The Complete Production SOP: How to Deploy and Run Checkov Static Code Analysis for Cloud & Kubernetes in Autonomous AI Agents

---
name: "checkov-iac-compliance-scanner"
description: "Enforce security and compliance policies across Terraform, CloudFormation, Helm, and Dockerfiles."
metadata:
  author: "Bridgecrew"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "run checkov scan"
  - "write custom checkov policy"
  - "checkov framework terraform"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: true
  net_access: false
---

# Checkov Static Code Analysis Execution Rules
1. Run scan: `checkov -d . --framework terraform,kubernetes,dockerfile -o json --compact`
2. Filter findings: focus exclusively on HIGH and CRITICAL violations.
3. Implement immediate in-place remediation for failing attributes.
4. Re-run scan to verify 0 high/critical policy violations before completing task.

metadata:
  name: "Ensure S3 bucket server-side encryption is enabled"
  id: "CKV2_CUSTOM_01"
  category: "ENCRYPTION"
scope:
  provider: "aws"
definition:
  and:
    - cond_type: "filter"
      value:
        - "aws_s3_bucket"
      attribute: "resource_type"
      operator: "within"
    - cond_type: "connection"
      resource_types:
        - "aws_s3_bucket_server_side_encryption_configuration"
      operator: "exists"

#!/usr/bin/env bash
set -euo pipefail

checkov \
  -d . \
  --framework terraform,kubernetes,dockerfile \
  --severity HIGH,CRITICAL \
  --soft-fail \
  --output json \
  > checkov_report.json

echo "Report written to checkov_report.json. Evaluation completed."

resource "aws_s3_bucket" "audit_logs" {
  bucket = "corp-audit-logs-prod"
}

# Enforced by checkov-iac-compliance-scanner remediation
resource "aws_s3_bucket_server_side_encryption_configuration" "audit_logs" {
  bucket = aws_s3_bucket.audit_logs.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

resource "aws_s3_bucket_public_access_block" "audit_logs" {
  bucket                  = aws_s3_bucket.audit_logs.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}