OptionsOn checkov itself
--help-h
Show help for checkov
--version-v
Show the version of checkov
--quiet
CLI output, display only failed checks
--compact
CLI output, do not display code blocks
--no-guide
Do not fetch Bridgecrew platform IDs and guidelines for the checkov output report. Note: this prevents Bridgecrew platform check IDs from being used anywhere in the CLI
--output-bc-ids
Print Bridgecrew platform IDs (BC...) instead of Checkov IDs (CKV...), if the check exists in the platform
--directory-d
IaC root directory (can not be used together with --file) <Directory>
--output-o
Report output format. Add multiple outputs by using the flag multiple times (-o sarif -o cli) <FORMAT>
--framework
IaC frameworks to include checks for <FRAMEWORKS>
--skip-framework
IaC frameworks to exclude checks for <FRAMEWORKS>
--add-check
Generate a new check via CLI prompt
--file-f
IaC file(can not be used together with --directory) <FILE>
--skip-path
Path (file or directory) to skip, using regular expression logic, relative to current working directory. Word boundaries are not implicit; i.e., specifying 'dir1' will skip any directory or subdirectory named 'dir1'. Ignored with -f. Can be specified multiple times <SKIP_PATH>
--check-c
Filter scan to run only on a specific check identifier (allowlist). You can specify multiple checks separated by comma delimiter. You may also use the environment variable: CKV_CHECK <CHECKS>
--skip-check
Filter scan to run all check except a specific check identifier (denylist). You can specify multiple checks separated by comma delimiter. You may also use the environment variable: CKV_SKIP_CHECK <CHECKS>
--run-all-external-checks
Run all external checks (loaded via --external-checks options) even if the checks are not present in the --check list. This allows you to always ensure that new checks present in the external source are used. If an external check is included in --skip-check, it will still be skipped
--external-checks-dir
Directory for custom checks to be loaded. Can be repeated <EXTERNAL_CHECKS_DIR>
--bc-api-key
Bridgecrew API key. You may also use the environment variable: BC_API_KEY <BC_API_KEY>
--docker-image
Scan docker images by name or ID. Only works with --bc-api-key flag <DOCKER_IMAGE>
--dockerfile-path
Path to the Dockerfile of the scanned docker image <DOCKERFILE_PATH>
--repo-id
Identity string of the repository, with form <repo_owner>/<repo_name> <REPO_ID>
--branch-b
Selected branch of the persisted repository. Only has effect when using the --bc-api-key flag <BRANCH>
--skip-fixes
Do not download fixed resource templates from Bridgecrew. Only has an effect when using the --bc-api-key flag
--skip-suppressions
Do not download preconfigured suppressions from the Bridgecrew platform. Code comment suppressions will still be honored. Only has an effect when using the --bc-api-key flag
--skip-policy-download
Do not download custom policies configured in the Bridgecrew platform. Only has an effect when using the --bc-api-key flag
--download-external-modules
Download external terraform modules from public git repositories and terraform registry. You may also use the environment variable: DOWNLOAD_EXTERNAL_MODULES] <DOWNLOAD_EXTERNAL_MODULES>
--var-file
Variable files to load in addition to the default files (see https://www.terraform.io/docs/language/values/variables.html#variable-definitions-tfvars-files). Currently only supported for source Terraform (.tf file), and Helm chart scans. Requires using --directory, NOT --file <VAR_FILE>
--external-modules-download-path
Set the path for the download external terraform modules. You may also use the environment variable: EXTERNAL_MODULES_DIR <EXTERNAL_MODULES_DIR>
--evaluate-variables
Evaluate the values of variables and locals <EVALUATE_VARIABLES>
--ca-certificate-ca
Custom CA (bundle) fila. You may also use the environment variablee: CA_CERTIFICATE <CA_CERTIFICATE>
--repo-root-for-plan-enrichment
Directory containing the hcl code used to generate a given plan file. Use with -f FILE <REPO_ROOT_FOR_PLAN_ENRICHMENT>
--config-file
Path to the Checkov configuration YAML file <CONFIG_FILE>
--create-config
Takes the current command line args and writes them out to a config file at the given path <CONFIG_FILE>
--show-config
Prints all arguments and config settings and where they came from (eg. commandline, config file, environment variable or default)
--create-baseline
Save all current results to a '.checkov.baseline' file so future runs will only flag new findings. Works only with `--directory` flag
--baseline
Use a '.checkov.baseline' file to compare current results with a known baseline. Report will include only failed checks that are newwith respect to the provided baseline. See --create-baseline <BASELINE>
--soft-fail-s
Runs checks but suppresses the error code
--soft-fail-on
Exits with a 0 exit code for specified checks. You can specify multiple checks separated by comma delimiter <CHECKS>
--hard-fail-on
Exits with a non-zero exit code for specified checks. You can specify multiple checks separated by comma delimiter <CHECKS>
--min-cve-severity
Set minimum severity to return a non-zero exit code <MIN_SEVERITY>
--skip-cve-package
Ignore specific open source package when SCA scanning for CVEs in package dependencies. Can be used multiple times to skip multiple packages <SKIP_CVE_PACKAGE>
--use-enforcement-rules
Use the Enforcement rules configured in the platform for hard / soft fail logic <USE_ENFORCEMENT_RULES>
--support
Enable debug logs and upload the logs to the server <SUPPORT>
--summary-position
Chose whether the summary will be appended on top or on bottom <SUMMARY_POSITION>
--skip-resources-without-violations
Exclude extra resources (resources without violations) <SKIP_RESOURCES_WITHOUT_VIOLATIONS>
--skip-download
Do not download any data from Prisma Cloud <SKIP_DOWNLOAD>
--secrets-history-timeout
Maximum time to run the history scan <SECRETS_HISTORY_TIMEOUT>
--scan-secrets-history
Will scan the history of commits for secrets <SCAN_SECRETS_HISTORY>
--prisma-api-url
The Prisma Cloud API URL <PRISMA_API_URL>
--policy-metadata-filter
Comma separated key:value string to filter policies based on Prisma Cloud policy metadata <POLICY_METADATA_FILTER>
--output-file-path
Name of the output folder to save the chosen output formats <OUTPUT_FILE_PATH>
--output-baseline-as-skipped
Output checks that are skipped due to baseline file presence <OUTPUT_BASELINE_AS_SKIPPED>
--openai-api-key
Add an OpenAI API key to enhance finding guidelines. This will send Code to OpenAI <OPENAI_API_KEY>
--no-fail-on-crash
Return exit code 0 instead of 2 <NO_FAIL_ON_CRASH>
--mask
Each entry in the list will be used for masking the desired attribute <MASK>
--include-all-checkov-policies
When running with an API key, Checkov will omit any policies that do not exist in the Bridgecrew or Prisma Cloud platform <INCLUDE_ALL_CHECKOV_POLICIES>
--external-checks-git
GitHub URL of external checks to be added <EXTERNAL_CHECKS_GIT>
--enable-secret-scan-all-files
Enable secret scan for all files <ENABLE_SECRET_SCAN_ALL_FILES>
--deep-analysis
Enable combine TF graph and TF Plan graph <DEEP_ANALYSIS>
--block-list-secret-scan
List of files to filter out from the secret scanner <BLOCK_LIST_SECRET_SCAN>
