Free readiness test
Home / Tool labs / Checkov

Checkov hands-on lab Review the data-lake Terraform

Catch cloud misconfigurations in Terraform before they're deployed.

DevSecOpsIntermediatePro live lab4 objectives
cloudsec@review:~/infra$
$ cat terraform/main.tf
resource "aws_s3_bucket" "lake" {
  bucket = "acme-analytics-lake"
}

resource "aws_s3_bucket_acl" "lake" {
  bucket = aws_s3_bucket.lake.id
  acl    = "public-read"          # should be private + block public access
}

What is Checkov?

Checkov scans infrastructure-as-code (Terraform, CloudFormation, Kubernetes, Bicep, Dockerfiles) against hundreds of security policies, so insecure cloud resources are caught in code review instead of production.

1 IaC scanning

Misconfigurations like public buckets and open security groups are found in code, before 'terraform apply'.

2 Policies

Each check has an ID (e.g. CKV_AWS_24) mapped to benchmarks such as CIS.

3 Suppressions

Accepted risks are skipped in code with a written justification, keeping exceptions visible.

The scenario: Review the data-lake Terraform

A pull request adds the analytics data lake on AWS. Scan terraform/, understand the failures, read the risky code, and record an approved exception properly.

Run this lab live in the platform

A simulated terminal with 4 objectives, hints and scenario questions. Included with NERvE Pro.

Open the Checkov lab

Step-by-step: Checkov commands used in this lab

1Scan the Terraform folder

checkov -d <dir>

checkov -d terraform/

2Read the risky resources

cat terraform/main.tf

cat terraform/main.tf

3Re-run showing only failures, compactly

--compact --quiet

checkov -d terraform/ --compact --quiet

4Scan with an approved exception skipped

--skip-check with the access-logging check ID.

checkov -d terraform/ --skip-check CKV_AWS_18 --compact --quiet

Key takeaways

Install Checkov and practise for real

pipx install checkov   # then: checkov -d .

Scan the Terraform examples in public 'insecure by design' repos like TerraGoat. Only scan or test systems you own or are explicitly authorised to assess. Official site: www.checkov.io · Licence: Apache 2.0.

Scenario questions

Which finding could expose the most data?

Answer: public-read ACL on the data lake bucket. A public-read bucket lets anyone on the internet list and download the data.

Best fix for SSH open to 0.0.0.0/0?

Answer: Remove public SSH: use SSM Session Manager or restrict to the VPN range. Don't expose management ports to the internet; use brokered access.

How should accepted risks be handled?

Answer: Inline checkov:skip with a justification and risk reference. Documented, reviewable exceptions keep governance intact.

More open-source tool labs

🐳

Trivy

Scan container images, code and Kubernetes manifests for vulnerabilities and misconfigurations.

🧪

Semgrep

Find security bugs in source code with fast, readable rules.

🔑

Gitleaks

Find passwords, keys and tokens committed to Git, then stop it happening again.

📡

Nmap

Discover hosts, open ports and services on networks you're authorised to assess.

🦈

Wireshark / tshark

See exactly what's crossing the wire and spot malware calling home.

🔭

Zeek

Turn raw traffic into rich, searchable logs for threat hunting.