improve dependency analysis.
     • Supports relative file paths in Terraform plan files to allow portable execution environments.

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !enable_secret_scan_all_files is no longer required for custom secrets scanning configuration.
222. 2.2.105 Nov 29, 2022 · release notes

     Checkov 2.2.105 adds new Terraform checks for NCP load balancer HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate., server public IP, and ACR retention policy.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.105 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.105

     • terraform: add CKV NCP rules about Load Balancer Listener Using HTTPS
     • terraform: add CKV NCP rules about server instance and public IP
     • terraform: azurerm ACR check for retention policy

     3 details in Everything

223. 2.2.99 Nov 27, 2022 · release notes

     Checkov 2.2.99 adds new CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. checks for GitHub and Azure ACR image security rules

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.99 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.99

     • Adds CIS checks part 1 for GitHub resources (PR #3937)
     • Adds Terraform check: Azure ACR Enable Image Quarantine (PR #3925)
     • Adds Terraform check: Azure use signed image in ACR (PR #3923)

     3 details in Everything

224. 2.2.84 Nov 22, 2022 · release notes

     Checkov 2.2.84 adds Terraform multiline secrets handling and cross-module edge support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.84 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.84

     • Terraform parser now handles multiline secret strings in checkov scans

     1 detail in Everything

225. 2.2.78 Nov 20, 2022 · release notes

     Checkov 2.2.78 adds CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. JSON output and source attribution to contributor metrics

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.78 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.78

     └──▷ TRY IT
     Generate CycloneDX JSON for software bill of materialssoftware bill of materialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. integration.
     copy

     $ checkov -d ./ --output cyclonedx_json -o output.json

     • Adds cyclonedx_json as a new supported output format.
     • Adds source attribution data to the contributor metrics report.

     2 details in Everything

226. 2.2.72 Nov 16, 2022 · release notes

     Checkov 2.2.72 adds --sca-cli-scan-id CLI flag for SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scan correlation and new Terraform graphing logic.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.72 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.72

     • Add support for the scaCliScanId parameter to correlate SCA scans across distributed environments
     • Enhance Terraform analysis by creating cross-variable edges between resources within the same module to improve dependency tracing
     • Improve Terraform tfplan graph output by censoring secret values before rendering

     3 details in Everything

227. 2.2.65 Nov 15, 2022 · release notes

     Checkov 2.2.65 adds GovCloud S3 support, SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. repoId query param, and polling API for scan results.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.65 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.65

     • Adds s3 client configuration support for AWS GovCloud environments in the general platform module
     • Adds repoId query parameter to the SCA GET request endpoint for repository identification
     • Enables asynchronous SCA scan result retrieval via the Polling API instead of synchronous waits

     3 details in Everything

228. 2.2.58 Nov 14, 2022 · release notes

     Checkov 2.2.58 adds larger/less-than/equal operators for number_of_words and masks secrets in Terraform plan reports.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.58 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.58

     • number_of_words now supports >, <, and <= operators for text length checks
     • Secret values in Terraform plan file JSON reports are masked per resource

     2 details in Everything

229. 2.2.50 Nov 13, 2022 · release notes

     Adds reporting contributor metrics and CKV NCP rules for Terraform access key hardcoding

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.50 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.50

     • Adds reporting contributor metrics via [#3823](https://github.com/bridgecrewio/checkov/pull/3823)
     • Adds CKV NCP rules about access key hardcoding in Terraform resources
     • Changes NSGRulePortAccessRestricted rule to no longer require a condition for dynamic blocks

     3 details in Everything

230. 2.2.38 Nov 9, 2022 · release notes

     Checkov 2.2.38 adds abstract multiline parser for secrets and nested dynamic module support in Terraform.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.38 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.38

     • Adds an abstract multiline parser and a concrete multiline JSON parser to the secrets detection engine.

     1 detail in Everything

231. 2.2.35 Nov 8, 2022 · release notes

     Checkov 2.2.35 adds dynamic block support and new NCP rules

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.35 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.35

     • dynamic_blocks env var enables rendering of Terraform Dynamic Blocks for policy evaluation
     • Support for CKV_NCP_1 (LBTargetGroupUsingHTTPS) and CKV_NCP_2 (NASEncrytionEnabled) rules in the NCP framework
     • SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scan execution now supports running package scans via the external API

     3 details in Everything

232. 2.2.31 Nov 7, 2022 · release notes

     Checkov 2.2.31 adds Azure pipeline resource naming, GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. graph support, Terraform dynamic module map handling, and a new SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. package scan engine

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.31 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.31

     • Adds get_resource_names for azure_pipelines resources to extract explicit resource names during scanning
     • Adds support for rendering the dependency graph in GitHub Actions output reports
     • Adds CKV NCP rule CKV_AZURE_LBListenerUsesSecureProtocols to detect insecure load balancer listeners in Terraform configurations
     • Enables dynamic module processing when source maps use map types instead of literal HCL blocks
     • Extends kubernetes_pod checks to include pods derived from kubernetes_deployment resources across multiple resource graphs

     +1 more show less

     • Adds a new SCA package scan engine that extracts Checkov check links for discovered dependencies

     6 details in Everything

233. 2.2.21 Nov 3, 2022 · release notes

     Checkov 2.2.21 adds range_includes operator and multiline secret detection

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.21 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.21

     • Adds range_includes operator for policy evaluation logic
     • Enables the inverted operator alongside existing comparison operators
     • Adds multiline detection capability to the entropy keyword combinator for secrets scanning

     3 details in Everything

234. 2.2.17 Nov 2, 2022 · release notes

     Checkov 2.2.17 adds CKV_AWS_276 detection for API Gateway data trace settings.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.17 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.17

     └──▷ TRY IT
     Identify API Gateways with data tracing enabled for compliance or cost control.
     copy

     $ checkov -d . --check CKV_AWS_276

235. 2.2.15 Oct 31, 2022 · release notes

     Adds GitHub webhook separation, GitLab image detection check, and OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. JSON pre-validation in v2.2.15

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.15 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.15

     • Splits GitHub repo and org webhooks to separate files via PR #3764
     • Pre-validates OpenAPI JSON files before processing in PR #3760

     2 details in Everything

236. 2.2.8 Oct 30, 2022 · release notes

     Adds CKV2_AWS_40 detection for full IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. privileges and resource filtering logic

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.8 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.8

     └──▷ TRY IT
     Detect overly permissive IAM policies in Terraform code using the new check ID.
     copy

     $ checkov --check CKV2_AWS_40 .

     • Adds CKV2_AWS_40 check to detect AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. policies that allow full IAM privileges
     • Filters taggable resources when retrieving them from the platform for policy evaluation

     2 details in Everything

237. 2.2.5 Oct 27, 2022 · release notes

     Checkov v2.2.5 adds graph module support, NCP Network ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. rules, and for_each list resolution

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.5 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.5

     • Adds graph check support for modules (graph)
     • Adds CKV NCP rules about Network ACL (terraform)
     • Adds TF Dynamic Blocks support for for_each lists type (terraform)

     3 details in Everything

238. 2.2.0 Oct 26, 2022 · release notes

     Checkov 2.2.0 adds CKV NCP rules for block storage, VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. volume encryption, and Network ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. alongside new checks for AWS managed admin policies.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.2.0 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.2.0

     • Add CKV NCP rule about block storage encryption
     • Add CKV NCP rule about vpc volume encryption
     • Add CKV NCP rules about Network ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource.
     • Create checks for aws managed admin policy

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The github_failed_only output suffix changes to .md
     • !Dependant variable check results now return UNKNOWN instead of previous values in Python based checks
     • !Unrendered values in graph checks now return UNKNOWN
239. 2.1.294 Oct 25, 2022 · release notes

     Checkov v2.1.294 adds Kubernetes label selector edge builder and new Terraform NCP rules

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.1.294 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.1.294

     • kubernetes: Added a label_selector edge builder to programmatically construct label-based resource filters for Kubernetes checks.
     • terraform: Added new CKV NCP rules that detect insecure access control group inbound rules.
     • terraform: Extended Terraform Kubernetes checks to cover versioned Kubernetes resources.

     3 details in Everything

240. 2.1.290 Oct 24, 2022 · release notes

     Checkov 2.1.290 adds CircleCI image reference checking via a new mixin class

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.1.290 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.1.290

241. 2.1.286 Oct 23, 2022 · release notes

     Adds graph equals/not_equals_ignore_case operators for conditional logic in checks

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.1.286 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.1.286

     • Adds equals and not_equals_ignore_case solvers to the graph module for flexible value comparison

     1 detail in Everything

242. 2.1.277 Oct 19, 2022 · release notes

     Adds CKV NCP rules for access control group outbound rules and versioned Kubernetes resource checks to Terraform.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.1.277 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.1.277

     • Adds CKV NCP rules about access control group outbound rule detection for Terraform resources
     • Adds support for versioned Kubernetes resources in Terraform Kubernetes checks

     2 details in Everything

243. 2.1.273 Oct 18, 2022 · release notes

     Checkov 2.1.273 adds multiple SCIA framework result merging and kustomize optimization

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.1.273 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.1.273

     • sca: Enable multiple image referencer framework results in the same scan
     • terraform: add versioned kubernetes resources to terraform kubernetes checks (1/5)

     2 details in Everything

244. 2.1.266 Oct 11, 2022 · release notes

     Checkov 2.1.266 adds Azure Pipelines framework support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.1.266 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.1.266

245. 2.1.258 Oct 6, 2022 · release notes

     Checkov 2.1.258 adds Dockerfile Image Referencer support for vulnerability scanning.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.1.258 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.1.258

246. 2.1.254 Oct 3, 2022 · release notes

     Checkov 2.1.254 adds --image-referencer CLI support and custom graph check guideline fields.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.1.254 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.1.254

     • sca: support Image referencer in CLI - Enables the Image Referencer feature directly via command-line invocation
     • graph: add support for guideline field to custom graph checks - Allows custom graph checks to include a guideline metadata field

     2 details in Everything

247. 2.1.247 Oct 2, 2022 · release notes

     Checkov 2.1.247 adds an -r flag for extra resources and two NCP Terraform checks

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.1.247 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.1.247

     • Adds CKV_NCP_1 detection to check LB target group health configurations.
     • Adds CKV_NCP_2 detection to validate access control group descriptions.
     • Expands the serverless and dockerfile scanners to include extra resources by default.

     3 details in Everything

248. 2.1.242 Sep 29, 2022 · release notes

     Adds resources mappings for roles objects in Kubernetes support.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.1.242 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.1.242

     └──▷ BREAKING ON UPGRADE

     • !Switch from black-list to block-list terminology (PR #3581)
249. 2.1.236 Sep 28, 2022 · release notes

     Checkov 2.1.236 adds OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. HTTP check, SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. Kubernetes support, and Lambda code-signing validation.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.1.236 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.1.236

     └──▷ TRY IT
     Scan an OpenAPI spec for HTTP usage in paths using the new detection rule.
     copy

     $ checkov -f openapi.yaml --check CKV_OPENAPI_7

     Validate that AWS Lambda functions use code-signing via the new Terraform check.
     copy

     $ checkov -d . --check CKV_AWS_272

     • entrypoint.sh now enforces rules at container startup
     • Adds CKV_OPENAPI_7 detection for insecure HTTP paths in OpenAPI specs
     • Adds CKV_AWS_272 to validate AWS Lambda function code-signing
     • Adds new GCP PostgreSQL checks in the Terraform engine

     4 details in Everything

250. 2.1.226 Sep 22, 2022 · release notes

     Adds GitlabCI ImageReferencer detection for container image tagging issues

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.1.226 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.1.226

     • Adds GitlabCI ImageReferencer support to detect untagged or latest images in GitLab CI configurations.

     1 detail in Everything

251. 2.1.223 Sep 21, 2022 · release notes

     Checkov 2.1.223 introduces ComplexSolver run time improvements and the ability to create complex Kubernetes vertices for enhanced cluster scanning coverage.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.1.223 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.1.223

     • Introduces ComplexSolver optimizations that reduce run time for large or deeply nested configurations
     • Enables creation of complex Kubernetes (k8s) vertices during scanning, allowing Checkov to model and analyze more intricate K8s resource structures

     2 details in Everything

252. 2.1.219 Sep 20, 2022 · release notes

     Checkov 2.1.219 adds CKV_AWS_197 and splits PRESENT_CACHED_RESULTS into two feature flag env vars

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.1.219 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.1.219

     • PRESENT_CACHED_RESULTS environment variable split into two separate feature flags to control caching behavior

     1 detail in Everything

253. 2.1.214 Sep 19, 2022 · release notes

     Checkov 2.1.214 adds K8SEdgeBuilder base class and SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. guideline links

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.1.214 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.1.214

     └──▷ USE IT
     Use the new builder class when writing custom Kubernetes policies that require edge-specific logic.
     python copy

     from checkov.kubernetes.base_graph_builder import K8SEdgeBuilder

     • Adds K8SEdgeBuilder base class for Kubernetes policy builders
     • Leverages SARIF helpUri field to include guidelines and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. links in output

     2 details in Everything

254. 2.1.210 Sep 15, 2022 · release notes

     Checkov 2.1.210 adds SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. Image Referencer for CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. and S3 upload of run metadata

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.1.210 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.1.210

     • Adds SCA Image Referencer support for CloudFormation templates to enable image vulnerability scanning in IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. workflows.
     • Enables uploading run metadata to an S3 bucket via a new platform integration.

     2 details in Everything

255. 2.1.204 Sep 12, 2022 · release notes

     Adds license suppression by type for SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scans

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.1.204 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.1.204

256. 2.1.201 Sep 8, 2022 · release notes

     Adds intersects and not_intersects policy operators for more expressive condition matching.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.1.201 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.1.201

     • Introduces intersects and not_intersects operator solvers to allow complex list/set comparisons in policies

     1 detail in Everything

257. 2.1.192 Sep 6, 2022 · release notes

     Checkov 2.1.192 adds SCAR ImageReferencer cache data and feature-flag-based secrets scanning.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.1.192 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.1.192

     • Adds image_cached_results field to the ImageReferencer scan output for SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scans
     • Enables scanning all files in the secrets scanner via a new feature flag

     2 details in Everything

258. 2.0.200 Jun 17, 2021 · release notes

     Checkov v2.0.200 adds checks for AmazonMQ public access and Amazon Broker settings.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.0.200 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.0.200

     └──▷ TRY IT
     Detect public access and broker configuration issues in CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. templates during static analysis.
     copy

     $ checkov -d ./infra --check CKV_AWS_164,CKV_AWS_165,CKV_AWS_166,CKV_AWS_69

     • Adds CKV_AWS_164 check for CloudFormation resource coverage
     • Adds CKV_AWS_165 check for CloudFormation resource coverage
     • Adds CKV_AWS_166 check to detect AmazonMQ instances with public access
     • Enhances CKV_AWS_69 logic for Amazon Broker configurations in CloudFormation

     4 details in Everything

259. 2.0.196 Jun 15, 2021 · release notes

     Checkov 2.0.196 introduces native secrets scanning with configurable environment variable support.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.0.196 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.0.196

     └──▷ TRY IT
     Scan local directory for hardcoded secrets using the new dedicated scanner.
     copy

     $ checkov secrets -d .

     Customize secrets scanning behavior via environment variable.
     📍CHECKOV_SECRETS_CONFIG=/path/to/config checkov secrets -d .
     • Adds secrets command-line subcommand for dedicated secrets scanning
     • Introduces environment variable configuration for secrets scanning behavior

     2 details in Everything

260. 2.0.150 May 19, 2021 · release notes

     Adds excluded_paths configuration to runner_filter for platform integrations.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.0.150 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.0.150

261. 2.0.125 May 9, 2021 · release notes

     Checkov 2.0.125 adds Cloudwatch Log Group and Athena Workgroup encryption checks

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.0.125 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.0.125

     • CloudwatchLogGroupEncryption check detects unencrypted CloudWatch log groups

     1 detail in Everything

262. 2.0.60 Apr 20, 2021 · release notes

     Adds --ca-certificate flag and BC_CA_BUNDLE env var to configure TLS CA bundles in Checkov CLI.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.0.60 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.0.60

     • Adds --ca-certificate command-line argument to specify a custom CA bundle for Bridgecrew integration.
     • Adds BC_CA_BUNDLE environment variable as an alternative way to set the CA bundle path.

     2 details in Everything

263. 2.0.57 Apr 19, 2021 · release notes

     Checkov 2.0.57 enables CF Cloudsplaining checks on resources with embedded policies

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.0.57 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.0.57

     • Enable cloudsplaining scanning for CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. resources where the IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policy is directly embedded in the resource definition.

     1 detail in Everything

264. 2.0.56 Apr 19, 2021 · release notes

     Checkov 2.0.56 adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. parameter checking via refactored ARM resource checks.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.0.56 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.0.56

     • Adds arm param check capability (refactored as arm resource checks) to evaluate parameters in Azure Resource Manager templates.

     1 detail in Everything

265. 2.0.0 Apr 8, 2021 · release notes

     Checkov 2.0 adds graph-based variable resolution, multi-resource queries, 230+ new policies

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.0.0 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 2.0.0

     • Introduces a new multi-resource query language that enables YAML-based policy checks spanning multiple resources and their connections via the underlying graph model.
     • Adds 230+ new policy detections covering AWS, GCP, Azure, and Kubernetes resources within the updated detection engine.

     2 details in Everything

266. 1.0.789 Feb 18, 2021 · release notes

     Checkov 1.0.789 expands secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. to Lambda/CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. and generalizes AWS checks.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 1.0.789 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 1.0.789

     • Adds Lambda secrets check for CFN

     1 detail in Everything

267. 1.0.787 Feb 17, 2021 · release notes

     Adds BC_SKIP_MAPPING environment variable to skip mapping API calls

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 1.0.787 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 1.0.787

     └──▷ USE IT
     Skip mapping API calls during a scan to reduce external dependencies or speed up execution.
     shell copy

     BC_SKIP_MAPPING=true checkov -d ./

268. 1.0.784 Feb 17, 2021 · release notes

     Checkov 1.0.784 adds TF parser support for ternary conditions

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 1.0.784 https://github.com/bridgecrewio/checkov.git
     # already have the repo? check out this version:
     $ git checkout 1.0.784