95 lines
1.7 KiB
YAML
95 lines
1.7 KiB
YAML
# Checkov Configuration File
|
|
# Place this file as .checkov.yaml in your project root
|
|
|
|
# Framework selection
|
|
framework:
|
|
- terraform
|
|
- kubernetes
|
|
- dockerfile
|
|
- helm
|
|
|
|
# Checks to skip globally
|
|
skip-check:
|
|
# Development environment exceptions
|
|
- CKV_AWS_17 # RDS backup retention (dev envs)
|
|
- CKV_AWS_8 # CloudWatch log encryption (cost optimization)
|
|
|
|
# Low severity informational checks
|
|
- CKV_AWS_50 # Lambda tracing
|
|
- CKV_K8S_35 # Prefer secrets as files
|
|
|
|
# Paths to exclude from scanning
|
|
skip-path:
|
|
- .terraform/
|
|
- .terragrunt-cache/
|
|
- node_modules/
|
|
- vendor/
|
|
- "**/.git"
|
|
- "**/test/"
|
|
- "**/examples/"
|
|
|
|
# Severity-based configuration
|
|
soft-fail-on:
|
|
- LOW
|
|
- MEDIUM
|
|
|
|
hard-fail-on:
|
|
- CRITICAL
|
|
- HIGH
|
|
|
|
# Compact output mode
|
|
compact: true
|
|
|
|
# Quiet mode (only show failures)
|
|
quiet: false
|
|
|
|
# Download external Terraform modules
|
|
download-external-modules: true
|
|
|
|
# Output configuration
|
|
output:
|
|
- cli
|
|
- json
|
|
- sarif
|
|
|
|
# Output file path
|
|
output-file-path: ./checkov-reports
|
|
|
|
# Repository identification
|
|
repo-id: my-infrastructure
|
|
branch: main
|
|
|
|
# External checks directory
|
|
external-checks-dir:
|
|
- ./custom_checks
|
|
|
|
# Baseline file for drift detection
|
|
# baseline: .checkov.baseline
|
|
|
|
# Enable secrets scanning
|
|
# framework:
|
|
# - secrets
|
|
|
|
# Prisma Cloud/Bridgecrew integration (optional)
|
|
# bc-api-key: ${PRISMA_API_KEY}
|
|
# prisma-api-url: https://api.prismacloud.io
|
|
|
|
# Skip specific resources by regex
|
|
# skip-resources-without-violations: true
|
|
|
|
# CKV check configuration
|
|
# check:
|
|
# - CIS_AWS
|
|
# - CIS_AZURE
|
|
# - CIS_KUBERNETES
|
|
|
|
# Enable/disable specific frameworks
|
|
# skip-framework:
|
|
# - ansible
|
|
# - github_actions
|
|
|
|
# Custom policies metadata filter
|
|
# policy-metadata-filter:
|
|
# severity: HIGH,CRITICAL
|
|
# category: IAM,ENCRYPTION
|