> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/application-security/get-started/connect-code-and-build-providers/ci-cd-runs/add-checkov.md). # Checkov Integrate Prisma Cloud with Checkov, a static code analysis tool designed to scan code for Infrastructure-as-Code (IaC) misconfigurations, Software Composition Analysis (SCA) issues, exposed secrets and license non-compliance. See [Visualizing Checkov Output](https://www.checkov.io/2.Basics/Visualizing%20Checkov%20Output.html) for more on Checkov. 1. Before you begin. 1. Grant the user installing Checkov either the Developer, AppSec Admin, or System Admin role within Prisma. If you prefer to use a custom permission group, Checkov requires: * Policies: Policies - 'View' permissions * Application Security: Projects - 'View' permissions * Settings: Providers - ('View' and 'Create') OR ('View' and 'Update') permissions The Developer role does not support the use of `--policy-metadata-filter` and `--policy-metadata-filter-exception`. This is because these options require permission to call the policies API, which the Developer role does not have. To use these filters, you must either assign a different role to the user or create a custom permission group that includes the necessary permissions noted above. 1. [Generate and copy the Prisma Cloud access key](/content-collections/administration/create-access-keys.md) to enable access to Prisma Cloud. The access key includes a key ID and secret. 2. Add the Prisma Cloud IP addresses and hostname for Application Security to an [allow list](/content-collections/get-started/console-prerequisites.md) to enable access to the Prisma Cloud Console. 3. Best Practice (**Mandatory** for SCA vulnerability suppression): * Run Checkov within your current working directory (\). It is recommended to use the absolute file path for your current working directory * Ensure that the **--repo-id** parameter includes the `/` structure, with the `` matching the exact name of the directory. Example: Suppose the present working directory is `Users/test/`. In this case, the **--repo-id** parameter must be: `--repo-id /`, ensuring that `` precisely matches the directory name within the structure. 1. On the Prisma Cloud console. 4. In Application Security, select **Home** > **Settings** > **Connect Provider** > **Code & Build Providers**.
connect provider menu
5. Select **Checkov** (under CI/CD Runs) in the catalog that is displayed.
connect provider
The Checkov integration wizard is displayed. 6. Select a CLI installation tool from the **Install Checkov** step > Copy the provided command > **Next**. NOTES: * CLI tool options: Homebrew (MacOS), Python (pip), Python3 (pip3) * Checkov requires Python version 3.8 - 3.10. * For additional installation methods, see [Installing Checkov](https://www.checkov.io/2.Basics/Installing%20Checkov.html). 7. Configure the following attributes in the **Set attributes for CLI command** step of the wizard. * **Directory**. Required. Hint: IaC root directory * **Repository ID**. Required. Hint: The identity string of the repository `/` * **Branch**. Optional. Default: master 8. Select **Next**. 1. Trigger a Checkov run from the CLI: Copy the following command to your CLI. Replace `::` with your corresponding access key ID and secret. ``` export PRISMA_API_URL=https://api2.prismacloud.io checkov -d Sa --bc-api-key PRISMA_ACCESS_KEY::PRISMA_SECRET_KEY --repo-id --/ Sa --branch Sa ``` See the Checkov [CLI Command Reference](https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html) for more advanced Checkov run settings, such as `--file`, `--check`, `--framework`. 2. Select **Done**. 3. Next Step. * To view connected repositories, in **Application Security** select **Home** > **Projects** > **CI/CD Runs** tab. * To view scan results and resolve issues, in **Application Security** select **Home** > **Projects**. See [Monitor and Manage Code Build Issues](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/application-security/risk-management/monitor-and-manage-code-build/monitor-and-manage-code-build.md) for more information ## Configure Proxy Settings To ensure Checkov works correctly across all environments, regardless of case sensitivity, the recommendation is to set all four variables: `HTTP_PROXY`, `HTTPS_PROXY`, `http_proxy`, and `https_proxy`. * macOS ``` # Set proxy environment variables export HTTP_PROXY=https://proxy.domain.site export HTTPS_PROXY=https://proxy.domain.site export http_proxy=https://proxy.domain.site export https_proxy=https://proxy.domain.site # Running Checkov export PRISMA_API_URL=https://api2.prismacloud.io export BC_API_KEY=:: checkov -d . --repo-id / --use-enforcement-rules ``` * Windows ``` :: Set proxy environment variables set HTTP_PROXY=https://proxy.domain.site set HTTPS_PROXY=https://proxy.domain.site set http_proxy=https://proxy.domain.site set https_proxy=https://proxy.domain.site :: Running Checkov set PRISMA_API_URL=https://api2.prismacloud.io set BC_API_KEY=:: checkov -d . --repo-id / --use-enforcement-rules ``` ## Example Usage The following example displays the Checkov configuration for scanning the root directory and synchronizing results with the tenant in the App2 stack tenant using [Enforcement](/content-collections/application-security/risk-management/monitor-and-manage-code-build/enforcement.md) to set thresholds. * MAC OS ``` export PRISMA_API_URL=https://api2.prismacloud.io export BC_API_KEY=prismaaccesskey::prismasecretkey checkov -d . --repo-id --/ org/repo --use-enforcement-rules ``` * Windows ``` set PRISMA_API_URL=https://api2.prismacloud.io set BC_API_KEY=prismaaccesskey::prismasecretkey checkov -d . --repo-id --/ org/repo --use-enforcement-rules ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/content-collections/application-security/get-started/connect-code-and-build-providers/ci-cd-runs/add-checkov.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.