Checkov: catching misconfigured infrastructure code before it merges

Checkov, maintained by Bridgecrew under the bridgecrewio/checkov GitHub project, is an open-source static analysis tool that scans infrastructure-as-code — Terraform, Terraform plans, Kubernetes manifests, CloudFormation, Helm charts, Bicep and several other formats — for security and compliance misconfigurations before that infrastructure is ever provisioned.

Where it fits in an MSP's pipeline

Checkov's natural home is pull-request CI: run it against a Terraform plan or a Kubernetes manifest as part of the merge check, and treat a policy failure as a merge blocker rather than a warning to fix later. Its checks are graph-based, meaning they can verify relationships between resources — for example, that an EC2 instance is actually attached to a network interface inside a VPC-scoped subnet — rather than only inspecting one resource's attributes in isolation. It also does basic secrets detection, recognizing known credential formats such as AWS access keys and flagging high-entropy strings that look like randomized secrets.

A different lane from container scanning

It's worth being precise about what Checkov is not: it doesn't scan container images or open-source package dependencies for known CVEs — that's the job of tools like Grype or OSV-Scanner, which most MSPs likely already run somewhere in their pipeline. Checkov's lane is configuration posture in the infrastructure code itself, before any cloud resource exists to scan. Running both is complementary, not redundant.

The CLI is free under the Apache 2.0 license with no scan limits or telemetry gate on results, and ships with official integrations for GitHub Actions, GitLab and JetBrains IDEs, so adding it to an existing pipeline is largely a matter of wiring in the action rather than standing up new infrastructure. For MSPs running IaC on behalf of clients, a fail-closed Checkov gate in CI is a cheap way to catch a public S3 bucket or an overly permissive security group before it's ever applied.

Sources: GitHub — bridgecrewio/checkov.