Checkov

Judgement

What it is

Developer tool

What it does

Statically scans Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and other infrastructure code for security and compliance misconfigurations, and checks packages for known vulnerabilities.

Adopt it when

You want a policy check on infrastructure code in CI with a large built-in rule set and custom rules in Python or YAML.

Watch out

It is owned by Palo Alto Networks and steers toward Prisma Cloud, and the default rule set produces many findings you will need to tune.

Ready for

Production-ready

Runs as

Command line

Built with

Python

How established

Established: started 7 years ago, latest release 3.4.3.

What the license allows

You can build it into a product you sell, as long as you keep its copyright notice.

Judged on 2026-11-06 from the project's README and GitHub data. The license and age lines are worked out directly.

Built from

Follow it down: Checkov → CPython → GCC → LLVM project → runs on a microchip

How compilers were built, back to punched paper tape

Open-source alternatives to Checkov

1. 1
   Terraform hashicorp

   Terraform enables you to safely and predictably create, change, and improve infrastructure. It is a source-available tool that codifies APIs into declarative configuration files that can be shared amongst team members, treated as code, edited, reviewed, and versioned.

   Developer tool Production-ready Your team provisions infrastructure across one or more cloud providers and wants it reviewed and versioned as code with the largest provider ecosystem available.

   ★ 50k See repository Go Active, pushed today
   
2. 2
   Trivy aquasecurity

   Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

   Developer tool Production-ready You want one free scanner in CI that covers container images, dependencies and infrastructure code instead of several separate tools.

   ★ 39k Apache-2.0 Go Active, pushed today
3. 3
   OpenTofu opentofu

   OpenTofu lets you declaratively manage your cloud infrastructure.

   Developer tool Production-ready You want Terraform-style infrastructure management under an open-source licence, without HashiCorp's Business Source Licence.

   ★ 31k MPL-2.0 Go Active, pushed today
   
4. 4
   Kestra kestra-io

   Orchestrate everything, everywhere. The open-source control plane for workflows across data, infrastructure, business processes and AI agents. Declarative YAML, event-driven, any language, Git-versioned, scalable to millions of executions.

   Complete system Production-ready You need Airflow-class orchestration but want YAML flows, any language, and a UI non-Python people can use.

   ★ 30k Apache-2.0 Java Active, pushed today
5. 5
   Pulumi pulumi

   Pulumi - Infrastructure as Code in any programming language 🚀

   Developer tool Production-ready Your engineers would rather write infrastructure in a general-purpose language with loops, functions and tests than learn HCL.

   ★ 26k Apache-2.0 Go Active, pushed today
6. 6
   Salt saltstack

   Software to automate the management and configuration of infrastructure and applications at scale.

   Developer tool Production-ready You manage a large fleet of servers and need fast remote execution plus configuration management with an agent on each machine.

   ★ 16k Apache-2.0 Python Active, pushed today
7. 7
   AWS CDK aws

   The AWS Cloud Development Kit is a framework for defining cloud infrastructure in code

   Framework or platform Production-ready Everything you run is on AWS and you want typed, reusable infrastructure code that stays inside CloudFormation's deployment model.

   ★ 13k Apache-2.0 TypeScript Active, pushed today
8. 8
   Encore encoredev

   Infrastructure orchestration from local to your cloud

   Framework or platform Usable You are starting a new backend and want infrastructure derived from application code instead of writing Terraform yourself.

   ★ 13k MPL-2.0 Go Active, pushed 2 days ago