Chapter 41: Terraform Environments and Jenkins Plan Approval Apply Pipeline

41.3 Reading Checkov and tfsec results

By Ravindra Bagale · Last updated: 25 October 2026

In short: Checkov and tfsec are static scanners: they read the code or the plan and compare it with hundreds of rules, such as encryption, public access and open ports.

Story. An Infosys client security team asked for proof that every Terraform change is scanned. Checkov and tfsec are static scanners: they read the code or the plan and compare it with hundreds of rules, such as encryption, public access and open ports. You run them locally before pushing, and Jenkins runs them again so nobody can skip it. Fix the finding, or skip it with a written reason that reviewers see.

pip install checkov
checkov -d envs/dev --framework terraform

tfsec envs/dev

resource "aws_s3_bucket" "logs" {
  #checkov:skip=CKV_AWS_18:Access logging bucket cannot log to itself
  #tfsec:ignore:aws-s3-enable-bucket-logging
  bucket = "badge-logs-<your-account-id>"
}

What each line does

• pip install checkov — Installs Checkov.
• checkov -d envs/dev --framework terraform — Scans every .tf file in the dev folder.
• tfsec envs/dev — Runs tfsec on the same folder.
• #checkov:skip=CKV_AWS_18:... — Skips one Checkov rule for this resource, with the reason after the colon.
• #tfsec:ignore:aws-s3-enable-bucket-logging — Skips the matching tfsec rule for this resource.

When it is green.

Passed checks: 18, Failed checks: 0, Skipped checks: 1
No problems detected!

When it is red.

Result #1 HIGH Security group rule allows ingress from public internet.
  sg.tf:12   cidr_blocks = ["0.0.0.0/0"]   (port 22)
  1 potential problem(s) detected.

Fix. SSH is open to the world. Remove the rule and use Session Manager, or limit it to your office range.

What: every term in plain English

• static scanner — A tool that reads code or a plan and checks it against rules, without creating anything.
• Checkov — An open-source scanner from Prisma Cloud with rule ids such as CKV_AWS_18.
• tfsec — An older Terraform scanner. Its rules now live in Trivy, so new projects run trivy config.
• finding — One rule that failed for one resource, with the file and line.
• skip comment — A comment such as checkov:skip=CKV_AWS_18:reason that ignores one rule for one resource, with a written reason.
• soft fail — The scanner reports but does not fail the build. Useful only while a team cleans up old code.
• plan scan — Scanning the plan JSON, which sees final values from variables and modules.

Example 1: Scan a bucket and read the finding

At an ICICI Lombard vendor, the first Checkov run on old code found 40 issues. Learn to read one finding fully before fixing anything.

1. Write a plain bucket.
2. Run Checkov on the folder.
3. Read the rule id, resource, file and line.

# main.tf
resource "aws_s3_bucket" "logs" {
  bucket = "badge-scan-logs-123456789012"
}

checkov -d . --framework terraform --compact --quiet

Output

terraform scan results:

Passed checks: 2, Failed checks: 5, Skipped checks: 0

Check: CKV_AWS_18: "Ensure the S3 bucket has access logging enabled"
    FAILED for resource: aws_s3_bucket.logs
    File: /main.tf:2-4
Check: CKV2_AWS_6: "Ensure that S3 bucket has a Public Access block"
    FAILED for resource: aws_s3_bucket.logs
    File: /main.tf:2-4
Check: CKV_AWS_144: "Ensure that S3 bucket has cross-region replication enabled"
    FAILED for resource: aws_s3_bucket.logs
    File: /main.tf:2-4

What it shows: Rule id, plain-English title, resource and lines. That is enough to fix or to decide to skip with a reason.

Example 2: Fix the important finding

Public access is the finding that makes news. Fix it first; the scan then passes that rule.

1. Add a public access block.
2. Scan again.
3. Compare the counts.

resource "aws_s3_bucket_public_access_block" "logs" {
  bucket                  = aws_s3_bucket.logs.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

checkov -d . --framework terraform --compact --quiet | grep "Passed checks"

Output

Passed checks: 7, Failed checks: 4, Skipped checks: 0

What it shows: Each fix moves numbers from failed to passed. Keep going until only findings with a reason remain.

Example 3: Skip a rule with a written reason

Cross-region replication doubles cost and a log bucket in a lab does not need it. A Mu Sigma reviewer accepted the skip because the reason was right there in the code.

1. Add the skip comment inside the resource.
2. Scan again.
3. Read the Skipped count.

resource "aws_s3_bucket" "logs" {
  # checkov:skip=CKV_AWS_144:Lab log bucket, replication not needed, approved by platform team
  # checkov:skip=CKV_AWS_18:This bucket is itself the access-log target
  bucket = "badge-scan-logs-123456789012"
}

checkov -d . --framework terraform --compact --quiet | grep -E "Passed|SKIPPED" | head -3

Output

Passed checks: 7, Failed checks: 2, Skipped checks: 2
Check: CKV_AWS_144: "Ensure that S3 bucket has cross-region replication enabled"
    SKIPPED for resource: aws_s3_bucket.logs

What it shows: The skip is visible in the code, in review, and in the report. No hidden exceptions.

Example 4: Run the tfsec rules through Trivy

tfsec development moved into Trivy. Teams at Freshworks-style companies run trivy config with the same kind of rules.

1. Install Trivy.
2. Scan the folder for high and critical issues.

trivy config --severity HIGH,CRITICAL .

Output

main.tf (terraform)
Tests: 9 (SUCCESSES: 7, FAILURES: 2)
Failures: 2 (HIGH: 2, CRITICAL: 0)

AVD-AWS-0088 (HIGH): Bucket does not have encryption enabled
AVD-AWS-0132 (HIGH): Bucket does not encrypt data with a customer managed key.

What it shows: Different ids, same idea. Many teams run Checkov and Trivy together; each catches things the other misses.

Example 5: Scan the plan JSON in Jenkins

Values from variables and modules only appear in the plan. A Netflix-style pipeline scans the plan again just before approval.

1. Create plan JSON after the plan.
2. Run Checkov on the JSON.
3. Fail the build on findings.

stage('Scan plan') {
  steps {
    dir("envs/${params.ENV}") {
      sh 'terraform show -json tfplan > tfplan.json'
      sh 'checkov -f tfplan.json --framework terraform_plan --compact --quiet'
    }
  }
}

Output

terraform_plan scan results:
Passed checks: 18, Failed checks: 0, Skipped checks: 2
[Pipeline] }

What it shows: Delete tfplan.json at the end of the job; like the binary plan, it can contain sensitive values.

Command cheat sheet

Verify: did it work?

1. No failed checks

   checkov -d . --framework terraform --compact --quiet | grep -o "Failed checks: [0-9]*"
   

   Output

   Failed checks: 0
   

2. Skips have reasons

   grep -c "checkov:skip=CKV_[A-Z0-9_]*:[A-Za-z]" main.tf
   

   Output

   2
   

When it is red 1

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
    FAILED for resource: aws_security_group.web

Cause. The code opens SSH to the internet.

Fix, step by step

1. Remove the port 22 rule.
2. Use Session Manager through the instance role.
3. Scan again.

When it is red 2

script returned exit code 1  (Jenkins stage Scan code)

Cause. Checkov found failed checks and the build stopped, which is the goal.

Fix, step by step

1. Open the console log.
2. Fix each finding or add a skip with a reason.
3. Push and run again.

When it is red 3

checkov: command not found

Cause. The Jenkins agent image has no Checkov.

Fix, step by step

1. Add pip install checkov to the agent image.
2. Or run Checkov in a container image in that stage.

Cleanup

terraform destroy -auto-approve
rm -f tfplan tfplan.json

Practice tasks

Homework: try at home

Recap

• Scanners read code or plans and check rules.
• Read rule id, resource and lines before fixing.
• Fix real risks; skip only with a written reason.
• tfsec rules now run through trivy config.
• Scan the plan JSON in Jenkins before approval.

FAQ

Checkov or Trivy?

Both are free. Many teams run both because their rule sets differ.

Does a scan need AWS access?

No for code scans. The plan scan needs a plan, which needs access.

Should every finding be fixed?

Fix real risks. Skip low-value ones with a reason that reviewers accept.

Can I scan modules from the registry?

Checkov can download external modules with --download-external-modules true.

Where do I see all rules?

Run checkov --list for the full list of rule ids.

Interview questions

1. How do you add security scanning to Terraform?

   Run Checkov and Trivy on code locally and in CI, and Checkov on the plan JSON before approval.

2. Why scan the plan as well as the code?

   The plan has final values from variables and modules.

3. How do you handle a false positive?

   A skip comment with rule id and reason, reviewed in the pull request.

4. What happened to tfsec?

   Its rules moved into Trivy; new setups use trivy config.

5. Should scan failures stop the pipeline?

   Yes, except during a short soft-fail cleanup period.

Samajla ka?

Ravi Sir's Cards for this lesson

Revision cardInterview card

मराठी cards