0004. Checkov over tfsec for IaC Scanning

Status

Accepted

Context

The quality gate needs a static analysis tool for infrastructure-as-code. The two main candidates historically were:

• tfsec: Terraform-specific, fast, low false-positive rate.
• Checkov: Multi-framework (Terraform, Dockerfile, Ansible, Kubernetes, CloudFormation, etc.), 1000+ built-in policies, graph-based cross-resource analysis.

As of 2024, tfsec has been deprecated and archived. Its maintainers migrated all checks into Trivy. tfsec does not support Terraform 1.5+.

Decision

Use Checkov as the IaC static analysis tool. Install via pip under the mise-managed Python.

Configure it in .pre-commit-config.yaml to scan Terraform, Dockerfile, and Ansible frameworks.

Consequences

Easier: - Single tool covers all IaC frameworks in the repo (Terraform, Dockerfile, Ansible), not just Terraform. - Actively maintained with regular releases. - Integrates with pre-commit hooks natively. - Python-based, so it runs natively in the mise-managed Python environment.

Harder: - Slower than tfsec was (Python vs Go), especially on large Terraform codebases. - More verbose output; may need --skip-check for false positives. - Requires Python runtime (already present via mise, so no extra cost).