Your Infrastructure Has Bugs Too: Scanning Terraform with Checkov (IaC SAST)

Short summary

Checkov is an open-source SAST tool that scans Terraform, CloudFormation, and Kubernetes manifests for infrastructure misconfigurations without touching your cloud account. This tutorial walks through intentionally vulnerable AWS configurations (public S3 buckets, open security groups, hardcoded credentials), finds 35 security issues, remediates each, and wires the scan into GitHub Actions as a build gate. The result: zero failed checks with all skipped checks auditable and justified.

• •Checkov scans Infrastructure as Code (Terraform, CloudFormation, K8s) for 1,000+ built-in security policies without cloud credentials
• •Real-world example: 70 lines of Terraform revealed 35 misconfigurations matching famous breaches (Capital One, Accenture, voter records leak)
• •CI/CD integration via GitHub Actions fails builds on security regressions, shifting infrastructure compliance left

Generated with AI, which can make mistakes.