The original title is "Applying SAST to Infrastructure as Code (Without TFSec)"

Short summary

This tutorial demonstrates using Checkov, an open-source policy-as-code scanner, to perform static analysis on Infrastructure as Code files like Terraform, CloudFormation, and Pulumi. It walks through scanning a deliberately vulnerable Terraform project, configuring hard/soft fail thresholds, and integrating Checkov into GitHub Actions as a merge gate with SARIF output for native PR annotations. The approach replaces TFSec with a broader tool that covers AWS, Azure, GCP, Kubernetes, Helm, Dockerfile, and more.

• •Checkov scans Terraform, OpenTofu, CloudFormation, Kubernetes, and Pulumi IaC for misconfigurations with 1000+ built-in policies
• •Configurable hard-fail/soft-fail thresholds let CI gates block only critical/high findings while reporting lower severities
• •GitHub Actions integration with SARIF output renders findings natively in GitHub Security tab and inline on pull requests

Generated with AI, which can make mistakes.