Bridgecrew Terraform: Pricing, Use Cases, Best Practices & Alternatives

# Install via pip
pip install checkov
 
# Or using Homebrew on macOS
brew install checkov
 
# Or run with Docker
docker run --rm -v $(pwd):/tf bridgecrew/checkov -d /tf

# Scan current directory
checkov -d .
 
# Scan specific file
checkov -f main.tf
 
# Output results as JSON
checkov -d . -o json
 
# Run specific check
checkov -d . --check CKV_AWS_20

# This S3 bucket has multiple security issues
resource "aws_s3_bucket" "vulnerable" {
  bucket = "my-public-bucket"
  acl    = "public-read"  # Issue: Public access
  
  # Issue: No encryption
  # Issue: No versioning
  # Issue: No logging
}
 
resource "aws_security_group" "wide_open" {
  name = "allow_all"
  
  ingress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]  # Issue: Open to world
  }
}

resource "aws_s3_bucket" "secure" {
  bucket = "my-private-bucket"
}
 
resource "aws_s3_bucket_acl" "secure" {
  bucket = aws_s3_bucket.secure.id
  acl    = "private"
}
 
resource "aws_s3_bucket_server_side_encryption_configuration" "secure" {
  bucket = aws_s3_bucket.secure.id
  
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}
 
# Suppression example when public access is intended
resource "aws_s3_bucket" "static_website" {
  #checkov:skip=CKV_AWS_20:Public website bucket
  bucket = "my-website-files"
  acl    = "public-read"
}

name: Terraform Security Scan
 
on: [pull_request]
 
jobs:
  checkov:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Run Checkov
        id: checkov
        uses: bridgecrewio/checkov-action@master
        with:
          directory: .
          framework: terraform
          output_format: sarif
          output_file_path: results.sarif
          
      - name: Upload SARIF results
        if: always()
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: results.sarif

checkov:
  stage: test
  image:
    name: bridgecrew/checkov:latest
    entrypoint: [""]
  script:
    - checkov -d . -o junitxml --output-file-path checkov.test.xml
  artifacts:
    reports:
      junit: checkov.test.xml
    paths:
      - checkov.test.xml

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/bridgecrewio/checkov.git
    rev: 2.5.0
    hooks:
      - id: checkov
        args: ['--framework', 'terraform', '--compact']

# Don't fail builds initially
checkov -d . --soft-fail

# Fail only on critical issues
checkov -d . --check CKV_AWS_20,CKV_AWS_21 --hard-fail-on HIGH

# my_custom_check.py
from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
from checkov.common.models.enums import CheckResult, CheckCategories
 
class S3BucketNaming(BaseResourceCheck):
    def __init__(self):
        name = "Ensure S3 buckets follow naming convention"
        id = "CKV_CUSTOM_1"
        supported_resources = ['aws_s3_bucket']
        categories = [CheckCategories.CONVENTION]
        super().__init__(name=name, id=id, categories=categories, 
                        supported_resources=supported_resources)
 
    def scan_resource_conf(self, conf, entity_type):
        bucket_name = conf.get("bucket", [""])[0]
        if bucket_name.startswith("company-"):
            return CheckResult.PASSED
        return CheckResult.FAILED
 
check = S3BucketNaming()

resource "aws_db_instance" "main" {
  #checkov:skip=CKV_AWS_17:Dev environment doesn't need encryption
  #checkov:skip=CKV_AWS_16:Using default master username is acceptable
  
  identifier     = "dev-database"
  engine         = "postgres"
  instance_class = "db.t3.micro"
}