$ show bridgecrewio/checkov
Checkov is a static analysis tool for Infrastructure as Code (IaC) security and compliance. It scans Terraform, CloudFormation, Kubernetes, Helm, Dockerfile, ARM, Bicep, and many other IaC frameworks against thousands of built-in policies covering AWS, Azure, GCP, and other cloud providers. The tool operates as a CLI application and can also be used as a Python library or integrated into CI/CD pipelines. Its architecture is modular, with separate runners per framework, a graph-based analysis engine for cross-resource checks, and a pluggable check registry system. Checkov also includes software composition analysis (SCA) for container images and packages, secrets detection, and integration with the Bridgecrew/Prisma Cloud platform for policy management and reporting.
The LLM identified 4 files worth highlighting for reuse:
Provides an abstract base class for attribute solvers used in graph-based policy evaluation. Each concrete solver (e.g., EqualsAttributeSolver, ContainsAttributeSolver) implements a simple `_get_operation` method, making it easy to add new comparison operators without duplicating infrastructure. The pattern is clean, well-documented, and can be extracted for any rule engine that needs attribute-level filtering.
Implements a composite solver that combines multiple sub-solvers with AND logic. This pattern is used throughout Checkov's graph checks to build complex conditions from simple attribute solvers. The implementation is generic and could be reused in any system that needs to evaluate boolean combinations of predicates against a graph or data structure.
Defines the LocalGraph class that builds an in-memory graph of infrastructure resources and their relationships. It handles vertex creation, edge addition, and provides methods for graph traversal and querying. While somewhat coupled to Checkov's resource model, the core graph-building logic (adding vertices/edges, managing indices) is a reusable pattern for any system that needs to construct a directed graph from parsed configuration files.
Demonstrates a clean integration feature pattern for extending Checkov with platform-specific capabilities. Each feature (custom policies, suppressions, fixes) follows a base class with `pre_scan`, `post_scan`, and `run` hooks. This pattern is reusable for any application that needs a modular, hook-based extension system without tight coupling to the core logic.