{"id":3011,"date":"2023-09-07T09:09:10","date_gmt":"2023-09-07T08:09:10","guid":{"rendered":"https:\/\/www.easydeploy.io\/blog\/?p=3011"},"modified":"2024-01-11T07:41:45","modified_gmt":"2024-01-11T07:41:45","slug":"devsecops-iac-static-code-analysis-checkov-bitbucket","status":"publish","type":"post","link":"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/","title":{"rendered":"Terraform static code analysis to bitbucket pipeline | DevSecOps"},"content":{"rendered":"

Introduction:<\/h3>\n

As a cloud and IAC consulting company. It became vital for us to meet security and compliance standards for all our client deployments. Ever since we adopted infrastructure as code to provision infrastructures to all our client environments we were looking for options to improvise our team’s code standards to ensure we match up with enterprise standards. This is when the need for static code review came and we evaluated a lot of options and finally decided to choose Checkov.<\/a><\/p>\n

Choosing the tool:<\/h3>\n

As a cost<\/a> effective cloud and infrastructure as code consulting company we cannot choose a premium priced tool which will increase our service costs to our customers. Hence, we looked for open source products as our first preference.<\/p>\n

Checkov<\/a> is actively developed and maintained by https:\/\/bridgecrew.io<\/a> and supports major CI\/CD tools. Checkov not only supports terraform, it supports various infrastructure as code scripts like docker,kubernetes, ansible, helm, Azure ARM, AWS Cloudformation, OpenAI etc(covers most of the services we are providing to our customers so, it turned out to be a single tool solving all our needs).<\/p>\n

This attracted us to integrate Checkov<\/a> to our IAC workflow. We use bitbucket to host our coding repositories. Since we tested it on bitbucket, I am going to write this technical blog on how to integrate checkov to perform static code analysis to terraform using bitbucket pipelines.<\/p>\n

Prerequisites:<\/h3>\n

Since this blog only covers the DevSecOps part of terraform, this post assumes that you already have DevOps knowledge and know how to write a terraform\/ansible scripts and basic understanding on bitbucket pipelines and enabled bitbucket pipeline already for the subjective repository.<\/p>\n

We are using Gitflow workflow as our branching strategy and hence we make any new changes using a feature branch.\u00a0 We are also using atlantis<\/a> to manage Pull requests merge changes to target repositories. Thus, we thought to run terraform code analysis on every commit to feature branch.<\/p>\n

Implementation:<\/h3>\n

The code used in the bitbucket-pipelines.yml is below.<\/p>\n

\n
checkov: &checkov\r\n  step:\r\n    name: Checkov\r\n    image:\r\n      name: bridgecrew\/checkov:latest\r\n      entrypoint:\r\n        - '\/usr\/bin\/env'\r\n        - 'PATH=\/usr\/local\/sbin:\/usr\/local\/bin:\/usr\/sbin:\/usr\/bin:\/sbin:\/bin'\r\n    script:\r\n      - checkov -d .\r\npipelines:\r\n    branches:\r\n      feature\/*:\r\n        - <<: *checkov<\/code><\/pre>\n<\/div>\n
Once above pipeline entry is added and pushed to the feature branch. Feature branch will check for code standards of your code.<\/p>\n
checkov in action:<\/h3>\n
Below is the screenshot of the bitbucket pipeline failing because the terraform code is not passing all the checks made by checkov.<\/p>\n
 <\/p>\n
\"bitbucket<\/p>\n
Each failed check will have a guide link explaining the issue and possible solution. Hence, it is very easy to fix the errors and pass the test.<\/p>\n
A passed checkov checks would look like the screenshot below.<\/p>\n
\"\"<\/p>\n
This concludes our blog post on how to implement DevSecOps to your infrastructure as code project. You can contact us<\/a> if you have any requirements on DevOps, DevSecOps, IAC, Azure, AWS, GCP consulting.<\/p>\n
FAQ<\/strong><\/p>\n
    \n
  1. What is the best static code analysis tool for Terraform?<\/strong><\/li>\n<\/ol>\n
    Checkov is the tool that helps to check the vulnerabilities and misconfigurations of Terraform code. It is a free static code analysis tool that anyone can use it and is very easy to use<\/span><\/p>\n
    2. Can I use Bitbucket Pipeline to run Checkov for Terraform?<\/strong><\/p>\n
    Yes, Since Checkov can be integrated with the Bitbucket pipeline, You can store your terraform code in the Bitbucket repository. Enable the pipeline and integrate Checkov with your pipeline to check the vulnerabilities of your terraform code.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"
    Introduction: As a cloud and IAC consulting company. It became vital for us to meet security and compliance standards for all our client deployments. Ever since we adopted infrastructure as code to provision infrastructures to all our client environments we were looking for options to improvise our team’s code standards to ensure we match up […]<\/p>\n","protected":false},"author":4,"featured_media":3035,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[26,458,424],"tags":[],"yoast_head":"\nTerraform static code analysis to bitbucket pipeline | DevSecOps | easydeploy.io<\/title>\n<meta name=\"description\" content=\"How to add static code analysis to your infrastructure as code(terraform, ansible, etc) and achieve DevSecOps adoption to your IAC CI\/CD pipelines.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Terraform static code analysis to bitbucket pipeline | DevSecOps | easydeploy.io\" \/>\n<meta property=\"og:description\" content=\"How to add static code analysis to your infrastructure as code(terraform, ansible, etc) and achieve DevSecOps adoption to your IAC CI\/CD pipelines.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/\" \/>\n<meta property=\"og:site_name\" content=\"easydeploy.io\" \/>\n<meta property=\"article:published_time\" content=\"2023-09-07T08:09:10+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-01-11T07:41:45+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.easydeploy.io\/blog\/wp-content\/uploads\/2023\/09\/devsecops-best-practices.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Siranjeevi R\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Siranjeevi R\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/\"},\"author\":{\"name\":\"Siranjeevi R\",\"@id\":\"https:\/\/www.easydeploy.io\/blog\/#\/schema\/person\/0e7f79e0cd26f6446f7a76d9d2d3b20c\"},\"headline\":\"Terraform static code analysis to bitbucket pipeline | DevSecOps\",\"datePublished\":\"2023-09-07T08:09:10+00:00\",\"dateModified\":\"2024-01-11T07:41:45+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/\"},\"wordCount\":552,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.easydeploy.io\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.easydeploy.io\/blog\/wp-content\/uploads\/2023\/09\/devsecops-best-practices.webp\",\"articleSection\":[\"DevOps\",\"DevSecOps\",\"Terraform\"],\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/\",\"url\":\"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/\",\"name\":\"Terraform static code analysis to bitbucket pipeline | DevSecOps | easydeploy.io\",\"isPartOf\":{\"@id\":\"https:\/\/www.easydeploy.io\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.easydeploy.io\/blog\/wp-content\/uploads\/2023\/09\/devsecops-best-practices.webp\",\"datePublished\":\"2023-09-07T08:09:10+00:00\",\"dateModified\":\"2024-01-11T07:41:45+00:00\",\"description\":\"How to add static code analysis to your infrastructure as code(terraform, ansible, etc) and achieve DevSecOps adoption to your IAC CI\/CD pipelines.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/#primaryimage\",\"url\":\"https:\/\/www.easydeploy.io\/blog\/wp-content\/uploads\/2023\/09\/devsecops-best-practices.webp\",\"contentUrl\":\"https:\/\/www.easydeploy.io\/blog\/wp-content\/uploads\/2023\/09\/devsecops-best-practices.webp\",\"width\":1280,\"height\":720,\"caption\":\"devsecops best practices\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.easydeploy.io\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Terraform static code analysis to bitbucket pipeline | DevSecOps\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.easydeploy.io\/blog\/#website\",\"url\":\"https:\/\/www.easydeploy.io\/blog\/\",\"name\":\"easydeploy.io\",\"description\":\"A Cloud Architect Company\",\"publisher\":{\"@id\":\"https:\/\/www.easydeploy.io\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.easydeploy.io\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.easydeploy.io\/blog\/#organization\",\"name\":\"EasyDeploy Technologies Pvt Ltd\",\"url\":\"https:\/\/www.easydeploy.io\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.easydeploy.io\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.easydeploy.io\/blog\/wp-content\/uploads\/2019\/02\/easydeploy.png\",\"contentUrl\":\"https:\/\/www.easydeploy.io\/blog\/wp-content\/uploads\/2019\/02\/easydeploy.png\",\"width\":536,\"height\":100,\"caption\":\"EasyDeploy Technologies Pvt Ltd\"},\"image\":{\"@id\":\"https:\/\/www.easydeploy.io\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.easydeploy.io\/blog\/#\/schema\/person\/0e7f79e0cd26f6446f7a76d9d2d3b20c\",\"name\":\"Siranjeevi R\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.easydeploy.io\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/353661218917699fcc292e9bc0da9081?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/353661218917699fcc292e9bc0da9081?s=96&d=mm&r=g\",\"caption\":\"Siranjeevi R\"},\"url\":\"https:\/\/www.easydeploy.io\/blog\/author\/siru\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Terraform static code analysis to bitbucket pipeline | DevSecOps | easydeploy.io","description":"How to add static code analysis to your infrastructure as code(terraform, ansible, etc) and achieve DevSecOps adoption to your IAC CI\/CD pipelines.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/","og_locale":"en_GB","og_type":"article","og_title":"Terraform static code analysis to bitbucket pipeline | DevSecOps | easydeploy.io","og_description":"How to add static code analysis to your infrastructure as code(terraform, ansible, etc) and achieve DevSecOps adoption to your IAC CI\/CD pipelines.","og_url":"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/","og_site_name":"easydeploy.io","article_published_time":"2023-09-07T08:09:10+00:00","article_modified_time":"2024-01-11T07:41:45+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/www.easydeploy.io\/blog\/wp-content\/uploads\/2023\/09\/devsecops-best-practices.webp","type":"image\/webp"}],"author":"Siranjeevi R","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Siranjeevi R","Estimated reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/#article","isPartOf":{"@id":"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/"},"author":{"name":"Siranjeevi R","@id":"https:\/\/www.easydeploy.io\/blog\/#\/schema\/person\/0e7f79e0cd26f6446f7a76d9d2d3b20c"},"headline":"Terraform static code analysis to bitbucket pipeline | DevSecOps","datePublished":"2023-09-07T08:09:10+00:00","dateModified":"2024-01-11T07:41:45+00:00","mainEntityOfPage":{"@id":"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/"},"wordCount":552,"commentCount":0,"publisher":{"@id":"https:\/\/www.easydeploy.io\/blog\/#organization"},"image":{"@id":"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/#primaryimage"},"thumbnailUrl":"https:\/\/www.easydeploy.io\/blog\/wp-content\/uploads\/2023\/09\/devsecops-best-practices.webp","articleSection":["DevOps","DevSecOps","Terraform"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/","url":"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/","name":"Terraform static code analysis to bitbucket pipeline | DevSecOps | easydeploy.io","isPartOf":{"@id":"https:\/\/www.easydeploy.io\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/#primaryimage"},"image":{"@id":"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/#primaryimage"},"thumbnailUrl":"https:\/\/www.easydeploy.io\/blog\/wp-content\/uploads\/2023\/09\/devsecops-best-practices.webp","datePublished":"2023-09-07T08:09:10+00:00","dateModified":"2024-01-11T07:41:45+00:00","description":"How to add static code analysis to your infrastructure as code(terraform, ansible, etc) and achieve DevSecOps adoption to your IAC CI\/CD pipelines.","breadcrumb":{"@id":"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/#primaryimage","url":"https:\/\/www.easydeploy.io\/blog\/wp-content\/uploads\/2023\/09\/devsecops-best-practices.webp","contentUrl":"https:\/\/www.easydeploy.io\/blog\/wp-content\/uploads\/2023\/09\/devsecops-best-practices.webp","width":1280,"height":720,"caption":"devsecops best practices"},{"@type":"BreadcrumbList","@id":"https:\/\/www.easydeploy.io\/blog\/devsecops-iac-static-code-analysis-checkov-bitbucket\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.easydeploy.io\/blog\/"},{"@type":"ListItem","position":2,"name":"Terraform static code analysis to bitbucket pipeline | DevSecOps"}]},{"@type":"WebSite","@id":"https:\/\/www.easydeploy.io\/blog\/#website","url":"https:\/\/www.easydeploy.io\/blog\/","name":"easydeploy.io","description":"A Cloud Architect Company","publisher":{"@id":"https:\/\/www.easydeploy.io\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.easydeploy.io\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/www.easydeploy.io\/blog\/#organization","name":"EasyDeploy Technologies Pvt Ltd","url":"https:\/\/www.easydeploy.io\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.easydeploy.io\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.easydeploy.io\/blog\/wp-content\/uploads\/2019\/02\/easydeploy.png","contentUrl":"https:\/\/www.easydeploy.io\/blog\/wp-content\/uploads\/2019\/02\/easydeploy.png","width":536,"height":100,"caption":"EasyDeploy Technologies Pvt Ltd"},"image":{"@id":"https:\/\/www.easydeploy.io\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.easydeploy.io\/blog\/#\/schema\/person\/0e7f79e0cd26f6446f7a76d9d2d3b20c","name":"Siranjeevi R","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.easydeploy.io\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/353661218917699fcc292e9bc0da9081?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/353661218917699fcc292e9bc0da9081?s=96&d=mm&r=g","caption":"Siranjeevi R"},"url":"https:\/\/www.easydeploy.io\/blog\/author\/siru\/"}]}},"_links":{"self":[{"href":"https:\/\/www.easydeploy.io\/blog\/wp-json\/wp\/v2\/posts\/3011"}],"collection":[{"href":"https:\/\/www.easydeploy.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.easydeploy.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.easydeploy.io\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.easydeploy.io\/blog\/wp-json\/wp\/v2\/comments?post=3011"}],"version-history":[{"count":6,"href":"https:\/\/www.easydeploy.io\/blog\/wp-json\/wp\/v2\/posts\/3011\/revisions"}],"predecessor-version":[{"id":3401,"href":"https:\/\/www.easydeploy.io\/blog\/wp-json\/wp\/v2\/posts\/3011\/revisions\/3401"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.easydeploy.io\/blog\/wp-json\/wp\/v2\/media\/3035"}],"wp:attachment":[{"href":"https:\/\/www.easydeploy.io\/blog\/wp-json\/wp\/v2\/media?parent=3011"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.easydeploy.io\/blog\/wp-json\/wp\/v2\/categories?post=3011"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.easydeploy.io\/blog\/wp-json\/wp\/v2\/tags?post=3011"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}