CDK Checkov Validator Plugin

---

The APIs of higher level constructs in this module are experimental and under active development. They are subject to non-backward compatible changes or removal in any future version. These are not subject to the Semantic Versioning model and breaking changes will be announced in the release notes. This means that while you may use them, you may need to update your source code when upgrading to a newer version of this package.

---

Installation

TypeScript/JavaScript

npm install @bridgecrew/cdk-validator-checkov

Python

pip install cdk-validator-checkov

Usage

To use this plugin in your CDK application add it to the CDK App.

Python

from cdk_validator_checkov import CheckovValidator

...

App(
  policy_validation_beta1=[
    CheckovValidator()
  ]
)

By default, the CheckovValidator plugin comes with all checkov built-in checks for CloudFormation. In order to disable any of the checks or just run a subset of them you can use the check or skipCheck property.

CheckovValidator(
  check= ['CKV_AWS_18', 'CKV_AWS_21']
)

CheckovValidator(
  skipCheck= ['CKV_AWS_18', 'CKV_AWS_21']
}

TypeScript

new App({
  policyValidationBeta1: [
    new CheckovValidator(),
  ],
});

Specify checks:

new CheckovValidator({
    check: ['CKV_AWS_18', 'CKV_AWS_21'],
});

Skip checks:

new CheckovValidator({
    skipCheck: ['CKV_AWS_18', 'CKV_AWS_21'],
});

Troubleshooting

If you are getting Error: spawnSync checkov ENOBUFS error, please try to set CHECKOV_MAX_BUFFER_SIZE_MB environment variable to numeric value above 1. It's setting maxBuffer parameter for spawnSync function under the hood.