Checkov

Scans infrastructure as code configurations across Terraform, CloudFormation, Kubernetes, Helm, ARM Templates, Serverless framework, and AWS CDK.

Uses Python-based policy-as-code framework to scan cloud resources for misconfigured attributes during build time.

Analyzes relationships between cloud resources with graph-based YAML policies to detect complex misconfigurations.

Integrates with CI/CD pipelines such as Jenkins, GitHub Actions, GitLab CI, and Bitbucket Pipelines to scan IaC files during automated builds.

Allows users to create and contribute custom policies using Python or YAML to tailor security checks to specific needs.

Enables executing, testing, and modifying runner parameters interactively in the terminal within the context of a repository.

Includes scanning capabilities to detect exposed credentials and secrets within infrastructure code.

Supports embedding into existing developer workflows and extending support for custom platforms, build processes, and release systems.