Checkov

Integrate Prisma Cloud with Checkov, a static code analysis tool designed to scan code for Infrastructure-as-Code (IaC) misconfigurations, Software Composition Analysis (SCA) issues, exposed secrets and license non-compliance.

See Visualizing Checkov Output for more on Checkov.

1. Before you begin.

   1. Grant the user installing Checkov either the Developer, AppSec Admin, or System Admin role within Prisma. If you prefer to use a custom permission group, Checkov requires:

      • Policies: Policies - 'View' permissions
      • Application Security: Projects - 'View' permissions
      • Settings: Providers - ('View' and 'Create') OR ('View' and 'Update') permissions

The Developer role does not support the use of --policy-metadata-filter and --policy-metadata-filter-exception. This is because these options require permission to call the policies API, which the Developer role does not have. To use these filters, you must either assign a different role to the user or create a custom permission group that includes the necessary permissions noted above.

1. Generate and copy the Prisma Cloud access key to enable access to Prisma Cloud. The access key includes a key ID and secret.
2. Add the Prisma Cloud IP addresses and hostname for Application Security to an allow list to enable access to the Prisma Cloud Console.
3. Best Practice (Mandatory for SCA vulnerability suppression):

   • Run Checkov within your current working directory (<current_directory_path>). It is recommended to use the absolute file path for your current working directory
   • Ensure that the --repo-id parameter includes the <repo_owner_name>/<repo_name> structure, with the <repo_name> matching the exact name of the directory.

     Example: Suppose the present working directory is Users/test/<repo_name>. In this case, the --repo-id parameter must be: --repo-id <repo_owner_name>/<repo_name>, ensuring that <repo_name> precisely matches the directory name within the structure.

     1. On the Prisma Cloud console.
4. In Application Security, select Home > Settings > Connect Provider > Code & Build Providers.

   
5. Select Checkov (under CI/CD Runs) in the catalog that is displayed.

   

   The Checkov integration wizard is displayed.
6. Select a CLI installation tool from the Install Checkov step > Copy the provided command > Next.

   NOTES:

   • CLI tool options: Homebrew (MacOS), Python (pip), Python3 (pip3)
   • Checkov requires Python version 3.8 - 3.10.
   • For additional installation methods, see Installing Checkov.
7. Configure the following attributes in the Set attributes for CLI command step of the wizard.

   • Directory. Required. Hint: IaC root directory
   • Repository ID. Required. Hint: The identity string of the repository <repo_owner>/<repo_name>
   • Branch. Optional. Default: master
8. Select Next.

   1. Trigger a Checkov run from the CLI: Copy the following command to your CLI.

      Replace <PRISMA_ACCESS_KEY>::<PRISMA_SECRET_KEY> with your corresponding access key ID and secret.

      export PRISMA_API_URL=https://api2.prismacloud.io checkov -d Sa --bc-api-key PRISMA_ACCESS_KEY::PRISMA_SECRET_KEY --repo-id <current_directory_path> --<repo_owner>/<repo_name> Sa --branch Sa

      See the Checkov CLI Command Reference for more advanced Checkov run settings, such as --file, --check, --framework.
   2. Select Done.
   3. Next Step.

      • To view connected repositories, in Application Security select Home > Projects > CI/CD Runs tab.
      • To view scan results and resolve issues, in Application Security select Home > Projects. See Monitor and Manage Code Build Issues for more information

Configure Proxy Settings

To ensure Checkov works correctly across all environments, regardless of case sensitivity, the recommendation is to set all four variables: HTTP_PROXY, HTTPS_PROXY, http_proxy, and https_proxy.

• macOS

  # Set proxy environment variables
  export HTTP_PROXY=https://proxy.domain.site
  export HTTPS_PROXY=https://proxy.domain.site
  export http_proxy=https://proxy.domain.site
  export https_proxy=https://proxy.domain.site
  
  # Running Checkov
  export PRISMA_API_URL=https://api2.prismacloud.io
  export BC_API_KEY=<prismaaccesskey>::<prismasecretkey>
  checkov -d . --repo-id <repo_owner>/<repo_name> --use-enforcement-rules

• Windows

  :: Set proxy environment variables
  set HTTP_PROXY=https://proxy.domain.site
  set HTTPS_PROXY=https://proxy.domain.site
  set http_proxy=https://proxy.domain.site
  set https_proxy=https://proxy.domain.site
  
  :: Running Checkov
  set PRISMA_API_URL=https://api2.prismacloud.io
  set BC_API_KEY=<prismaaccesskey>::<prismasecretkey>
  checkov -d . --repo-id <repo_owner>/<repo_name> --use-enforcement-rules

Example Usage

The following example displays the Checkov configuration for scanning the root directory and synchronizing results with the tenant in the App2 stack tenant using Enforcement to set thresholds.

• MAC OS

  export PRISMA_API_URL=https://api2.prismacloud.io
  export BC_API_KEY=prismaaccesskey::prismasecretkey
  checkov -d . --repo-id --<repo_owner>/<repo_name> org/repo --use-enforcement-rules

• Windows

  set PRISMA_API_URL=https://api2.prismacloud.io
  set BC_API_KEY=prismaaccesskey::prismasecretkey
  checkov -d . --repo-id --<repo_owner>/<repo_name> org/repo --use-enforcement-rules